CERT® Resilience Management Model: A Maturity Model for Managing Operational Resilience

Part Two: Process Institutionalization and Improvement

The concept of using a maturity model to improve operational resilience may not at first glance appear to provide significant advantages over the simple implementation of a code of practice. Codes of practice, after all, typically represent a cumulative view of how an industry faces a challenge such as information security and can be of great benefit to all organizations that share this challenge. For some organizations, using practices alone will bring about improvement—improvement in the way that passwords and user IDs are managed, how incidents are handled, or how continuity plans are developed and tested. But lasting improvement depends on the organization’s ability to develop and ...