CERT Resilience Management Model, Version 1.0

Table 1:Process Areas in CERT-RMM and CMMI ModelsCMMI Models Process AreasCAM – Capacity andAvailability Management(CMMI-SVC only)Equivalent CERT-RMM Process AreasTM – Technology ManagementCERT-RMM addresses capacity management from the perspective oftechnology assets. It does not address the capacity of services.Availability management is a central theme of CERT-RMM, significantlyexpanded from CMMI-SVC. Service availability is addressed in CERT-RMM bymanaging the availability requirement for people, information, technology, andfacilities. Thus, the process areas that drive availability management includeRRD – Resilience Requirements Development (where availabilityrequirements are established)RRM – Resilience Requirements Management (where the lifecycle of availability requirements is managed)EC – Environmental Control (where the availability requirementsfor facilities are implemented and managed)KIM – Knowledge and Information Management (where theavailability requirements for information are implemented andmanaged)PM – People Management (where the availability requirements forpeople are implemented and managed)TM – Technology Management (where the availability requirementsfor software, systems, and other technology assets are implementedand managed)IRP – Incident Resolution andPrevention(CMMI-SVC only)IMC – Incident Management and ControlIn CERT-RMM, IMC expands IRP to address a broader incident managementsystem and incident life cycle at the asset level. Workarounds in IRP areexpanded in CERT-RMM to address incident response practices.MA – Measurement andAnalysisMA – Measurement and Analysis is carried over intact from CMMI.In CERT-RMM, MA is directly connected to MON – Monitoring, which explicitlyaddresses data collection that can be used for MA activities.OPD – Organizational ProcessDefinitionOPD – Organizational Process Definition is carried over from CMMI, butdevelopment life-cycle-related activities and examples are deemphasized oreliminated.OPF – Organizational ProcessFocusOT – Organizational TrainingOPF – Organizational Process Focus is carried over intact from CMMI.OTA – Organizational Training and AwarenessOT is expanded to include awareness activities in OTA.REQM – RequirementsManagementRRM – Resilience Requirements ManagementBasic elements of REQM are included in RRM, but the focus is on managingthe resilience requirements for assets and services, regardless of where theyare in their development cycle.RD – RequirementsDevelopmentRRD – Resilience Requirements DevelopmentBasic elements of RD are included in RRM, but practices differ substantially.11 | CMU/SEI-2010-TR-012