Richard A. Caralli, Julia H. Allen, David W. White. CERT Resilience Management Model
Подождите немного. Документ загружается.
SC:SG2.SP2 IDENTIFY INTERNAL AND EXTERNAL DEPENDENCIES AND INTERDEPENDENCIES
The internal and external relationships necessary to ensure service continuity are identified
and analyzed.
The resilience considerations of the organization’s reliance on public services and public infra-
structure are addressed in the Environmental Control process area. The association of internal
and external assets to the services they support is addressed in the Asset Definition and Man-
agement process area. Managing relationships with external entities is addressed in the Exter-
nal Dependencies Management process area. This practice is included here to emphasize the
need to determine the layers of support on which services depend in order to develop effective
and comprehensive service continuity plans.
Services depend on organizational assets, both internal and external, to
ensure continuity of operations. They also rely on external entities such as public
agencies and infrastructure such as public utilities and telecommunications.
These dependencies and interdependencies must be identified in order to ensure
a robust consideration of the range of planning that must be incorporated into
the service continuity plans.
Ty p i c a l w o r k p r o d u c t s
1. List of public service providers on which services depend (Refer also to
EC:SG4.SP3 and SP4.)
2. List of external entities, including business partners and vendors that facilitate
service delivery
3. Key contacts list
Subpractices
1. Identify and document internal infrastructure dependencies that the organization
relies upon to provide services.
This practice requires that the organization document the association between
services and the internal and external assets—people, information, technology, and
facilities—that support the services. (This practice is formally performed in the Asset
Definition and Management process area.)
2. Identify and document external entities that the organization relies upon to pro-
vide services.
3. Develop a key contacts list for organizational services that can be included as part
of the service continuity plans.
SC:SG2.SP3 IDENTIFY VITAL ORGANIZATIONAL RECORDS AND DATABASES
Vital information required for service continuity is identified.
Service Continuity 837
SC
The resilience of information is addressed in the Knowledge and Information Management
process area. This practice is included here to emphasize the importance of information assets
in the development of effective and comprehensive service continuity plans.
Vital records and databases constitute high-value information assets that are
essential to the continued operation of services during and after a disruption.
Thus, these assets must be considered in the development of service continuity
plans. Because information in the form of vital records and databases tends to be
distributed organization-wide, vital records and databases must be inventoried to
ensure that they are properly included in the service continuity plans. (Developing
and maintaining a comprehensive asset inventory are addressed in the Asset Definition
and Management process area.)
Vital records are typically distinguished from other types of information. Vital
records include those records that the organization relies upon to protect the
legal and financial rights of the organization and of individuals directly affected
by disruption. In contrast, files and databases are types of information that are
most typically associated with the direct operation of a specific service. For
example, the vendor database is a necessary component of paying invoices. Vital
records may be more universal in that they can apply to many service continuity
plans, while files and databases may be more applicable to specific services.
Ty p i c a l w o r k p r o d u c t s
1. Vital records, such as
• organizational orders of succession
• delegations of authority
• contracts and service level agreements with external entities, including vendors
and business partners
• organizational legal operating charters
• personnel records
2. Directory of vital staff (people assets) with contact information, roles, and
responsibilities
3. List of files and databases that support high-value service operation
Subpractices
1. Identify and document vital records and databases.
This practice is formally performed in the Knowledge and Information Management
process area.
2. Identify and document vital staff and their specific roles in relation to the services
being provided.
This practice is formally performed in the People Management process area.
3. Ensure that vital records and databases are protected, accessible, and usable if a
disruption occurs.
838 PART THREE CERT-RMM PROCESS AREAS
This practice is formally performed in the Knowledge and Information Management
process area.
SC:SG3 DEVELOP SERVICE CONTINUITY PLANS
Service continuity plans for high-value organizational services are developed.
Service continuity plans are a proactively established description of the actions
an organization will take if a service disruption occurs. They are generally
focused on managing the organizational consequences of service disruption
based on a range of potential events that can cause disruption, such as incidents
and disasters. Service continuity plan development is in essence a risk manage-
ment and control activity that seeks to limit or control the consequences of real-
ized risk. Thus, the genesis for a service continuity plan may be risk assessment
and mitigation activities or lessons learned from past disruptions.
Service continuity plans can take many forms, and often a service continuity
plan is the aggregation of more than one type of plan.
Ty p i c a l l y, c o n t i n u i t y a n d r e c o v e r y p l a n s p ro v i d e f o r i m m e d i a t e , r e s p o n s e -
driven activities, while restoration plans are longer-term activities that may
extend for a considerable time after the immediate consequences of disruption
have been experienced.
