CERT Resilience Management Model, Version 1.0

For some improvement objectives, it may be optimal to designate an organizational unit thatcomprises all of the parts of the organization that are directly involved in the delivery of a specificservice or that are responsible for a specific system. On an organization chart, such anorganizational unit would be indicated by selecting the various elements of the organization thatare responsible for the service, as shown in Figure 30. In this case, the term organizationalsubunit is less meaningful but could still be used to refer to elements such as 1.1.2 or 1.3.3.1. Theterm organizational superunit can be used to refer to element 1 or to the entire organization.Figure 30: Alternate Organizational Unit Designation on Organizational Chart6.3.2 Model ScopeThe model scope represents the parts of CERT-RMM that will be used to guide the improvementeffort. In other words, the model scope specifies which parts of the model will be deployed in theorganizational units that compose the organizational scope.The model scope is determined by selecting specific CERT-RMM process areas. Process areasshould be chosen based on the objectives and business case for the improvement effort and inconsideration of the other factors described above, such as timing, regulatory mandates, andsponsorship.For example, the organization described in the first example in Section 6.1.1 might choose thefollowing process areas as its initial model scope to help manage operational risk in support of itsonline sales growth objective:Service Continuity (SC)—to ensure that business continuity practices are adequate to sustainthe operation of its online sales infrastructureKnowledge and Information Management (KIM)—to improve the protection of customerinformationRisk Management (RISK)—to establish common guidelines for risk tolerance andprocedures to evaluate and mitigate identified risks in a consistent manner68 | CMU/SEI-2010-TR-012