Richard A. Caralli, Julia H. Allen, David W. White. CERT Resilience Management Model
Подождите немного. Документ загружается.
Financial Resource Management 407
FRM
3. Review activities, status, and results of the process with the immediate level of
managers responsible for the process and identify issues.
Elaboration:
4. Identify and evaluate the effects of significant deviations from the plan for
performing the process.
5. Identify problems in the plan for performing and executing the process.
6. Take corrective action when requirements and objectives are not being satisfied,
when issues are identified, or when progress differs significantly from the plan
for performing the process.
7. Track cor re ctive ac tion to closure.
Periodic reviews of the financial resource management process are needed to
ensure that
• resilience activities are being budgeted, accounted for, and controlled
• strategic operational resilience management activities and budgets are on track
• key financial metrics are within acceptable ranges as demonstrated in governance
dashboards or scorecards and financial reports
• administrative, technical, and physical controls are operating as intended
• controls are meeting the stated intent of the resilience requirements
• financial reports are provided to appropriate stakeholders in a timely manner
• actions resulting from internal and external audits are being closed in a timely
manner
• percentage of resilience activities subject to off-cycle or off-budget funding
requests
• percentage of resilience activities tracking to planned budgets
• percentage of resilience activities with budget variances outside of established
thresholds and for which resolution plans have been developed to reduce or
eliminate these variances
• percentage of financial exceptions by reporting period
• percentage of high-value assets and services for which optimization calculations
have been performed
• percentage of optimization opportunities where no action has been taken
• number of financial resource risks referred to the risk management process;
number of risks where corrective action is still pending (by risk rank)
• level of adherence to process policies; number of policy violations; number of
policy exceptions requested and number approved
• number of process activities that are on track per plan
• rate of change of resource needs to support the process
• rate of change of costs to support the process
408 PART THREE CERT-RMM PROCESS AREAS
FRM:GG2.GP9 OBJECTIVELY EVALUATE ADHERENCE
Objectively evaluate adherence of the financial resource management process against its
process description, standards, and procedures, and address non-compliance.
Elaboration:
These are examples of work products to be reviewed:
• process plan and policies
• business case for resilience
• funding strategy and requirements for resilience activities
• financial management tools and techniques
• resilience budgets and budget projections, including those for the overall
resilience program as well as line-item budgets at the enterprise and organizational
unit or line of business level and project budgets
• funding gaps and decisions for addressing them
• funding justifications
• resilience financial reports, including variance analysis
• resilience cost accumulation and categorization scheme
• current and historical calculations for COR and RORI
• resilience cost charge-backs
• metrics for the process (Refer to FRM:GG2.GP8 subpractice 2.)
• contracts with external entities
These are examples of activities to be reviewed:
• the identification, commitment, allocation, and tracking of budgets for operational
resilience management system activities
• the assignment of responsibility, accountability, and authority for budgeting, funding,
and accounting of operational resilience management system activities
• the determination of the adequacy of operational resilience management financial
reviews, including funding gap analysis and budget variance analysis
• the identification of risks resulting from budget shortfalls
• the review of off-budget and off-cycle funding requests and approvals
• the definition of any financial exceptions
• action and inaction on operational resilience management optimization calculations
• use of risk-based and financial information for improving strategies for protecting
and sustaining services and assets
• the alignment of stakeholder requirements with process plans
• assignment of responsibility, accountability, and authority for process activities
• determination of the adequacy of process reports and reviews in informing decision
makers regarding the performance of operational resilience management activities
and the need to take corrective action, if any
Financial Resource Management 409
FRM
FRM:GG2.GP10 REVIEW STATUS WITH HIGHER-LEVEL MANAGERS
Review the activities, status, and results of the financial resource management process with
higher-level managers and resolve issues.
Elaboration:
Status reporting on the financial resource management process is likely part of
the formal governance structure or may be performed through other organiza-
tional reporting requirements (such as through the chief financial officer or
the chief resilience officer to an immediate superior). Audits of the process
may be escalated to higher-level managers and board directors through the
organization’s audit committee of the board of directors or similar construct.
Refer to the Enterprise Focus process area for more information about providing sponsor-
ship and oversight to the operational resilience management system.
FRM:GG3 INSTITUTIONALIZE A DEFINED PROCESS
Financial resource management is institutionalized as a defined process.
FRM:GG3.GP1 ESTABLISH A DEFINED PROCESS
Establish and maintain the description of a defined financial resource management
process.
Establishing and tailoring process assets, including standard processes, are addressed in
the Organizational Process Definition process area.
Establishing process needs and objectives and selecting, improving, and deploying process
assets, including standard processes, are addressed in the Organizational Process Focus
process area.
Subpractices
1. Select from the organization’s set of standard processes those processes that
cover the financial resource management process and best meet the needs of the
organizational unit or line of business.
