CERT Resilience Management Model, Version 1.0

according to the organization’s tailoring guidelines. The process also contributes work products,measures, and other process improvement information as organizational process assets for use byall organizational units [CMMI 2007].What does this ultimately mean to the organization? One of the principle challenges for effectiveoperational resilience management is the ability to get all parts of the organization to coalescearound common goals and objectives. When different parts of the organization operate withdifferent goals, assumptions, and practices, it is difficult if not impossible to ensure that theorganization’s collective goals and objectives can be reached. This is particularly true with crosscuttingconcerns such as operational risk management. If the organization’s risk assumptions arenot reflected consistently in security, continuity, and IT operations activities, the organization’srisk management process will be less than effective and perhaps significantly detrimental tooverall operational resilience.At capability level 3, alignment begins to occur because the standards, process descriptions, andprocedures used for operational resilience management at the organizational unit level are tailoredfrom the organization’s standard set of operational resilience management processes. Atcapability level 2, each organizational unit may be improving the degree to which processes areinstitutionalized for that unit, but the organization is not necessarily reaping improvement benefitsas a whole. At capability level 3, this begins to occur because there is more consistency acrossunits, and improvements made by each organizational unit can be accessed and used by theorganization through an organization-level improvement infrastructure.Another critical distinction at capability level 3 is that processes are typically described morerigorously than at capability level 2. A defined process clearly states the purpose, inputs, entrycriteria, activities, roles, measures, verification steps, outputs, and exit criteria. At capability level3, processes are managed more proactively using an understanding of the interrelationships of theprocess activities and details [CMMI 2007].5.3.5 Other Capability LevelsIf your organization uses the CMMI models, you are likely to be familiar with two othercapability levels—capability level 4, quantitatively managed, and capability level 5, optimized.Both these levels address the use of statistical and other quantitative techniques to control andimprove processes. Beginning at capability level 4, process quality and performance is understoodin statistical terms, and at capability level 5, common causes of process variation are understoodand utilized for improving the range of process performance.In CERT-RMM, it is unclear at this point whether these capability levels exist for operationalresilience management, or more distinctly, whether they have meaning. In other words, should anorganization strive for some level of quantitatively managed operational resilience processes, andif so, what benefits would this bring to the organization? Thus, these additional levels are notdefined in the model.5.4 CERT-RMM Generic Goals and PracticesGeneric goals and practices are common to all process areas. They are the roadmap for helpingthe organization raise its performance of each process area to the next capability level. The degreeof process institutionalization is embodied in the generic goals and practices and expressed in the56 | CMU/SEI-2010-TR-012