DOCSLIB.ORG

Defining Incident Management Processes for Csirts: a Work in Progress

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Defining Incident Management Processes for Csirts: a Work in Progress Defining Incident Management Processes for CSIRTs: A Work in Progress Chris Alberts Audrey Dorofee Georgia Killcrece Robin Ruefle Mark Zajicek October 2004 TECHNICAL REPORT CMU/SEI-2004-TR-015 ESC-TR-2004-015 Pittsburgh, PA 15213-3890 Defining Incident Management Processes for CSIRTs: A Work in Progress CMU/SEI-2004-TR-015 ESC-TR-2004-015 Chris Alberts Audrey Dorofee Georgia Killcrece Robin Ruefle Mark Zajicek October 2004 Networked Systems Survivability Program Unlimited distribution subject to the copyright. This report was prepared for the SEI Joint Program Office HQ ESC/DIB 5 Eglin Street Hanscom AFB, MA 01731-2116 The ideas and findings in this report should not be construed as an official DoD position. It is published in the interest of scientific and technical information exchange. FOR THE COMMANDER Christos Scondras Chief of Programs, XPK This work is sponsored by the U.S. Department of Defense. The Software Engineering Institute is a federally funded research and development center sponsored by the U.S. Department of Defense. Copyright 2004 Carnegie Mellon University. NO WARRANTY THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN "AS-IS" BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT. Use of any trademarks in this report is not intended in any way to infringe on the rights of the trademark holder. Internal use. Permission to reproduce this document and to prepare derivative works from this document for internal use is granted, provided the copyright and "No Warranty" statements are included with all reproductions and derivative works. External use. Requests for permission to reproduce this document or prepare derivative works of this document for external and commercial use should be addressed to the SEI Licensing Agent. This work was created in the performance of Federal Government Contract Number F19628-00-C-0003 with Carnegie Mel- lon University for the operation of the Software Engineering Institute, a federally funded research and development center. The Government of the United States has a royalty-free government-purpose license to use, duplicate, or disclose the work, in whole or in part and in any manner, and to have or permit others to do so, for government purposes pursuant to the copy- right license under the clause at 252.227-7013. For information about purchasing paper copies of SEI reports, please visit the publications portion of our Web site (http://www.sei.cmu.edu/publications/pubweb.html). Table of Contents Preface .......................................................................................................... ix Acknowledgements.............................................................................................. xiii Abstract ......................................................................................................... xv 1 Introduction ..................................................................................................... 1 1.1 Definition of a CSIRT ............................................................................... 1 1.2 Definition of Incident Management........................................................... 2 1.3 Who Performs Incident Management ....................................................... 5 1.4 A Process Model for Incident Management .............................................. 8 1.5 Purpose of this Report ............................................................................. 9 1.6 Scope of this Report .............................................................................. 10 1.7 Intended Audience ................................................................................. 11 1.8 Use of this Report .................................................................................. 12 1.9 Structure of the Report........................................................................... 13 1.10 Reading and Navigating this Report....................................................... 14 2 Incident Management Concepts and Processes......................................... 15 2.1 Incident Management Requirements...................................................... 15 2.2 Overview of Incident Management Processes........................................ 16 2.3 Why We Chose These Processes.......................................................... 19 2.4 Incident Management Versus Security Management............................. 23 2.5 Applying These Incident Management Concepts and Processes ........... 