2. Establish the defined process by tailoring the selected processes according to
the organization’s tailoring guidelines.
3. Ensure that the organization’s process objectives are appropriately addressed in
the defined process, and ensure that process oversight extends to the tailored
processes.
4. Document the defined process and the records of the tailoring.
5. Revise the description of the defined process as necessary.
410 PART THREE CERT-RMM PROCESS AREAS
FRM:GG3.GP2 COLLECT IMPROVEMENT INFORMATION
Collect financial resource management work products, measures, measurement results,
and improvement information derived from planning and performing the process to sup-
port future use and improvement of the organization’s processes and process assets.
Elaboration:
Establishing the measurement repository and process asset library is addressed in the
Organizational Process Definition process area. Updating the measurement repository
and process asset library as part of process improvement and deployment is addressed
in the Organizational Process Focus process area.
Subpractices
1. Store process and work product measures in the organization’s measurement
repository.
2. Submit documentation for inclusion in the organization’s process asset library.
3. Document lessons learned from the process for inclusion in the organization’s
process asset library.
4. Propose improvements to the organizational process assets.
These are examples of improvement work products and information:
• issues with the budgeting, commitment, allocation, tracking, variance analysis, gap
analysis, off-cycle budget allocation, and optimization processes
• reports on financial exception
• optimization calculations and action or inaction with respect to these
• metrics and measurements of the viability of the process (Refer to FRM:GG2.GP8
subpractice 2.)
• changes and trends in operating conditions, risk conditions, and the risk environ-
ment that affect operational resilience management budget allocations and
expenditures
• lessons learned in post-event review of incidents and disruptions in continuity
• process lessons learned that can be applied to improve controls and inform future
budgeting activities
• reports on the effectiveness and weaknesses of controls
• resilience requirements that are not being satisfied or that are being exceeded
411
HUMAN RESOURCE MANAGEMENT
Enterprise
Purpose
The purpose of Human Resource Management is to manage the employment life
cycle and performance of staff in a manner that contributes to the organization’s
ability to manage operational resilience.
Introductory Notes
The way that an organization hires, manages, and terminates staff can have a sig-
nificant effect on the organization’s operational resilience. The Human Resource
Management process area seeks to address the management of staff in a way that
minimizes operational risk and contributes to the organization’s ability to man-
age operational resilience.
In Human Resource Management, the organization consciously approaches
the acquisition of staff as an activity that can improve operational resilience by
ensuring the acquisition of necessary skill sets and the avoidance of introducing
operational risk that results from poor hiring decisions. Staff are acquired with a
view toward their contributions to meeting the organization’s mission with an
understanding and acceptance of their role in sustaining operational resilience.
This helps staff to begin acculturation to the organization’s philosophy on opera-
tional resilience as they become part of the organization.
The management of staff performance is a means by which the organization
can enforce (and reinforce) its philosophy of operational resilience. In Human
Resource Management, the organization reinforces the connection between staff
and operational resilience by using the performance management program as a
way to acculturate staff to their resilience roles and responsibilities. Job descrip-
tions include these roles and responsibilities, which are enforced by the organiza-
tion by their inclusion in annual goal setting. The organization specifically
establishes acceptable performance behaviors and measures compliance with
these behaviors on a regular basis as part of the performance management cycle.
As a result, the organization inculcates a resilience-aware and -ready culture that
is essential for supporting the resilience process and the organizational mission.
HRM
Human Resource Management also seeks to ensure that the organization’s
human resources do not pose additional operational risk to the organization when
their employment is voluntarily or involuntarily severed. Changes in employment
can have significant effects on operational resilience by potentially disrupting the
contributions of staff to the productive capacity of services. In addition, because
staff typically have other organizational assets in their possession, when they
vacate their positions the repossession of these assets by the organization may be
critical to operational resilience, particularly if sensitive information assets or
technology assets are not returned. Finally, involuntary separations may be
disruptive—they can affect services and the morale and motivation of remaining
staff. Thus, the organization must act in a way that minimizes the impact of invol-
untary terminations and limits unpredictable effects on productive capacity.
The Human Resource Management competency covers the employment life
cycle—hiring, performance management, and termination. It has four specific goals
addressing the identification of skill requirements, the acquisition of appropriate
staff, the management of staff performance in supporting operational resilience, and
the termination of staff in a manner that minimizes organizational impact.
As people are a ubiquitous resource in an organization, there are many aspects
of human resources that affect operational resilience. People Management is
focused on the availability of people to the services that they support. The manage-
ment of people through their employment life cycle and the effect on operational
resilience are addressed in the Human Resource Management competency. Finally,
promoting awareness of the organization’s efforts and providing training to resilience
staff for their roles in managing operational resilience are addressed in the Organiza-
tional Training and Awareness competency.
