Build measurable operational resilience with CERT-RMM

CERT-RMM is the CERT Resilience Management Model, a process improvement model for managing operational resilience developed by the CERT Division of Carnegie Mellon University's Software Engineering Institute. It combines security, business continuity and IT operations into 26 process areas, each with specific goals and practices. Organisations use it to assess their capability to manage resilience, set targets and plan improvements for the services and assets that matter most.

No. CERT-RMM is a voluntary model and no law or regulator requires it. Organisations adopt it because it gives a structured, process-based way to manage operational resilience. Some sectors and customers recognise it, and the US Cyber Resilience Review, a free assessment offered by the US government to critical infrastructure organisations, was derived from CERT-RMM, so the two share much of their language and structure.

Version 1.2 has 26 process areas grouped into Engineering, Enterprise Management, Operations Management and Process Management. Examples include Asset Definition and Management, Access Management, Incident Management and Control, Risk Management, Service Continuity, External Dependencies Management, and Vulnerability Analysis and Resolution. Each process area has specific goals and practices, and three generic goals describe how each process is performed, managed and defined.

No formal certification scheme exists for CERT-RMM. Instead, organisations measure their capability in each process area, either through self-assessment or an appraisal, and compare results against the capability levels they have chosen as targets. Results are typically used internally to plan improvements and report progress to leadership, rather than as a certificate shown to customers.

CERT-RMM is broader than ISO 27001 or SOC 2 because it covers business continuity, people, facilities and IT operations as well as information security. Many of its practices, such as asset inventory, access management, incident handling and supplier management, overlap with ISO 27001 Annex A controls and SOC 2 criteria. Mapping one control set across all three avoids collecting the same evidence several times.

Version 1.2 is the latest release of the model. According to the SEI release notes, it made numerous enhancements to improve readability and usability and to remove redundancies, including some changes that affect appraisals. It is published in the SEI Digital Library as a set of process area chapters together with the generic goals and practices, a glossary and an acronym list.

It depends on how many process areas you target and the capability level you aim for. Most organisations do not adopt all 26 process areas at once. A common approach is to start with the areas most relevant to critical services, such as asset management, risk, incident management and service continuity, establish a baseline, then expand scope and raise capability over time.

Yes, on request. CERT-RMM v1.2 is mapped in OneClickComply's control library and is available on request rather than as a ready-to-adopt framework today. Once enabled, its process areas link to the controls you already run for other frameworks, with automated evidence collection, continuous monitoring and guidance from our in-house audit team. OneClickComply does not certify CERT-RMM capability.