Richard A. Caralli, Julia H. Allen, David W. White. CERT Resilience Management Model
Подождите немного. Документ загружается.
Controls Management 267
3. Review activities, status, and results of the process with the immediate level of
managers responsible for the process and identify issues.
Elaboration:
Reviews of the controls management process may result from periodic
assessment or post-event audits that seek to identify problems that must
be corrected. Elevating the results of these assessments and audits to
managers provides an opportunity to correct controls management process
deficiencies and to make managers aware of variations in the process that not
only have localized impact but may also affect the organization’s resilience
as a whole.
4. Identify and evaluate the effects of significant deviations from the plan for
performing the process.
5. Identify problems in the plan for performing and executing the process.
6. Take corrective action when requirements and objectives are not being satisfied,
when issues are identified, or when progress differs significantly from the plan
for performing the process.
7. Track cor re ctive ac tion to closure.
CTRL:GG2.GP9 OBJECTIVELY EVALUATE ADHERENCE
Objectively evaluate adherence of the controls management process against its process
description, standards, and procedures, and address non-compliance.
Periodic reviews of the controls management process are needed to ensure that
• control objectives are satisfied and continue to be satisfied across time and in the
face of changing business and risk conditions
• control problem areas have been identified and remediated
• risks related to control problem areas have been identified, properly referred, and
addressed
• actions requiring management involvement are elevated in a timely manner
• the performance of process activities is being monitored and regularly
reported
• key measures are within acceptable ranges as demonstrated in governance dash-
boards or scorecards and financial reports
• actions requiring management involvement are elevated in a timely manner
• actions resulting from internal and external audits are being closed in a timely
manner
CTRL
268 PART THREE CERT-RMM PROCESS AREAS
Elaboration:
CTRL:GG2.GP10 REVIEW STATUS WITH HIGHER-LEVEL MANAGERS
Review the activities, status, and results of the controls management process with higher-
level managers and resolve issues.
Refer to the Enterprise Focus process area for more information about providing sponsorship
and oversight to the operational resilience management system.
CTRL:GG3 INSTITUTIONALIZE A DEFINED PROCESS
Controls management is institutionalized as a defined process.
These are examples of work products to be reviewed:
• management directives and guidelines
• control objectives and their priorities
• assessment results
• risks resulting from problem areas in controls that have been referred to the risk
management process
• remediation plans
• process plan and policies
• process methods, techniques, and tools
• metrics for the process (Refer to CTRL:GG2.GP8 subpractice 2.)
• contracts with external entities
These are examples of activities to be reviewed:
• establishing management directives and guidelines that serve as the basis for
defining control objectives
• identifying and documenting control objectives
• satisfying control objectives
• identifying problem areas in controls (gaps, updates, need for new controls,
remediation of redundant and conflicting controls)
• identifying risks and remediation plans arising from problem areas in controls
• the alignment of stakeholder requirements with the process plan
• assignment of responsibility, accountability, and authority for process activities
• determination of the adequacy of process reports and reviews in informing deci-
sion makers regarding the performance of operational resilience management
activities and the need to take corrective action, if any
• use of process work products for improving strategies for protecting and sustain-
ing assets and services
Controls Management 269
CTRL:GG3.GP1 ESTABLISH A DEFINED PROCESS
Establish and maintain the description of a defined controls management process.
Establishing and tailoring process assets, including standard processes, are addressed in the
Organizational Process Definition process area.
Establishing process needs and objectives and selecting, improving, and deploying process
assets, including standard processes, are addressed in the Organizational Process Focus
process area.
Subpractices
1. Select from the organization’s set of standard processes those processes that cover
the controls management process and best meet the needs of the organizational
unit or line of business.
2. Establish the defined process by tailoring the selected processes according to the
organization’s tailoring guidelines.
3. Ensure that the organization’s process objectives are appropriately addressed in
the defined process, and ensure that process governance extends to the tailored
processes.
4. Document the defined process and the records of the tailoring.
5. Revise the description of the defined process as necessary.
CTRL:GG3.GP2 COLLECT IMPROVEMENT INFORMATION
Collect controls management work products, measures, measurement results, and improve-
ment information derived from planning and performing the process to support future use
and improvement of the organization’s processes and process assets.
