CERT Resilience Management Model, Version 1.0

GG2.GP2 reminds you that you need to plan the activities related to identifying, documenting,and managing assets throughout their life cycle. Thus, the application of this generic practiceimproves the institutionalization of the Asset Definition and Management process area byinstilling a planning discipline.In some cases, the application of a generic practice to the specific goals in a process area willseem recursive. For example, consider the application of generic practice GG2.GP2 to a processarea that already includes a specific goal directed at planning. In the Incident Management andControl process area, planning for incident management is a major aspect of the process. Theapplication of the generic practice GG2.GP2 in this case reminds you that you must plan theactivities involved in creating the plan for managing incidents.5.6 Process Areas That Support Generic PracticesWhile generic goals and generic practices are the model components that directly address processinstitutionalization, some process areas also address institutionalization by supporting theimplementation of the generic practices. Thus, implementing the specific practices in someprocess areas may also help with the implementation of a generic practice.Table 8 shows the relationship between CERT-RMM process areas and generic practices.Table 8:CERT-RMM Generic Practices Supported by Process AreasGeneric Practice Related Process Area How the Process Area Helps toImplement the Generic PracticeGG2.GP1Establish processgovernanceEnterprise FocusEnterprise Focus addresses thegovernance aspect of managingoperational resilience. Mastery of theEnterprise Focus process area can helpto achieve GG2.GP1 in other processareas.GG2.GP3Provide resourcesHuman Resource ManagementFinancial Resource ManagementHuman Resource Management ensuresthat resources have the proper skill setsand their performance is consistent overtime. Financial Resource Managementaddresses the provision of otherresources to the process, such asfinancial capital.GG2.GP4Train peopleOrganizational Training andAwarenessOrganizational Training and Awarenessensures that resources are properlytrained.58 | CMU/SEI-2010-TR-012