27 2.6 Getting Started....................................................................................... 34 2.7 Detailed Workflow Diagrams and Descriptions....................................... 35 3 Overview of Process Mapping...................................................................... 37 3.1 What is Process Mapping?..................................................................... 37 3.2 Applying Process Mapping to Incident Management.............................. 38 3.3 Our Process Mapping Methodology ....................................................... 39 3.3.1 Additional Uses for the Workflow Model ..................................... 41 CMU/SEI-2004-TR-015 i 3.4 Guide to Reading the Incident Management Process Maps....................42 3.4.1 Workflow Diagrams.....................................................................42 3.4.2 Workflow Descriptions.................................................................46 4 Incident Management Process Workflows and Descriptions ....................49 4.1 Overview ................................................................................................49 4.2 Incident Management .............................................................................50 4.2.1 PC: Prepare/Sustain/Improve Process (Prepare) ........................54 4.2.1.1 PC: Prepare/Sustain/Improve Workflow Diagram .........56 4.2.1.2 PC: Prepare/Sustain/Improve Workflow Description.....58 4.2.1.3 Handoff from Any Activity Inside or Outside CSIRT Process to PC: Prepare/Sustain/Improve .....................68 4.2.1.4 Handoff from PC: Prepare/Sustain/Improve to PI: Protect Infrastructure ................................................................72 4.2.2 PI: Protect Infrastructure Process (Protect) .................................76 4.2.2.1 PI: Protect Infrastructure Workflow Diagram.................80 4.2.2.2 PI: Protect Infrastructure Workflow Description.............82 4.2.2.3 Handoff from Any Activity Inside or Outside CSIRT Process to PI: Protect Infrastructure .............................86 4.2.2.4 Handoff from PI: Protect Infrastructure to D: Detect Events ..........................................................................90 4.2.3 D: Detect Events Process ...........................................................94 4.2.3.1 Reactive Detection .......................................................94 4.2.3.2 Proactive Detection ......................................................94 4.2.3.3 Detect Events Details ...................................................95 4.2.3.4 D: Detect Events Workflow Diagram.............................98 4.2.3.5 D: Detect Events Workflow Description ......................100 4.2.3.6 Handoff from Any Activity Inside or Outside of the Organization to D: Detect Events................................104 4.2.3.7 Handoff from D: Detect Events to T: Triage Events ....108 4.2.4 T: Triage Events (Triage) Process .............................................112 4.2.4.1 T: Triage Events Workflow Diagram ...........................116 4.2.4.2 T: Triage Events Workflow Description.......................118 4.2.4.3 Handoff from T: Triage Events to R: Respond ............122 4.2.5 R: Respond Process .................................................................128 4.2.5.1 Technical Response...................................................128 4.2.5.2 Management Response .............................................129 4.2.5.3 Legal Response .........................................................129 4.2.5.4 Coordination of Response Activities ...........................129 4.2.5.5 R: Respond Workflow Diagram ..................................132 4.2.5.6 R: Respond Workflow Description ..............................134 4.2.5.7 Handoff from R: Respond to PC: Prepare/Sustain/Improve............................................140 ii CMU/SEI-2004-TR-015 4.2.5.8 R1: Respond to Technical Issues Workflow Diagram...................................................... 144 4.2.5.9 R2: Respond to Management Issues Workflow Diagram...................................................... 148 4.2.5.10 R3: Respond to Legal Issues Workflow Diagram ....... 152 5 Future Work................................................................................................. 157 Bibliography ....................................................................................................... 161 Appendix A: Context for Each of the Process Workflows........................ A-1 Appendix B: Acronyms................................................................................ B-1 Appendix C: Glossary.................................................................................
Load more

Recommended publications
  • National Incident Management System What Is NIMS?