Elaboration:
These are examples of improvement work products and information:
• metrics and measurements of the viability of the process (Refer to CTRL:GG2.GP8
subpractice 2.)
• changes and trends in operating conditions, risk conditions, and the risk environ-
ment that affect process results
• lessons learned from control analyses and assessments
• lessons learned from satisfying control objectives
• lessons learned in post-event review of continuity exercises, incidents, and dis-
ruptions in continuity
• lessons learned that can be applied to improve operational resilience manage-
ment performance and controls, such as remediation plans and risks resulting
from control problem areas
• resilience requirements that are not being satisfied or are being exceeded
CTRL
270 PART THREE CERT-RMM PROCESS AREAS
Establishing the measurement repository and process asset library is addressed in the
Organizational Process Definition process area. Updating the measurement repository and
process asset library as part of process improvement and deployment is addressed in the
Organizational Process Focus process area.
Subpractices
1. Store process and work product measures in the organization’s measurement
repository.
2. Submit documentation for inclusion in the organization’s process asset library.
3. Document lessons learned from the process for inclusion in the organization’s
process asset library.
4. Propose improvements to the organizational process assets.
271
EC
ENVIRONMENTAL CONTROL
Operations
Purpose
The purpose of Environmental Control is to establish and manage an appropriate
level of physical, environmental, and geographical controls to support the
resilient operations of services in organizational facilities.
Introductory Notes
Facilities are a subset of the physical plant assets of the organization that are
relied upon to execute a service. They are hubs of activity where many of the
organization’s services intersect, such as office buildings and warehouses. Facili-
ties can be owned by the organization but just as often are leased from an external
provider, and they may even encompass workers’ homes and other locations
where high-value services are physically executed.
People, information, and technology assets “live” within a physical facility—
they provide the physical space for the actions of people (people work in offices),
the use and storage of information (such as in file rooms and on servers), and the
operation of technology components (such as in data centers and server farms).
Because of its nature as an activity hub, when a facility is disrupted, there is often
a widespread cascading effect on the operability of these other assets, impacting
mission assurance of associated services and possibly translating to a failure to
achieve organizational goals and objectives.
As a complicating factor, organizations frequently execute their services in
facilities that they do not own or control. These arrangements sometimes also
mean that the organization’s assets are co-located with the assets of other organi-
zations. This presents challenges not only for facilities management but for
ensuring the operational resilience of services that depend on these facilities to
meet their missions.
The Environmental Control process area addresses the importance of facilities
in the operational resilience of services as well as the unique issues that facility
assets inherit because of their geographical location and the environment in
which they operate. In this process area, facility assets are prioritized according
to their value in supporting high-value organizational services. Physical, technical,
and administrative controls that sustain the operational viability of facility assets
are selected, implemented, and managed, and the effectiveness of these controls
is monitored. In addition, facility risks are identified and mitigated in an attempt
to prevent disruption where possible. Because a facility is intricately tied to the
geographical location in which it operates, the unique dependencies of the facility
on its adjacent environment are identified and actively managed.
Related Process Areas
The establishment and management of resilience requirements for facility assets are performed
in the Resilience Requirements Development and Resilience Requirements Management
process areas.
The identification, definition, and management of facility assets are addressed in the Asset
Definition and Management process area.
The risk management cycle for facility assets is addressed in the Risk Management process area.
The management of the internal control system that ensures the protection of facility assets is
addressed in the Controls Management process area.
The selection, implementation, and management of access controls for facility assets are
performed in the Access Management process area.
The development of service continuity plans for facilities is performed in the Service Continuity
process area.
The establishment and management of relationships with external entities to ensure the
resilience of services that are executed in facilities they own and operate are addressed in the
External Dependencies Management process area.
272 PART THREE CERT-RMM PROCESS AREAS
Summary of Specific Goals and Practices
EC:SG1 Establish and Prioritize Facility Assets
EC:SG1.SP1 Prioritize Facility Assets
EC:SG1.SP2 Establish Resilience-Focused Facility Assets
EC:SG2 Protect Facility Assets
EC:SG2.SP1 Assign Resilience Requirements to Facility Assets
EC:SG2.SP2 Establish and Implement Controls
EC:SG3 Manage Facility Asset Risk
EC:SG3.SP1 Identify and Assess Facility Asset Risk
EC:SG3.SP2 Mitigate Facility Risks
EC:SG4 Control Operational Environment
EC:SG4.SP1 Perform Facility Sustainability Planning
EC:SG4.SP2 Maintain Environmental Conditions
EC:SG4.SP3 Manage Dependencies on Public Services
EC:SG4.SP4 Manage Dependencies on Public Infrastructure
EC:SG4.SP5 Plan for Facility Retirement
Specific Practices by Goal
EC:SG1 ESTABLISH AND PRIORITIZE FACILITY ASSETS
Fac ility assets are priori tized to e nsure resilie nce of hig h-valu e se rvices t hat t hey supp ort.
