A Technical History of the SEI

and security process improvement. The bodies of knowledge identified included IT and information
security governance, audit, risk management, IT operations, security, project management,
and process management.
In December 2004, the SEI released a technical note titled Managing for Enterprise Security [Caralli
2004] that introduced operational resilience as the objective of security activities and began to
describe the convergence between security management,
business continuity management, and IT operations
management as essential for managing operational risk.
In March 2005, the SEI hosted a meeting with representatives
of the Financial Services Technology Consortium
(FSTC). 16 The FSTC’s Business Continuity Standing
Committee was actively organizing a project to explore
the development of a reference model to help determine
an organization’s capability to manage operational resilience
as a follow-on to lessons learned in the aftermath
of Sept. 11, 2001. The respective efforts were clearly focused
on solving the same problem: How can an organization
predictably and systematically control operational
resilience through activities such as security and business
continuity?
In the following year, the SEI introduced the concept of
a process improvement model for managing operational
resilience, drawing heavily upon the SEI’s CMMI experience.
The SEI continued to collaborate with the FSTC
and others to develop an initial framework and subsequent
revisions, which resulted in the CERT Resilience
Engineering Framework in March of 2008 and v1.0 of
the CERT Resilience Management Model (CERT-
RMM) in March 2010 (followed shortly thereafter by
v1.1 of the CERT-RMM in book form [Caralli 2010a]
and a model description in a webinar [Caralli 2010b]).
The SEI also developed resilience training and helped
The View from Others
The CERT-RMM class provided
Lockheed Martin participants with
a solid framework for measuring
organizational and operational resilience,
but the RMM Users
Group gave us a greater appreciation
of the issues surrounding resilience.
The diversity of perspectives
from industry, finance,
government, and education helped
to associate actual problems with
model constructs. Hearing about
the real world issues that other organizations
had, and how they
conquered or planned to conquer
them, helped us to be better able to
support our own operational teams
and to establish a strategy for our
organization.
– Lynn Penn, Director
Enterprise Integration,
Lockheed Martin
Corporation
establish a CERT-RMM Users Group. 17 The SEI is conducting research and developing resources
for measuring operational resilience, including guidance and templates that support organizations
in defining their measures and an addendum to CERT-RMM V. 1.1 that updates examples of
measures for the 26 process areas [Allen 2011].
16 The FSTC has since been incorporated into the Financial Services Roundtable
(http://www.fsround.org).
17 Information on SEI resilience work is available at http://www.cert.org/resilience, including links to
the training and the user group pages.
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 125
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.