Service continuity plans are best developed when they are the result of a com-
prehensive and optimized consideration of the requirements for protecting and
sustaining a service. In other words, as a foundation for operational resilience,
the organization should develop service continuity plans as a part of implement-
ing strategies for protecting and sustaining services and assets to meet resilience
requirements.
Service continuity plans come at a cost to the organization. The develop-
ment and maintenance of these plans are cost-intensive, as is the regular exer-
cising of the plans to ensure they work as intended. Executing a service
continuity plan is also costly to the organization. Thus, the cost of these plans
must be evaluated and balanced with protective controls that have been imple-
mented to prevent disruption and the value of the services and assets that
would be disrupted.
These are examples of types of service continuity plans:
• Business continuity plans focus on the continued provision of a service under
degraded circumstances.
• Recovery plans focus on limiting and containing damage as a result of the disruption
and dealing with the consequences of the disruption.
• Restoration plans focus on performing the actions necessary to bring a service back
to its expected and normal level of operation and output (as was in place before the
disruption).
Service Continuity 839
SC
The development of service continuity plans involves the identification of
plans to be developed, the development of the plans, the assignment of resources
to the plans, and the maintenance of the plans.
SC:SG3.SP1 IDENTIFY PLANS TO BE DEVELOPED
Required service continuity plans are identified.
The organization identifies the service continuity plans to be developed, tested,
executed, and maintained. This can be done through several means:
• in the regular course of designing and implementing resilience requirements for
services and assets
• as the result of security risk assessment and management activities (in the devel-
opment of preventive controls and mitigation actions)
• as part of the business impact analysis process (a typically business-continuity–
driven activity that seeks to identify the consequences of service disruption)
• as a result of legal, regulatory, compliance, and audit activities (where existing con-
trols may not be deemed as effective across a range of potential disruptive events)
• in response to a major event or catastrophe (whether or not the organization was
affected)
Ty p i c a l w o r k p r o d u c t s
1. List of service continuity plans (to be developed)
Subpractices
1. Identify service continuity plans to be developed.
SC:SG3.SP2 DEVELOP AND DOCUMENT SERVICE CONTINUITY PLANS
The required service continuity plans are developed and documented.
Required service continuity plans are developed by the organization or its assigned
representatives. Plans are typically developed by the service owner, but this varies
by organization and might include significant involvement of IT staff if the service
is highly automated or has one or more application systems associated with it.
The contents of the plan and the documentation requirements are established
by the organization as part of the organization’s service continuity standards and
guidelines. This ensures consistency and enterprise-wide understandability and
applicability.
The development of service continuity plans occurs as both a foundational and
an ongoing activity. Plans are developed at the time of service development and
implementation but also on an ongoing basis as new risks are encountered and the
operational environment changes.
840 PART THREE CERT-RMM PROCESS AREAS
Ty p i c a l w o r k p r o d u c t s
1. Service continuity plan templates
2. Service continuity plans (including relevant stakeholders)
Subpractices
1. Document the service continuity plans using available templates as appropriate.
A service continuity plan typically includes the following information:
• identification of authority for initiating and executing the plan (plan ownership)
• identification of the communication mechanism to initiate execution of the plan
2. Document the key elements of the specific plan, including
• alternative activities that would have to be performed (technical or manual)
• alternative resources and locations that would support the organization’s high-
value services
• identification of
– vital staff roles and responsibilities
– high-value technology assets necessary to support the plan
– high-value information assets and vital records necessary to support the plan
– high-value facilities assets necessary to support the plan
– relevant stakeholders of the plan and method of communicating with them
(See subpractice 3 below.)
• documentation of
– the recovery sequence for the service
– the restoration sequence for the service
– security- and access-related issues that are required to execute the plan
– any special handling of information or technology that is required
– the test plan for the service continuity plan (See SC:SG5.SP2.)
– the service continuity training plan
• coordination activities with other internal staff and external entities that must be
performed to implement the strategy
• the levels of authority and access needed by responders to carry out the strategy
and plan
• the cost of the plan and the activities necessary to carry out the plan
• the logistics of the plan
Documentation of the plan must be consistent with the standards and guidelines
established by the organization to ensure plan consistency, accuracy, and ability to
implement. (See SC:SG1.SP2.)
Consider also that the service continuity plan may in reality require the develop-
ment of one or more subplans (such as a restoration plan or a recovery plan).
3. Identify the stakeholders of specific service continuity plans.
Service continuity plans may have many different stakeholders. In addition to
those who must execute and participate in the plans, other organizational groups
(both internal and external) may have a vested interest in understanding them.
For example, plans may be provided to public emergency management staff, to
Service Continuity 841
SC
suppliers and vendors, and to external entities to which the organization is a
supplier. These organizations may even have a stated role in the plans. In addition,
some regulatory and legal entities may require that the organization submit service
continuity plans as evidence that they have taken appropriate actions to prepare
for specific threats such as natural disasters or terrorism.