Related Process Areas
The training of staff to meet resilience requirements, needs, and gaps is established and
managed in the Organizational Training and Awareness process area.
Determining funding needs for providing human resources to the operational resilience
management system is addressed in the Financial Resource Management process area.
The management of operational risks through their life cycle is addressed in the Risk
Management process area.
The specific activities involved in cross-training and succession planning as a means for
improving and sustaining resilience are addressed in the People Management process area.
The management of intellectual property and knowledge as high-value organizational infor-
mation assets is addressed in the Knowledge and Information Management process area.
Managing access to organizational assets on a recurring basis is addressed in the Access
Management process area.
412 PART THREE CERT-RMM PROCESS AREAS
Summary of Specific Goals and Practices
HRM:SG1 Establish Resource Needs
HRM:SG1.SP1 Establish Baseline Competencies
HRM:SG1.SP2 Inventory Skills and Identify Gaps
HRM:SG1.SP3 Address Skill Deficiencies
HRM:SG2 Manage Staff Acquisition
HRM:SG2.SP1 Verify Suitability of Candidate Staff
HRM:SG2.SP2 Establish Terms and Conditions of Employment
HRM:SG3 Manage Staff Performance
HRM:SG3.SP1 Establish Resilience as a Job Responsibility
HRM:SG3.SP2 Establish Resilience Performance Goals and Objectives
HRM:SG3.SP3 Measure and Assess Performance
HRM:SG3.SP4 Establish Disciplinary Process
HRM:SG4 Manage Changes to Employment Status
HRM:SG4.SP1 Manage Impact of Position Changes
HRM:SG4.SP2 Manage Access to Assets
HRM:SG4.SP3 Manage Involuntary Terminations
Specific Practices by Goal
HRM:SG1 ESTABLISH RESOURCE NEEDS
The resource needs to staff the activities and tasks of the organization’s resilience program
and plan are identified and satisfied.
Skilled people are absolutely essential to successfully managing operational
resilience and meeting the objectives of the organization’s resilience program. This
is particularly true for staff who are actively engaged in all aspects of resilience
work—performing security duties, supporting business continuity activities, and
managing IT operations—because these skill sets are typically in short supply.
In order to determine what skills the organization must possess to meet its
resilience needs, baseline competencies must be established relative to the
resilience program and plan to ensure the entire range of necessary skills is iden-
tified. Against this baseline, the organization must determine what skills it cur-
rently possesses in its pool of available human resources and identify skill gaps
that not only can affect its ability to manage operational resilience but can pose
additional risk to the organization in meeting its strategic objectives.
In establishing resource needs, the organization determines its baseline com-
petencies, takes an inventory of its current skill sets (based on available
resources), identifies gaps and related risks, and develops and implements a strat-
egy for closing these gaps and reducing risk to an acceptable level.
The specific practices in this goal are intended for application to positions
that have resilience as their primary responsibility. However, these practices can
apply universally to all positions in the organization, particularly vital positions.
Human Resource Management 413
HRM
HRM:SG1.SP1 ESTABLISH BASELINE COMPETENCIES
The staffing and skill needs relative to the operational resilience management system are
established.
The baseline competencies represent the staffing and skill set needs relative to
carrying out the organization’s resilience program and plan. These staffing and
skill set needs may be concentrated in resilience staff (i.e., with staff members
whose traditional positions are in the fields of security or business continuity)
and may also be found in positions in the operational and business units of the
organization where resilience tasks are often performed.
Baseline competencies can be gathered through detailed examination of the orga-
nization’s resilience program and plan, as well as through review of job descriptions
that the organization has developed for resilience positions. In the event that the
organization has not developed job descriptions, gathering baseline competencies
may be more difficult and may require an inventory of resilience positions from
which a foundation for developing more extensive baselines can be created. The
baseline competencies should be based on what the organization needs, not what it
currently has in terms of staff and skills. By determining what the organization
needs, the appropriate target for a sufficient level of staffing and skills is established.
An organization may want to expand this activity to include vital positions in
the organization. In this way, the organization establishes a baseline for the skills
necessary to meet organizational goals and strategic objectives. If gaps in these
skills exist, the risk that strategic objectives will not be achieved is increased and
the operational resilience of associated services is impacted.
Because skilled labor is a significant component of the costs of providing
resilience services, the establishment of baseline competencies can aid the organ-
ization in determining and validating funding needs for the operational resilience
management system. (Determining funding needs is performed in FRM:SG2.SP1 in
the Financial Resource Management competency.)
Ty p i c a l w o r k p r o d u c t s
1. Baseline competencies
2. Job descriptions
Subpractices
1. Establish and document baseline competencies necessary to meet the needs of
the organization’s operational resilience management system.
