PNNL

Abstract

Abstract. The idea that resilience is a tangible, measureable, and desirable system attribute has grown rapidly over the last decade beyond is origins in explaining ecological, physiological, psychological, and social systems. Operational enterprise resilience requires two types of measurement. First, the system must monitor various operational conditions in order to respond to disruptions. These measurements are part of one or more observation, orientation, decision, and action (OODA) loops The OODA control processes that implement a resilience strategy use these measurements to provide robustness, rapid recovery and reconstitution. In order to assess the effectiveness of the resilience strategy, a different class of measurements is necessary. This second type consists of measurements about how well the OODA processes cover critical enterprise functions and the hazards to which the enterprise is exposed. They allow assessment of how well enterprise management processes anticipate, mitigate, and adapt to a changing environment and the degree to which the system is fault tolerant. This paper nominates a theoretical framework, in the form of definitions, a model, and a syntax, that accounts for this important distinction, and in so doing provides a mechanism for bridging resilience management process models and the many proposed cyber-defense metric enumerations.