search menu icon-carat-right cmu-wordmark

The Critical Success Factor Method: Establishing a Foundation for Enterprise Security Management

July 2004 Technical Report
Richard A. Caralli Contributor James F. Stevens, Bradford J. Willke, William R. Wilson

In this report, the authors describe the critical success factor method and present theories and experience in applying it to enterprise security management.


Software Engineering Institute

CMU/SEI Report Number


DOI (Digital Object Identifier):


Every organization has a mission that describes why it exists (its purpose) and where it intends to go (its direction). The mission reflects the organization's unique values and vision. Achieving the mission takes the participation and skill of the entire organization. The goals and objectives of every staff member must be aimed toward the mission. However, achieving goals and objectives is not enough. The organization must perform well in key areas on a consistent basis to achieve the mission. These key areas—unique to the organization and the industry in which it competes—can be defined as the organization's critical success factors. 

The critical success factor method is a means for identifying these important elements of success. It was originally developed to align information technology planning with the strategic direction of an organization. However, in research and fieldwork undertaken by members of the Survivable Enterprise Management (SEM) team at the Software Engineering Institute, it has shown promise in helping organizations guide, direct, and prioritize their activities for developing security strategies and managing security across their enterprises. This report describes the critical success factor method and presents the SEM team's theories and experience in applying it to enterprise security management.