Baseline competencies may be as detailed as the organization needs to describe its
required skill sets. This may involve many layers of information, including
• role (security administrator, network administrator, CIO, etc.)
• position (CIO, senior security analyst, network engineer, etc.)
• skills (Java programming, Oracle DBA, etc.)
414 PART THREE CERT-RMM PROCESS AREAS
• certifications (CISSP, MSCE, etc.)
• aptitudes and job requirements (able to work long hours, travel, or be on call)
2. Create or update job descriptions to reflect base competencies.
Baseline competencies should be reflected in job descriptions to ensure that the
needs of the organization are translated into skilled positions. In some cases,
existing job descriptions may be a means for collecting baseline competencies,
but there may be cases where job descriptions do not exist even though there are
documented skill needs for the operational resilience management program.
HRM:SG1.SP2 INVENTORY SKILLS AND IDENTIFY GAPS
The current skill set for operational resilience management is inventoried and gaps in
necessary skills are identified.
A skills inventory is a means for identifying and documenting the current skill set
of the organization’s human resources. It provides a snapshot of the organization’s
current capabilities and can be used to diagnose resource shortages and gaps based
on the organization’s needs as represented in the baseline competencies.
A skills inventory is not a job inventory; it does not represent the positions
that the organization currently has deployed on its organization chart. Instead, a
skills inventory captures the skills and aptitudes of the current pool of human
resources regardless of their job position or roles and responsibilities. The skills
inventory provides a collective view of the organization’s capabilities, which in
some cases may be more extensive than the positions currently employed by the
organization. For example, there may be staff members who speak more than one
language but are not using that skill in their current positions.
Taking a skills inventory gives the organization a true picture of its current
competencies from which critical analysis and review of needs can be performed.
It may also reveal that staff members have skills that are needed by the organiza-
tion that were not previously known.
Ty p i c a l l y, a s k i l l s i n v e n t o r y i s s e l f - re p o r t e d — t h a t i s , s k i l l s a r e r e p o r t e d b y s t a f f
to the organization—which means that the organization may have to do some
validation of these skill sets.
The skills inventory is compared to the organization’s baseline competencies
in an attempt to identify skills that the organization does not possess. The result-
ing skill gap provides insight into the skill needs of the organization. These skills
may be keeping the organization from performing adequately in managing opera-
tional resilience and may result in additional risk to the organization. When the
skills inventory is expanded beyond resilience positions, skill gaps may indicate
areas of risk that result in potentially diminished operational resilience.
Ty p i c a l w o r k p r o d u c t s
1. Skills inventory
2. Identified skill gaps
Human Resource Management 415
HRM
Subpractices
1. Develop a skills inventory, particularly relative to resilience skills.
The skills inventory should contain at a minimum relevant skills, certifications,
and aptitudes that staff members currently possess. The organization should
concentrate on resilience skills; however, if the organization intends to use the
inventory for other process improvement purposes, it may expand the inventory
to other skills for vital positions.
The skills inventory is typically taken by survey. However, this requires that the
organization structure the survey in a way that will yield specific skills informa-
tion. For example, rather than asking whether staff members have skills in pro-
gramming languages, the organization may want to ask if they have skills in Java or
other specific languages that are relevant. In addition, the organization may need
to validate the skills survey. Certifications may be one way to validate that the staff
member possesses the skills, as well as aptitude testing.
2. Compare baseline competencies to the current skills inventory.
3. Identify skill gaps and deficiencies.
Skill gaps and deficiencies expose the areas where the organization does not have
the expertise, aptitude, skill, or experience to meet current needs. These gaps can
result in risks to the organization in that significant resilience activities may not be
performed appropriately or may not be performed at all.
4. Develop processes to keep the skills inventory current and for performing regular
comparison to baseline competencies.
As operational complexity changes, so do the organization’s needs and the skill sets
available to meet these needs. Keeping the skills inventory current allows the
organization to perform frequent comparisons so that gaps can be identified before
they result in risk to the organization.
HRM:SG1.SP3 ADDRESS SKILL DEFICIENCIES
Gaps in skills necessary to meet operational resilience management needs are
addressed.
Deficiencies in skills may impede the organization’s ability to adequately manage
operational resilience. These deficiencies pose risk to the organization that must
be addressed.
Addressing these deficiencies comes at a cost to the organization. However,
through identification, the organization has an opportunity to perform analysis
on these gaps (i.e., determining the risk versus reward of closing the gaps based
on the relative cost) and make sound decisions about how to address them.
An organization can address skill deficiencies in a number of ways:
• Existing staff may be trained to acquire new skills.
• New staff may be hired to acquire the necessary skills.
416 PART THREE CERT-RMM PROCESS AREAS