CERT-RMM
CERT Resilience Management Model, version 1.2 — Carnegie Mellon University Software Engineering Institute (SEI)
Also known as: CERT-RMM, CERT RMM, CERT Resilience Management Model
At a glance
- Status
- In force
- Next deadline
- None announced
- Who must comply
- Any organisation that wants to determine its capability to manage operational resilience, set goals and targets, and plan to close the gaps. source
- How it is assessed
- Organisations use the model to determine their own capability, set targets and plan improvements; SEI also describes model changes that affect appraisals. source
- Written by
- The CERT Division of the Software Engineering Institute (SEI) at Carnegie Mellon University publishes the model. source source
- Enforced by
- SEI presents CERT-RMM as a process improvement model that an organisation can use to assess and improve its own resilience management. source
- Last change
- None recorded yet
A maturity model from the CERT Division of Carnegie Mellon's SEI that treats security, business continuity and IT operations as one discipline — operational resilience — across twenty-six process areas. It is the ancestor of several later maturity models, including the US Department of Energy's C2M2.
Recent changes
No changes recorded yet — we are watching, and nothing has been published.
Key dates
No upcoming datesVersion history
-
CERT-RMM Version 1.2 RevisionCurrent
Made available for download with enhancements to readability and usability and removal of redundancies, including changes that affect appraisals. source
More
- Generic practice GG2.GP8 was retitled "Measure and Control the Process" in all process areas, with new example measures.
- The Communications process area was restructured, merging its second specific goal into the first.
Who it applies to
A process improvement model for operational resilience that any organisation can use to measure and improve its resilience management.
- Purpose
- CERT-RMM defines the essential organisational practices needed to manage operational resilience, as the foundation for a process improvement approach. source
- Contents
- Version 1.2 provides the model's process areas, generic goals and practices, glossary and acronyms. source
- Process areas
- The Version 1.2 model document is organised into 26 process areas, from Asset Definition and Management to Vulnerability Analysis and Resolution. source
- Distribution
- Version 1.2 is approved for public release and unlimited distribution, subject to the SEI copyright notice. source
How compliance is assessed
Organisations use the model to determine their own capability, set targets and plan improvements; SEI also describes model changes that affect appraisals.
- Self-evaluation
- Organisations use CERT-RMM to determine their capability to manage resilience, set goals and targets, and develop plans to close identified gaps. source
- Appraisals
- The Version 1.2 release notes describe the more significant model changes, including those that would affect appraisals. source
Enforcement and penalties
SEI presents CERT-RMM as a process improvement model that an organisation can use to assess and improve its own resilience management.
- How it is used
- SEI describes CERT-RMM as the foundation for a process improvement approach that an organisation can use to determine its capability to manage resilience, set goals and targets, and develop plans to close identified gaps. source
Documents
Verified against official sources on 18 October 2026. We monitor the official sources for this framework. Watching since 20 September 2026. Subscribe to CERT-RMM (RSS)