Because there are many stakeholders for service continuity plans, the organization
must identify the relevant stakeholders and communicate the plans to these stake-
holders as necessary.
Communicate the service continuity plans to stakeholders and review and adjust
them as necessary.
Ensure that compliance obligations that require communication and submission of
service continuity plans are identified and satisfied. (Meeting compliance obligations
is addressed in the Compliance process area.)
SC:SG3.SP3 ASSIGN STAFF TO SERVICE CONTINUITY PLANS
Staff members are assigned to the service continuity plans to ensure effective execution.
The activities documented in the service continuity plans must be assigned to
responsible and skilled individuals in the event that the plans must be executed.
These staff members may be internal to the organization or external (through
outsourcing arrangements and service contracts). The organization must define
the staff requirements that are required to meet the objectives of the plans, iden-
tify potential internal and external staff who will be needed to meet these require-
ments, and assign staff to activities in the plans.
When staff members do not have the necessary skill sets to meet the basic,
minimum requirements of the plans, the organization must provide training and
ascertain that the staff members are able to perform to the objectives stated in the
plans as a result of this training. (Training for service continuity plans is addressed
in SC:SG3.SP5.)
Ty p i c a l w o r k p r o d u c t s
1. Service continuity plan staff requirements
2. List of potential staff members (to fulfill staff requirements)
These are examples of relevant stakeholders:
• higher-level managers
• service and asset owners
• vendors, suppliers, and business partners
• public entities such as emergency management, public utilities, public infrastructure,
and local government
• regulatory and legal entities
• industry groups (for response coordination)
842 PART THREE CERT-RMM PROCESS AREAS
3. Staff and task assignments (as documented in service continuity plans)
4. Staff commitments to service continuity plans
Subpractices
1. Identify staff requirements to satisfy the objectives of the service continuity
plans.
2. Identify staff members, both internal and external, to satisfy the resource
requirements.
3. Assign staff to the service continuity plans.
Ensure that those who are assigned tasks in the plans are aware of their assignments,
have the authority to act as prescribed in the plans, and are held accountable for their
activities. Ensure that these staff members commit to performing their roles as
described in the plans.
SC:SG3.SP4 STORE AND SECURE SERVICE CONTINUITY PLANS
Service continuity plans are stored and made accessible to those with a need to know.
The ability to execute service continuity plans during a disruption is related to
their accessibility and viability. When service continuity plans that are developed
but misplaced or are allowed to be changed at will, they are not usable by those
who are responsible for executing them. Given that many service continuity
plans are executed under emergency or crisis circumstances, the ability to know
where the current version of the plans is stored is invaluable. To achieve this, the
organization must take steps to ensure that the plans are archived, that the most
current versions of the plans are available, that the plans are secured and free
from intentional or unintentional modification, and that those who need to
access the plans can readily retrieve them when necessary.
An inventory of service continuity plans can be established through the devel-
opment and maintenance of a service continuity database. This allows the organ-
ization to secure access, provides a one-stop place to archive plans, and allows for
plan version control. It also provides a means from which to perform plan main-
tenance and change control. (Change control over service continuity plans is
addressed in SC:SG7.)
Ty p i c a l w o r k p r o d u c t s
1. Service continuity plan inventory or database
Subpractices
1. Establish a service continuity plan inventory or database.
2. Store and protect the service continuity plans in the plan inventory or database.
Ensure that the service continuity plans are properly protected but accessible on
demand to those who have proper authorization.
Service Continuity 843
SC
3. Establish access controls to ensure that service continuity plans can be accessed
only by authorized individuals.
SC:SG3.SP5 DEVELOP SERVICE CONTINUITY PLAN TRAINING
Training in the service continuity plans is developed and administered.
Training is an effective mean s for ensuring that particip ants in servi ce continuity
plans understand their roles and are capable of carrying out these roles in times of
disruption and emergency. It is a means for communicating the contents of the
service continuity plans to stakeholders and for ensuring that those responsible
for carrying out the plans are qualified. Effective training increases the organiza-
tion’s capability in executing the plans and for ensuring that the plans’ objectives
are met. Poor advance training in service continuity plans often is a major contrib-
utor to their failure, which is typically learned under undesirable and unstable
organizational conditions.
Not all staff members who are assigned to plans may have the requisite skills
to perform the tasks they have been assigned. Thus, the organization must deter-
mine any skill gaps and ensure that appropriate training is made available and
completed before the service continuity plans are validated.
The provision of training for skill sets necessary to execute service continuity plans is
addressed in the Organizational Training and Awareness process area.
