Introducing OCTAVE Allegro - Software Engineering Institute ...

Step 8 – Select Mitigation Approach
BACKGROUND AND NOTES
• Mitigation approach – The way that an organization intends to address a risk. An organization
has the following options: accept, mitigate, or defer.
− Accept – A decision made during risk analysis to take no action to address a risk and
to accept the stated consequences. Risks that are accepted should have little to low
impact on the organization.
− Mitigate – A decision made during risk analysis to address a risk by developing and
implementing controls to counter the underlying threat or to minimize the resulting
impact, or both. Risks that are mitigated are those that typically have a medium to
high impact on an organization.
− Defer – A situation where a risk is neither accepted nor mitigated based on the organization’s
desire to gather additional information and perform additional analysis.
Deferred risks are monitored and re-evaluated at some point in the future. Risks that
are deferred are generally not an imminent threat to the organization nor would they
significantly impact the organization if realized.
• Residual risk – Residual risk is the risk that remains when a mitigation approach has
been developed and implemented for the range of risks that affect an information asset.
Residual risk that remains must be acceptable to the organization.
GENERAL NOTES
In Step 8, you consider which risks you need to mitigate and how. This is done by prioritizing
risks, deciding on an approach to mitigate important risk based on a number of organizational factors,
and developing a mitigation strategy that considers the value of the asset and the places
where it lives.
The decision to accept a risk, mitigate it, or defer it is based on a number of important factors.
Impact value is a primary driver, but so is probability. If a risk could seriously or significantly
impact the organization but is highly unlikely to occur, you may not want to mitigate it. Unfortunately,
there is no decisive path to follow for deciding which risks to mitigate. Often, this is a decision
that is driven by the individuals involved in the risk assessment and their knowledge of the
organization.
Once the decision is made to mitigate a risk, you must develop an effective and efficient mitigation
strategy. Deciding how to mitigate a risk is a complex endeavor and may require discussion
with other skilled personnel in your organization. The fact that the owner of an information asset
and the custodian of the asset are two different people means that both must collaborate on the
best strategy for providing overall protection.
58 | CMU/SEI-2007-TR-012