CERT Resilience Management Model, Version 1.0

names of the generic goals, except for goal 1, “Achieve specific goals,” which refers to theachievement of all of the specific goals and the performance of all of the specific practices of aprocess area.The generic goals and practices used in CERT-RMM have been sourced from CMMI models.Thus, if you are a current user of CMMI models, you will be able to use the same processinstitutionalization features of CMMI in your CERT-RMM process improvement effort.However, there are a few differences, mostly in wording.Generic practice 2.1 in CMMI models is “Establish an Organizational Policy,” while inCERT-RMM the corresponding practice is “Establish Process Governance.” In CERT-RMM, policy is an artifact of effective governance, which is required for all processes toreach capability level 2.CMMI generic practice 2.3, “Provide Resources,” is similar between the models, but CERT-RMM expands the definition of “resources” to include financial resources.Generic practice 2.6 in CMMI is “Manage Configurations,” but in CERT-RMM it is retitledas “Manage Work Product Configurations” to avoid confusion with traditional configurationmanagement activities as defined in IT operations.CERT-RMM includes subpractices in its articulation of generic goals and practices, whichwere eliminated in current versions of CMMI models.Remember, only the generic goals for capability levels 1, 2, and 3 from CMMI are included inCERT-RMM. The CERT-RMM generic goals and practices are included in Appendix A.5.4.1 CERT-RMM Elaborated Generic Goals and PracticesSince generic goals and practices apply to each process area, naturally there is variation in howeach generic goal and practice affects the core subject matter of a process area. For example,generic practice 2.1, which calls for governance over the process, will differ widely depending onwhether the process deals with incident management or organizational training and awareness.Thus, in each process area, the CERT-RMM model includes customized examples of the genericgoals and practices. These customized examples are called elaborations, and thus each processarea has a unique set of elaborated generic goals and practices associated with it.In this technical report, the elaborated generic goals and practices are provided for the AssetDefinition and Management process area, which is presented in its entirety in Part Three on page78. The elaborated generic goals and practices for all other process areas can be found atwww.cert.org/resilience.5.5 Applying Generic PracticesApplying the generic practices in CERT-RMM is mostly straightforward, but can be confusing. Itis easiest to start with a simple example.When you are achieving the specific goals of the Asset Definition and Management process area,you are formally identifying, documenting, and managing the assets that the organization dependson to ensure that high-value services meet their missions. Consider generic practice GG2.GP2,“Establish and maintain the plan for performing the process.” In this context, generic practice57 | CMU/SEI-2010-TR-012