    NIMS National Incident Management System What is NIMS? • A comprehensive, national approach to incident management • Applicable at all jurisdictional levels and across disciplines NIMS Compliance Your jurisdiction must adopt NIMS: • ICS by Oct 1, 2004 • Other aspects by a later dates Why Do We Need NIMS? Lessons learned have shown the need for: • A coordinated response. • Standardization. • Interoperability. NIMS Concepts and Principles NIMS is: • Flexible to enable all responding organizations to work together. • Standardized to improve overall response and interoperability. NIMS Standard Structures • Incident Command System (ICS) • Multiagency Coordination Systems • Public Information Systems Preparedness • Planning, training, and exercises • Personnel qualification and certification • Equipment acquisition and certification • Publication management • Mutual aid/Emergency Management Assistance Compacts Resource Management Includes standardized: • Descriptions • Inventories • Mobilization • Dispatch • Tracking • Recovery Communications/Information Management NIMS identifies requirements for: • Communications. • Information management. • Information sharing. Supporting Technologies NIMS provides systems to standardize: • Voice and data communications. • Information management. • Data displays. Command and Management NIMS Overview Lesson 2 Command and Management • Command and management under NIMS • Incident Command System overview Lesson Objectives • Identify the benefits of using ICS as the model incident management system. • Identify
    [Show full text]
  • NWCG Standards for Interagency Incident Business Management
    A publication of the National Wildfire Coordinating Group NWCG Standards for Interagency Incident Business Management PMS 902 April 2021 NWCG Standards for Interagency Incident Business Management April 2021 PMS 902 The NWCG Standards for Interagency Incident Business Management, assists participating agencies of the NWCG to constructively work together to provide effective execution of each agency’s incident business management program by establishing procedures for: • Uniform application of regulations on the use of human resources, including classification, payroll, commissary, injury compensation, and travel. • Acquisition of necessary equipment and supplies from appropriate sources in accordance with applicable procurement regulations. • Management and tracking of government property. • Financial coordination with the jurisdictional agency and maintenance of finance, property, procurement, and personnel records, and forms. • Use and coordination of incident business management functions as they relate to sharing of resources among federal, state, and local agencies, including the military. • Documentation and reporting of claims. • Documentation of costs and cost management practices. • Administrative processes for all-hazards incidents. Uniform application of interagency incident business management standards is critical to successful interagency fire operations. These standards must be kept current and made available to incident and agency personnel. Changes to these standards may be proposed by any agency for a variety of reasons: new law or regulation, legal interpretation or opinion, clarification of meaning, etc. If the proposed change is relevant to the other agencies, the proponent agency should first obtain national headquarters’ review and concurrence before forwarding to the NWCG Incident Business Committee (IBC). IBC will prepare draft NWCG amendments for all agencies to review before finalizing and distributing.
    [Show full text]
  • Incident Management Program Page 1
    RM-55 Chapter 1 Incident Management Program Page 1 RM-55 Table of Contents Incident Management Program Table of Contents Chapter 1 Introduction Chapter 2 Authorities Chapter 3 Definitions Chapter 4 Program Management Chapter 5 Qualifications and Certification Chapter 6 Workforce Development Chapter 7 Incident and Event Management Chapter 8 Team Management Chapter 9 Incident Business Management Chapter 10 Interagency Coordination Appendix A Acronyms RM-55 Chapter 1 Incident Management Program Page 1 Chapter 1 Introduction 1.1 Purpose 1.2 Objectives 1.3 Background 1.1 Purpose Reference Manual 55 (RM-55) provides comprehensive information, standard operating procedures, and other recommendations for implementing the policies and requirements of Director’s Order #55 (DO#55), the National Park Service (NPS) Incident Management Program. 1.2 Objectives This RM meets the following objectives: 1. Reference and describe the authorities for the NPS Incident Management Program. 2. Describe the historical development of incident management in general and the NPS “all- hazard” (i.e., non-wildland fire) Incident Management Program in particular. 3. Provide definitions for pertinent incident management terminology. 4. Describe how the NPS Incident Management Program is managed. 5. Describe how NPS will develop qualifications and certifications for incident management personnel. 6. Provide a transition plan for NPS non-fire incident management qualifications. 7. Describe the workforce development plan for NPS incident management personnel. 8. Provide guidelines for non-fire incident and event management. 9. Provide guidelines for the management of all-hazard IMTs (IMTs). 10. Provide incident business management procedures specific to NPS for non-fire incidents and events. 11.
    [Show full text]
  • National Interagency Buying Team Guide
    Interagency Buying Team Guide April 2019 Table of Contents I. INTRODUCTION ............................................................................................................................. 3 II. ORGANIZATION, QUALIFICATIONS AND TRAINING ............................................................ 3 A. Organization ................................................................................................................................... 3 B. Qualifications and Training ........................................................................................................... 4 III. MOBILIZATION AND DEMOBILIZATION ................................................................................. 5 IV. BUYING TEAM KIT ........................................................................................................................ 5 A. Equipment (Leader’s Responsibility) ............................................................................................ 5 B. Internet/Intranet Website References ............................................................................................. 6 C. Suggested Set-up Supplies ............................................................................................................. 7 D. Forms ............................................................................................................................................. 7 V. RESPONSIBILITIES .......................................................................................................................
