A Technical History of the SEI

Managing Operational Resilience
The Challenge: Delivering Essential Services in the Presence of Stress and
Disruption
Beginning in the late 1990s, the DoD faced a set of
problems shared with organizations in every sector—
U.S. federal government agencies, defense and commercial
industry, and academia—arising from increasingly
complex business and operational environments. Most
organizations continue to be constantly bombarded with
conditions and events that introduce stress and uncertainty
that may disrupt effective operation. Stress related
to operational resilience—the ability of an organization
to achieve its mission even under degraded circumstances—can
come from many sources, including risks
and threats resulting from technology advances and the
increasing globalization of organizations and their supply
chains.
All these demands conspire to force organizations to rethink
how they perform operational risk management
and how they address the resilience of high-value business
services and processes. The traditional, and typically
compartmentalized, disciplines of security, operational
continuity, and information technology (IT)
operations must be expanded to provide protection and
continuity strategies for high-value services and supporting
assets that are commensurate with these new operating
complexities.
A Solution: Convergence of Operational
Risk Disciplines That Accelerated the
SEI’s Ability to Tackle Resilience
In 1999, the SEI released the Operationally Critical
Threat, Asset, and Vulnerability Evaluation (OCTAVE)
method for information security risk management.
The View from Others
Our comprehensive analysis of
business resilience management
models identified CERT-RMM as
the most promising model for use
within our enterprise due to promoting
convergence, modeling the
needs of a large enterprise, considering
risks for both protecting
and sustaining assets, and its focus
on measuring and institutionalizing
resilience processes.
– Nader Mehravari, former
director of Corporate
Business Resiliency
Strategic Initiative,
Lockheed Martin Corp.
[Caralli 2010, Ch. 7]
CERT-RMM helps us define the
processes by which we conduct incident
responses for security incidents,
including how we interact
with the other business units and
the CISO’s [chief information security
officer’s] office for the recovery
of evidence and continuity
of operations. [Joch 2013]
OCTAVE provided a new way to look at information security risk from an operational perspective
and asserted that operational (business) people are in the best position to identify and analyze
security risk. This effectively repositioned IT’s role in security risk assessment and placed the responsibility
closer to the operations activity in the organization [Alberts 1999].
In October 2003, a group of 20 IT and security professionals from defense organizations, the financial
services sector, IT, and security services met at the SEI to begin building an executivelevel
community of practice for IT operations and security. The desired outcome was to better
capture and articulate the relevant bodies of knowledge that enable and accelerate IT operational
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 124
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.