In this goal, the organization establishes the subset of facility assets (from its
facility asset inventory) on which it must focus operational resilience activities
because of their importance to the sustained operation of essential services.
In many cases, all facility assets may be considered of high value to the
organization. However, from a risk and resilience perspective, these assets must
be prioritized. Prioritization establishes the facility assets that are of most value
to the organization (based on their support for high-value services) and for
which protective controls and sustainability measures are required. Failure to pri-
oritize facility assets may lead to inadequate operational resilience of high-value
assets and excessive levels of operational resilience for non-high-value assets.
EC:SG1.SP1 PRIORITIZE FACILITY ASSETS
Fac ility assets are priori tized rela tive t o th eir imp orta nce in supp orting the deliv er y of
high-value services.
The prioritization of facility assets must be performed in order to ensure that the
organization properly directs its operational resilience resources to the assets that
most directly contribute to the services supporting the organization’s mission.
These assets require the organization’s direct attention because their interruption
or disruption has the potential to cause significant organizational consequences.
Facility asset prioritization is performed relative to related services—that is,
facility assets associated with high-value services are those that must be most
highly prioritized for operational resilience activities. However, the organiza-
tion can use other criteria to establish high-priority facility assets, such as the
following:
• the use of the facility asset in the general management and control of the organiza-
tion (corporate headquarters, primary data centers, etc.)
• facility assets that are important to supporting more than one service
• the value of the asset in directly supporting the organization’s achievement of crit-
ical success factors and strategic objectives
• the organization’s tolerance for “pain”—the degree to which it can suffer a loss or
destruction of the facility asset and continue to meet its mission
Ty p i c a ll y, t h e o r g an i z a t i o n s e l e c ts a s u b s e t o f f a c i l i ty a s s e t s f ro m i t s a s s e t
inventory; however, it is feasible that the organization may compile a list of
Environmental Control 273
EC
high-value facility assets based on risk or other factors. However, failure to
select assets from the organization’s asset inventory poses additional risk that
some high-value facility assets may never have been inventoried. (The identification,
definition, management, and control of organizational assets are addressed in the
Asset Definition and Management process area.)
Ty p i c a l w o r k p r o d u c t s
1. List of high-value facility assets
Subpractices
1. Compile a list of high-value facility assets from the organization’s asset inventory.
Facilities assets that are essential to the successful operation of organizational
services should be included on the list of facility assets. (An inventory of high-
value facilities is established in practice ADM:SG1.SP1 in the Asset Definition and
Management process area.) This list may suffice for this subpractice or may be
expanded if necessary.
2. Prioritize facility assets.
The prioritization of facility assets is necessary so that the organization can ensure
it focuses protection and sustainability activities on facilities that have the most
potential for impacting the organization if they are disrupted or destroyed.
Unlike other organizational assets, facilities tend to be “hubs” of services; that is,
many services tend to be performed in or supported by a single facility. An example
of this would be a data center where many application systems (and their associ-
ated hardware, software, and network components) support a number of organiza-
tional services. Because the loss of a facility can have widespread cascading effects
on a number of services, the organization should consider this strongly when
prioritizing facility assets. One means for supporting this criterion is to review the
mapping between services and facility assets. (The association of services to facility
assets is performed in practice ADM:SG2.SP1 in the Asset Definition and Management
process area.) This information may also be gathered as the result of a business
impact analysis activity at the organizational unit level.
3. Periodically validate and update the list of high-value facility assets based on
operational and organizational environment changes.
