Introducing OCTAVE Allegro - Software Engineering Institute ...

• improve documentation and organization of data (through efficient and effective design of
worksheets and reducing the amount of data carry-forward)
• be self-correcting (by building in checks and balances that allow users to realize they are off
course before they expend considerable resources)
2.3.5 Encouraging Institutionalization and Repeatability
To be effective, risk assessment activities must be part of a larger continuous risk management
process. Properly positioned, risk assessment serves as the diagnostic component of continuous
risk management—the organization uses risk assessment to determine the status of controls that it
has implemented to manage information security and prepares and implements plans to close any
identified gaps. Thus, risk assessment not only helps the organization to establish a baseline from
which measurement can occur, but it also helps the organization keep pulse on the current status
of its security effectiveness through repeated and consistent use over time.
To encourage the use of risk assessment as a tool in a continuous risk management process, an
updated OCTAVE method must be accessible to as many users in the organization as possible,
require low levels of effort and investment, and aim to produce consistently meaningful results.
2.3.6 Producing Consistent and Comparable Results Across the Enterprise
An organization must be able to make use of the results of information security risk assessment in
a way that supports and enables a larger enterprise risk management effort. This requires that the
methodology allow the organization to achieve not only consistent results over time but results
that are comparable across operating units and lines of business. In addition, the results produced
by the methodology must be a factor of the successful execution of the methodology steps, not
dependent solely on the analysis team that is performing the assessment.
2.3.7 Facilitating the Development of a Risk Assessment Core Competency
A risk-aware culture results when employees throughout the organization cultivate their risk management
understanding and skill set and use that knowledge as a guiding force for performing
their job responsibilities on a daily basis. Learning to perform risk assessment is a foundational
way to improve these competencies and to promote a risk-aware culture. However, this requires
that the risk assessment methodology be accessible, have low barriers to use (such as the degree to
which specialized training is necessary), and produce meaningful results that are purposeful for
helping employees to better perform their jobs.
2.3.8 Supporting Enterprise Compliance Activities
The information security activities of many organizations are driven by their need to manage an
increasingly regulated environment. While organizations need to be focused on managing risks,
they want to be able to act quickly and achieve compliance efficiently. Thus, a risk assessment
methodology must be able to easily support information security risk management activities that
enable compliance with various laws and regulations.
10 | CMU/SEI-2007-TR-012