CERT Resilience Management Model, Version 1.0

possible (nor does it make good business sense) to mitigate all risks and improve all processes.High-value services are fueled by organizational assets such as people, information, technology,and facilities.2.2.2 Business ProcessesA business process is a series of discrete activities or tasks that contribute to the fulfillment of aservice mission. Think of a business process as the next level of decomposition for a service, anda service as the aggregation of all of the business processes necessary for service success. A singlebusiness process may support multiple services. As with services, business processes can traversethe organization and cross organizational lines. In addition, business processes are oftenperformed outside of the boundaries of the organization. Each business process mission mustenable the service mission it supports. In the CERT-RMM, any discussion of services can beunderstood to be referring to all their component business processes as well.2.2.3 AssetsAn asset is something of value to the organization. Services and business processes are “fueled”by assets—the raw materials that services need to operate. 6 A service cannot accomplish itsmission unless there arepeople to operate and monitor the servicesinformation and data to feed the process and to be produced by the servicetechnology to automate and support the servicefacilities in which to perform the serviceSuccess at achieving the organization’s mission relies on critical dependencies betweenorganizational goals and objectives, services, and associated high-value assets. Operationalresilience starts at the asset level. To ensure operational resilience at the service level, relatedassets must be protected from threats and risks that could disable them. Assets must also besustainable (able to be recovered and restored to a defined operating condition or state) duringtimes of disruption and stress. The optimal mix of protect and sustain strategies depends onperforming tradeoff analysis that considers the value of the asset and the cost of deploying andmaintaining the strategy.As shown in Figure 7, failure of one or more assets (due to disruptive events, realized risk, orother issues) has a cascading impact on the mission of related business processes, services, andthe organization as a whole. Failure can impede mission assurance of associated services and cantranslate into failure to achieve organizational goals and objectives. Thus, ensuring the operationalresilience of high-value assets is paramount to organizational success.6In CERT-RMM, we take a ―cyber‖ approach to resilience. That is, we specifically exclude considerations of othertangible, raw materials which are important to the delivery of some services and most manufacturing processes.This is not to say that physical materials cannot be considered in CERT-RMM, but explicit processes andpractices for this are not included in the core model.22 | CMU/SEI-2010-TR-012