    [Show full text]
  • Review of Literature and Practices for Incident Management Programs Technical Report
    Review of Literature and Practices for Incident Management Programs Technical Report PRC 15-56 T Review of Literature and Practices for Incident Management Programs Texas A&M Transportation Institute PRC 15-56 T June 2016 Authors Tim Lomax Lauren Simcic 2 Table of Contents List of Tables ................................................................................................................................. 4 List of Acronyms ........................................................................................................................... 5 Review of Literature and Practices for Incident Management Programs .............................. 6 The Federal Highway Administration: Incident Management Key Strategies ...................... 7 Performance Measures and Targets ......................................................................................... 10 Key Rapid Clearance Strategy Elements .................................................................................. 12 Unified Incident Command ....................................................................................................... 12 Standardized Operations and Response Practices ..................................................................... 12 Developing the Framework of a Successful TIM Program ....................................................... 13 More Coordinated and Timely Use of Technology................................................................... 13 Availability of Transportation Incident Responders ................................................................
    [Show full text]
  • Incident Management Is Your First- Step Resource to Start Or Improve Effective Ethics and Compliance Intake and Reporting Programs
    GU IVE IDE S NIT E I RI EF E D S Abridged GUI DEFINITIVE GUIDE TO IVE DE IT SE IN R F IE E S D GUI IVE DE IT SE IN R F IE E S INCIDENTD MANAGEMENT GUI IVE DE IT SE IN R F IE E S D Going Beyond the Whistleblower Hotline This version of our Definitive Guide to Incident Management is your first- step resource to start or improve effective ethics and compliance intake and reporting programs. Supplied by Why Is an Incident Management Program Important? A comprehensive incident management system allows an organization to capture, investigate and manage ethics and compliance reports from across the organization in a centralized database, regardless of reporting channel. Research continues to show that organizations with strong ethical cultures have lower rates of witnessed misconduct. By implementing an incident management program, organizations are asking and encouraging employees and third parties to report potential unethical behavior. The National Business Ethics Survey revealed that 41 percent of all employees have personally witnessed misconduct. When those events of misconduct show a repetitive pattern, it is a key indicator of a weaker culture. That’s why every organization needs a centralized, consistent way to learn about issues. An effective incident management program does more than reduce organizational risk. Requesting and addressing employee concerns and potential misconduct creates a culture of trust and respect. As employees are able to raise concerns confidentially or anonymously, and see those issues addressed, they build confidence that their requests will be handled and resolved using a consistent and fair process.
    [Show full text]
  • Rfp 21-06 Incident Response Management System Final
    CITY OF PORT ORANGE, FLORIDA REQUEST FOR PROPOSAL RFP #21-06 INCIDENT RESPONSE MANAGEMENT SYSTEM City of Port Orange Purchasing Division Prepared by Joseph Castro, Buyer Release Date: June 17, 2021 Proposal Due Date and Time: July 22, 2021 at 2:30 P.M. City of Port Orange, Florida 1000 City Center Circle Port Orange, FL 32129 (386) 506-5740 [email protected] www.port-orange.org RFP 21-06 INCIDENT RESPONSE MANAGEMENT SYSTEM 1 of 72 Legal Notice to Proposers RFP 21-06 INCIDENT RESPONSE MANAGEMENT SYSTEM Notice is hereby given that the City of Port Orange is soliciting proposals for RFP 21-06 INCIDENT RESPONSE MANAGEMENT SYSTEM. Proposals will be accepted in the City Clerk’s Office, Port Orange City Hall, 1000 City Center Circle, Port Orange, Florida 32129 until 2:30 P.M. on July 22, 2021, which may be amended by addendum issued by the City. All untimely proposals will not be considered and will be returned to the Proposer unopened. All proposals will be evaluated to ensure they contain all the required forms in order to deem the Proposer responsive or non-responsive. Proposals will be opened, and Proposers Names will be read aloud at 2:30 P.M. in the Council Chambers located on the first floor of City Hall, 1000 City Center Circle, Port Orange, Florida, 32129. There will be a Non-Mandatory Pre-Proposal Conference for the project at 10:00 A.M. (local time) on July 1, 2021 at City Hall, Council Chambers (1st floor), 1000 City Center Circle, Port Orange, Florida 32129.
