RMF-A: An Availability Assurance Framework for Quantitative Evaluation of Operational Resilience

Recent data center incidents have revealed that certification under ISO 22301 and ISO/IEC 27001 does not guarantee real operational resilience. This study presents the Availability Assurance Framework (RMF-A), an extension of the NIST Risk Management Framework that introduces an Availability Assurance Phase. RMF-A combines ISO-based management controls with NIST’s evidence-driven assessment using the Availability Evidence Model (AEM) and the Availability Assurance Index (AAI). AEM defines measurable indicators—recovery rate (RR), recovery time (RTO), and Detection Effectiveness (DET)—and AAI aggregates them into a quantitative assurance score. Validation using three open datasets—Google Cluster Trace, Azure Cloud Trace, and LANL HPC Logs—showed consistent assurance results: Google (AAI = 0.758, ATO-Conditional), Azure (AAI = 0.720, ATO-Conditional), and LANL HPC (AAI = 0.744, ATO-Conditional). The results confirm that RMF-A provides a reproducible, evidence-based approach to quantify operational resilience and ensure continuous availability.