Ty p i c a l w o r k p r o d u c t s
1. List of skill needs and gaps
2. Training strategy
3. Training re cords
4. Service continuity plan training materials
5. Training feedback evaluati ons
Subpractices
1. Identify any specialized training needs based on skill gaps for the activities
described in the plans.
2. Develop a strategy for conducting service continuity plan training.
The strategy should address how the training is delivered and the means by which
the competency of the resources involved is ascertained. The strategy should also
note the frequency of training offerings and how participation in the training is
documented.
3. Develop training materials and resources to conduct plan training on a regular
and ongoing basis.
4. Train resou rce s as nec essary t o fulfill their res ponsibil ities in the pla n.
5. Update service continuity plans, if necessary, as a result of feedback from training.
844 PART THREE CERT-RMM PROCESS AREAS
SC:SG4 VALIDATE SERVICE CONTINUITY PLANS
Service continuity plans are validated to ensure they satisfy requirements and standards
and to resolve conflicts between plans.
Before plans can be executed, the organization must validate the plans to ensure
that they meet the organization’s standards and guidelines, that they enable the
satisfaction of resilience requirements, and that plans do not cause resource con-
flicts or other potential bottlenecks.
The identification, documentation, and analysis of operational resilience requirements for services
and associated assets are addressed in the Resilience Requirements Development process area.
The management of requirements for services and associated assets is addressed in the
Resilience Requirements Management process area.
SC:SG4.SP1 VALIDATE PLANS TO REQUIREMENTS AND STANDARDS
Service continuity plans are examined to ensure they satisfy requirements and standards.
The service continuity plans are part of the organization’s overall operational
resilience management strategy for services and assets. In essence, the plans are one
of many functional controls that the organization implements to ensure that serv-
ices and assets are resilient to disruption and interruption. Thus, service continuity
plans are a means for satisfying the resilience requirements of services and assets.
As a result, service continuity plans must be objectively reviewed to ensure that
they are sufficient given the resilience requirements of related services and assets.
In addition, to ensure plan consistency, accuracy, completeness, and effective-
ness, service continuity plans are examined against the organization’s standards
and guidelines for plan development. This ensures consistent levels of documen-
tation, the inclusion of required elements (such as stakeholders), and the ability
of the plans to meet stated objectives. This also provides the organization an abil-
ity to review the logic of the plans and to make appropriate adjustments where
inconsistencies or gaps are found.
Ty p i c a l w o r k p r o d u c t s
1. Requirements gaps
2. Plan content issues and concerns
3. Plan updates and remediation actions
Subpractices
1. Review plans for consistency in achieving stated resilience requirements for ser-
vices and associated assets.
2. Review plans for adherence to service continuity plan development standards and
guidelines (refer to SC:SG1.SP2).
Service Continuity 845
SC
3. Identify plan omissions, gaps, and issues, and develop appropriate plan updates
and remediation actions.
The plan walk-through can identify issues that pose risk to the organization
because of poor coverage, inability of a plan’s stated activities to meet objectives,
poor documentation, etc. These issues must be identified and addressed as risks to
meeting the related service or asset resilience requirements. As with all risks,
proper risk disposition and mitigation actions should follow this practice.
Managing risks to high-value services and assets is addressed in the Risk Management
process area.
SC:SG4.SP2 IDENTIFY AND RESOLVE PLAN CONFLICTS
Conflicts between service continuity plans are identified and resolved.
Because of the sheer volume of service continuity plans and the operational inter-
connection of many services and assets, service continuity plans often overlap or
place reliance on the same set of organizational resources. For example, an organi-
zation may have an off-site facility that is named in more than one plan as a backup
site, but if more than one plan is executed simultaneously, the facility may not be
able to satisfy requirements as prescribed in any single plan. More commonly, some
people are often named in multiple service continuity plans that may have to be
executed simultaneously. These types of conflicts must be identified and resolved.
Ty p i c a l w o r k p r o d u c t s
1. Plan conflicts
2. Plan updates and remediation actions
Subpractices
1. Review plans to determine plan conflicts.
2. Determine the severity of plan conflicts and develop appropriate mitigation
actions to reduce or eliminate the conflicts.
Conflicts that would impede successful plan execution pose operational risks that
must be mitigated by the organization. Remember that the conflict may affect more
than one plan, and therefore mitigation actions may have to be performed on more
than one plan.
3. Rewrite or revise plans as necessary.
These are examples of possible actions the organization can take to resolve conflicts:
• Revise or rewrite conflicting plans.
• Prioritize plans to make use of conflicting resources.
• Resolve conflicting resources by replacing them with other resources.
• Provide training for staff members who would be affected by plan conflicts.
846 PART THREE CERT-RMM PROCESS AREAS