    [Show full text]
  • Cyber-Incident Management
    SIPRI Policy Paper CYBER-INCIDENT 55 MANAGEMENT September 2020 Identifying and Dealing with the Risk of Escalation johan turell, fei su and vincent boulanin STOCKHOLM INTERNATIONAL PEACE RESEARCH INSTITUTE SIPRI is an independent international institute dedicated to research into conflict, armaments, arms control and disarmament. Established in 1966, SIPRI provides data, analysis and recommendations, based on open sources, to policymakers, researchers, media and the interested public. The Governing Board is not responsible for the views expressed in the publications of the Institute. GOVERNING BOARD Ambassador Jan Eliasson, Chair (Sweden) Dr Vladimir Baranovsky (Russia) Espen Barth Eide (Norway) Jean-Marie Guéhenno (France) Dr Radha Kumar (India) Ambassador Ramtane Lamamra (Algeria) Dr Patricia Lewis (Ireland/United Kingdom) Dr Jessica Tuchman Mathews (United States) DIRECTOR Dan Smith (United Kingdom) Signalistgatan 9 SE-169 72 Solna, Sweden Telephone: + 46 8 655 9700 Email: [email protected] Internet: www.sipri.org Cyber-incident Management Identifying and Dealing with the Risk of Escalation SIPRI Policy Paper No. 55 johan turell, fei su and vincent boulanin September 2020 © SIPRI 2020 All rights reserved. No part of this publication may be reproduced, stored in a retrieval system or transmitted, in any form or by any means, without the prior permission in writing of SIPRI or as expressly permitted by law. ISBN 978-91-85114-99-3 Contents Preface v Acknowledgements vi Summary vii Abbreviations x 1. Introduction 1 2. Analytic framework: The concepts of escalation and de-escalation 4 and the actors involved Escalation and de-escalation: A brief review of the literature 4 Definitions of escalation and de-escalation in this paper 5 Types of actor involved in cyber incidents 8 3.
    [Show full text]
  • S260 Unit 11 Cost Accounting
    S-260: Interagency Incident Business Management Unit 11 – COST ACCOUNTING Cost accounting requires an awareness of your financial surroundings. For instance, is there a dozer sitting idle? Do you consistently forget to post your time daily? Maybe the incident management team (IMT) has recognized a big-picture problem leading to wasteful spending. Cost accounting is managing costs wherever and whenever you can. It’s doing what you can to ensure the best use of federal, state, and local funds. In this unit, we’ll review who’s responsible for tracking costs and how costs are analyzed, managed, and contained. Balancing an incident’s needs with cost expenditures is yet another challenge on a fire. We’re going to tell you why and how it’s done and who’s responsible. This topic covers: • Reasons to track costs • Responsibilities • Daily reporting requirements • Cost categories Any sound business has its eye on the bottom line. Documenting, tracking, and analyzing expenditures are all part of fiscal responsibility. There's a delicate balance between saving money and spending money in order to make the best strategic decisions. There are five identified reasons why costs need to be tracked: • Financial oversight • Recoup billable or reimbursable costs • Efficient resource management • Ensure compliance • Satisfy reporting requirements Financial Oversight Financial oversight of the incident is the responsibility of the agency administrator, who develops the Wildland Fire Decision Support System (WFDSS) to assist in financial decision making. The WFDSS is a critical document linking delegation of authority with agency-preferred operational strategies and spending limitations. Recouping Costs Tracking costs allows departments to identify which expenditures can be recovered.
