CERT-RMM — CERT Resilience Management Model

Why does it matter?

CERT-RMM treats security, business continuity and IT operations as one discipline: managing the resilience of services and the assets they depend on. Each of its 26 process areas states a purpose, introductory notes, specific goals with practices, and the generic goals used to judge institutionalization.

Key benefits include:

• One model for three disciplines

Security, business continuity and IT operations management are described by shared process areas instead of separate programs.

• Asset-based thinking

Assets are people, information, technology and facilities, each with an owner and custodian, and resilience requirements are set for each asset to support a service (Asset Definition and Management).

• Maturity shown by generic goals

Generic goals GG1 to GG3 distinguish achieving the specific goals from managing and defining the process, so maturity is measured per process area.

• Dependencies are in scope

External Dependencies Management applies controls to services and assets that third parties own or operate.

• Improvement loop built in

Measurement and Analysis, Monitoring and Organizational Process Focus keep the resilience management system under review.

How does it work?

Version 1.2 organizes its 26 process areas into four categories. Enterprise Management has seven: Communications, Compliance, Enterprise Focus, Financial Resource Management, Human Resource Management, Organizational Training and Awareness, and Risk Management. Engineering has six: Asset Definition and Management, Controls Management, Resilience Requirements Development, Resilience Requirements Management, Resilient Technical Solution Engineering, and Service Continuity.

Operations has nine: Access Management, Environmental Control, External Dependencies Management, Identity Management, Incident Management and Control, Knowledge and Information Management, People Management, Technology Management, and Vulnerability Analysis and Resolution. Process Management has four: Measurement and Analysis, Monitoring, Organizational Process Definition, and Organizational Process Focus.

Each process area uses specific goals (for example CTRL:SG1 Establish Control Objectives and CTRL:SG2 Establish Controls) and the generic goals GG1 Achieve Specific Goals, GG2 Institutionalize a Managed Process and GG3 Institutionalize a Defined Process. The SEI's version 1.2 document supplies the process areas, generic goals and practices, glossary and acronyms.

Key Elements

• Enterprise Focus and Risk Management (EF, RISK)

Enterprise Focus establishes strategic objectives and critical success factors that resilience activities support. Risk Management identifies, analyzes and responds to risks to organizational assets that could adversely affect the operation and delivery of services.

• Asset Definition and Management (ADM)

Identifies, documents and manages organizational assets through their life cycle to ensure sustained productivity for services. Assets are people, information, technology and facilities, and high-value assets have owners and custodians.

• Resilience requirements (RRD, RRM)

Resilience Requirements Development establishes enterprise and asset resilience requirements for services, and Resilience Requirements Management keeps them current. A resilience requirement is a characteristic or capability an asset must have to remain viable to support a service.

• Controls, service continuity and engineering (CTRL, SC, RTSE)

Controls Management defines control objectives and controls. Service Continuity plans for service continuity and sets standards for it. Resilient Technical Solution Engineering builds resilience into software and systems.

• Operations process areas (AM, EDM, IMC, VAR and others)

Operations covers access and identity, environmental control, external dependencies, incident management and control (identify and analyze events, detect incidents and determine the response), knowledge and information, people, technology, and vulnerability analysis and resolution.

• Process management (MA, MON, OPD, OPF)

Measurement and Analysis, Monitoring, Organizational Process Definition and Organizational Process Focus provide the feedback and standard processes that raise maturity. Monitoring collects, records and distributes information about the operational resilience management system on a timely basis.

What does it cover?

CERT-RMM applies to any organization that wants to manage the resilience of the services and assets that support its mission, public or private. It is a model that organizations apply across the 26 process areas, and it can be applied to a whole enterprise or to selected services.

What are its objectives?

CERT-RMM aims to define the practices needed to manage operational resilience and to help organizations improve them.

Define the essential organizational practices that manage operational resilience.

Let an organization determine its capability to manage resilience and set goals and targets.

Identify and prioritize the services and assets that need protection and sustainment.

Set resilience requirements for assets and keep them current.

Develop plans to close the gaps between current and target capability.

Framework in Context

CERT-RMM is a process view of resilience, in the tradition of capability maturity models. It sits beside control frameworks such as ISO/IEC 27001, NIST CSF and the ISO business continuity standards by describing how well an organization manages the underlying processes, not only which controls it has.

Common Framework Mappings

Organizations map CERT-RMM process areas to control and management-system standards to reuse evidence, align programs and simplify audits.

Mapped frameworks include:

C2M2 (Cybersecurity Capability Maturity Model)

COBIT 2019

ISO 22301

ISO/IEC 27001

NIST Cybersecurity Framework

NIST SP 800-53