These are examples of high-value facilities:
• office buildings (such as the headquarters building or a branch office)
• manufacturing facilities (such as manufacturing plants)
• data centers and other processing centers (such as call centers, payment processing
locations)
• physical plants (such as telecommunications hubs)
• other physical structures where significant people, information, or technology assets
exist (such as off-site data storage centers and SCADA operation centers)
274 PART THREE CERT-RMM PROCESS AREAS
EC:SG1.SP2 ESTABLISH RESILIENCE-FOCUSED FACILITY ASSETS
Fac ility assets that spec ifical ly su pp ort th e orga nizat ion’s se rvice c ontinuit y pla ns are
identified and established.
Some facility assets are specifically designated to support the organization’s ability
to execute service continuity plans. They provide physical locations where peo-
ple can work temporarily, information can be stored and retrieved when needed,
and technology components such as systems, hardware, and software can be
operated. In many cases, resilience-focused assets may be owned by the organiza-
tion (i.e., the organization may have a secondary data center) or may be con-
tracted for and provided by an external provider (such as the use of a shared data
center to recover systems and networks).
A resilience-focused asset may also serve as a primary facility that has been
designated as a recovery site during an incident. For example, an organization
may have two geographically dispersed data centers where day-to-day processing
occurs; however, when an incident affects one of the data centers, the other is
capable of being used to support operations of the other for a specified time
period. When this occurs, primary facilities also are designated as resilience facilities,
increasing the need for protection and sustainability.
Ty p i c a l w o r k p r o d u c t s
1. List of resilience-focused facility assets
Subpractices
1. Compile a list of resilience-focused facility assets from the organization’s asset
inventory.
These facility assets should include those that would be required for the successful
execution of service continuity plans and service restoration plans.
2. Periodically reconcile the list of resilience-focused facilities to the organization’s
service continuity plans and resilience-focused strategies.
EC:SG2 PROTECT FACILITY ASSETS
Administrative, technical, and physical controls for facility assets are identified, implemented,
monitored, and managed.
Facility assets are one of the most tangible and visible assets of the organization.
They provide a physical presence to the organization and are the intersection
point for people, processes, and technologies that fuel organizational services.
Thus, the availability of facilities is important to the viability of organizational
services—an organization has only to close an office building for one day to realize
that many job functions go unperformed during such a disruption, no matter the
cause.
Environmental Control 275
EC
Facility assets present unique challenges for managing operational resilience.
Facility assets are often leased from external business partners, and therefore the
organization may not have direct control or influence over their protection or
sustainability. Facility assets also often take non-traditional forms. For example,
in a distributed workforce employees may work at home, whereby their home
location becomes an extension of the organization’s physical plant.
Facility assets are also uniquely connected to their immediate environment in
that their operational resilience is often dependent on the resilience of public
services (police, fire, ambulance, and first responders) and infrastructure (elec-
tricity, gas, water, telecommunications). Because organizations have very little if
any control over the immediate environment, managing operational resilience for
facilities may require extensive considerations of redundancy, co-location, geo-
graphical dispersion, etc.
Protecting facility assets from vulnerabilities, threats, and risks requires that
the organization develop appropriate resilience requirements for these assets and
follow through with the development, implementation, and management of an
appropriate level of administrative, technical, and physical controls to manage
the conditions that could cause disruption of these assets. The organization
selects and designs controls based on the facility asset’s resilience requirements
and the conditions that require availability of the facilities. The effectiveness of
these controls is monitored on a regular basis to ensure that they meet the facility
asset’s resilience requirements.
The establishment and management of relationships with external entities to ensure
the resilience of services that are executed in facilities they own and operate are
addressed in the External Dependencies Management process area.
EC:SG2.SP1 ASSIGN RESILIENCE REQUIREMENTS TO FACILITY ASSETS
Resilience requirements that have been defined are assigned to facility assets.
Resilience requirements form the basis for the actions that the organization takes
to protect and sustain facility assets. These requirements are established com-
mensurate with the value of an asset to services that it supports. The resilience
requirements for facility assets must be assigned to the assets so that the appro-
priate type and level of protective controls can be designed, implemented, and
monitored to meet the requirements.
Resilience requirements for facility assets are developed in the Resilience
Requirements Development process area. However, facility asset resilience
requirements may not be formally defined or they may be assumed to be the
responsibility of the facility asset owner (if the organization is not the owner).
The assignment of these requirements is necessary as a foundational step for controls
management.
276 PART THREE CERT-RMM PROCESS AREAS