    [Show full text]
  • Copy of Incident Management Procedures & Guidance
    CONFIDENTIAL WBC.100.118.8029 Incident Management Procedures & Guidance FOR INTERNAL USE ONLY Document Owner: Group Head of Operational Risk & Insurance Date updated: December 2015 Version: 2.9 Location: Risk Document Library Incident Management Procedures & Guidance Page 1 of 62 CONFIDENTIAL WBC.100.118.8030 Document version control No. Date Version Author Description 1 - 5 11/06 V0.1 Mike Purvis Drafting to support introduction of new process at 1 Dec 06. 6 8/1/07 V0.2 Mike Purvis Drafting to reflect introduction of new processes at 31 Dec 06 7 22/1/07 V0.3 Mike Purvis Drafting to reflect new systems in February 07 8 06/02/07 V1.0 Steven Bardy Drafting to reflect Business Unit input and changes to reflect migration to new Policy Framework 9 15/02/07 V1.1 Aislinn Strang ORMF review amendments 10 07/08/07 V1.2 Maebehe Garcia Drafting to clarify issues related to credit and market risks and other amendments 11 24/04/08 V1.5 Andrew Leslie Annual Review Update for Rapid Recovery, Insurance Threshold and APS115 12 23/12/08 V1.6 Dung Thien Tran Update for the implementation of ACCORD 13 22/04/09 V1.7 Andrew Leslie Add hand written marked up edits to electronic version 14 15/05/09 V1.8 Andrew Leslie Simplified content. Integrated version to include SGB. 15 27/07/09 V2.0 Luke Tazelaar Updated from BU feedback 16 01/03/12 V2.1 Nadine Schaefer- Updated to reflect Policy updates and add additional Medappa guidance 17 02/04/12 V2.2 David Tan Updated to include operational risk related to project costs 18 24/04/12 V2.3 David Tan Updated to clarify about the treatment of near misses 19 05/06/12 V2.4 David Tan .
    [Show full text]
  • Incident Management and Control (IMC) CERT-RMM Process Area
    CERT® Resilience Management Model, Version 1.2 Incident Management and Control (IMC) Richard A. Caralli Julia H. Allen David W. White Lisa R. Young Nader Mehravari Pamela D. Curtis February 2016 CERT Program Unlimited distribution subject to the copyright. http://www.cert.org/resilience/ Copyright 2016 Carnegie Mellon University This material is based upon work funded and supported by various entities under Contract No. FA8721-05-C-0003 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center sponsored by the United States Department of Defense. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of Various or the United States Department of Defense. NO WARRANTY. THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN “AS-IS” BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRANTIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTABILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT. [Distribution Statement A] This material has been approved for public release and unlimited distribution. Please see Copyright notice for non-US Government use and distribution. Internal use:* Permission to reproduce this material and to prepare derivative works from this material for internal use is granted, provided the copyright and “No Warranty” statements are included with all reproductions and derivative works.
    [Show full text]
  • ITIL Business Relationship Management Explained
    ITIL Business Relationship Management Explained Business Relationship Management (BRM) is the part of the ITIL framework that deals with anticipating current and future customer needs. It is primarily defined in theService strategy phase which contains the following major processes, aside from BRM: Service portfolio management Financial management for IT services Demand management Strategy management for IT services In short, with BRM, the value of service delivery is optimized for the customer, strengthening the relationship between client and organization. Download Now: ITIL 4 Best Practice e- Books These all-new for 2020 ITIL e-books highlight important elements of ITIL 4 best practices. Quickly understand key changes and actionable concepts, written by ITIL 4 contributors. Free Download › Free Download › In addition to Service Strategy, BRM impacts other parts of the lifecycle in a number of ways. Service design Due to the close relationship between Service Strategy and Service Design (which includes Service Level Management or SLMs), a few processes require the principles of BRM. However, the line between SLM and BRM is sometimes poorly defined. SLM proactively ensures that service levels are delivered consistently to clients, which requires the Business Relationship Manager to be continuously involved in the process. Other functions closely related to SLM such as availability and capacity are also impacted by BRM involvement. Service operation The Service operation part of the ITIL lifecycle offers opportunities for the Business Relationship Manager to participate in Incident Management and Problem Management. He or she is responsible for liaising between the client and the organization regarding incidents as well as collecting customer feedback.
    [Show full text]