Resilience Management Model (RMM) is a maturity model for organising and improving an organisation’s resilience capabilities through defined process areas and staged improvement. Teams use it to assess current practice, prioritise gaps, and measure progress across governance, preparedness, response, and recovery. Keep assessments evidence based and tie actions to business continuity objectives.
What RMM actually measures
RMM is not a checklist and it is not a one-time audit. It is a maturity model, so its main job is to show how consistently resilience capabilities exist across the organisation, how repeatable they are, and where they need to become more disciplined. The value is in comparing current practice to a defined set of process areas rather than relying on anecdote or local team confidence.
That is why the model works best when teams treat each process area as an operational capability, not as a policy statement. Governance, preparedness, response, and recovery only become meaningful when they can be observed in evidence, exercised under pressure, and improved over time. For a deeper view of the broader resilience concept, see the Cyber Resilience Guide.
How the staged improvement approach works
RMM works by assigning an organisation a maturity view that helps identify where processes are ad hoc, repeatable, managed, or more fully optimised. That staging matters because resilience usually fails at the seams: unclear ownership, incomplete recovery planning, weak testing discipline, or missing dependencies between business services and technical controls.
The practical use is prioritisation. Teams can use the model to decide which gaps most affect business continuity objectives, which process areas need to be stabilised first, and which improvements will reduce the most operational uncertainty. In resilience programmes, the model is most useful when it leads to sequencing, not just scoring. The same logic applies when a team is tracking resilience engineering progress over time, which is why our Cyber Resilience Guide emphasises impact tolerance, testing, and recovery readiness.
What evidence and operations the model should connect
RMM works properly only when it is evidence based. A maturity claim should be backed by artefacts such as policies, playbooks, test results, recovery records, exercise outcomes, and metrics that show whether the organisation can actually respond and restore service. Without evidence, maturity ratings become subjective and easy to inflate.
It also works best when it is tied to business continuity objectives rather than abstract resilience language. That connection forces a more realistic question: what must stay available, what can degrade gracefully, and what recovery behaviour is acceptable during disruption? Where remote access tooling or managed support platforms are part of the operating model, keep in mind that tool governance is part of resilience too, because unapproved remote administration paths can undermine response discipline and recovery confidence. The RMM Tool Security Guide covers the governance and abuse considerations around those tools.
Risk and Threat Considerations
RMM creates risk when it is treated as a reporting exercise instead of an operating model. Weak evidence, optimistic scoring, or inconsistent process ownership can hide real resilience gaps until an outage, cyber incident, or third-party failure forces the organisation to prove its recovery capability under time pressure.
Failure mechanism: The maturity assessment overstates readiness when process areas are not exercised, dependencies are not mapped, or recovery actions are not tested against realistic business service scenarios. That can leave teams unable to prioritise the right fixes before disruption occurs.
Impact: Recovery takes longer, business services degrade more sharply, and leaders may discover too late that the organisation was resilient on paper but brittle in practice.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, CIS Controls v8 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | RC.RP-01 — Recovery Plan Execution | RMM assesses recovery capability and improvement across resilience processes. |
| GV.RM-01 — Risk Management Strategy | RMM uses maturity scoring to prioritise resilience gaps against business objectives. | |
| Recommendation — Test and refine recovery execution so continuity objectives are achievable under disruption. Align resilience improvements to risk appetite and business continuity priorities. | ||
| CIS Controls v8 | CIS-11 — Data Recovery | RMM depends on validated recovery capability and restoration evidence. |
| Recommendation — Validate recovery procedures and restore tests so resilience claims are evidence based. | ||
| NIST SP 800-53 Rev 5 | CP-2 — Contingency Plan | RMM maps directly to planning, exercising, and improving continuity and recovery capabilities. |
| Recommendation — Maintain and exercise contingency plans that support the organisation's resilience objectives. | ||
| ISO/IEC 27001:2022 | A.5.29 — Information security during disruption | RMM evaluates whether resilience practices hold up during disruptive events. |
| Recommendation — Define and test disruption procedures so security and service delivery remain controlled. | ||
Practitioner Guidance
What to prioritise: Start with the process areas that most directly affect service restoration and continuity decisions, not the ones that are easiest to score highly. If an area cannot be demonstrated with evidence, it should be treated as immature regardless of the written policy.
What to verify: Check that each maturity judgment can be traced to a concrete artefact or exercise outcome, and that the evidence shows repeatability rather than a one-off success. The most useful RMM outputs are the ones that drive an improvement backlog with owners and review dates.
Practitioner takeaway: RMM is most valuable when it turns resilience from a narrative into a measurable operating discipline, so the key question is not “Are we mature?” but “Can we prove we can absorb, respond to, and recover from disruption at the level the business requires?”