A Technical History of the SEI

Continuous Risk Management training course. The guidebook and associated course enabled program
managers and risk managers to learn how to manage risks more effectively.
In 1997, the SEI began to broaden its software risk management approach to other software-related
areas including cybersecurity. When the Army wanted a risk management approach tailored
to acquisition programs, this work became the foundation for guidance in implementing the risk
management process area of the Software Acquisition CMM. The COTS Usage Risk Evaluation
(CURE) and the Architecture Tradeoff Analysis Method (ATAM), which focused on COTS products
and software system architecture, respectively, were variations on the original risk assessment
(SRE). Risk was incorporated into CMMI in 2000 as a practice area (RSKM) in CMMI
V1.02.
Risk management was also a focus in the ongoing research
into cybersecurity by the CERT Coordination
Center (CERT/CC). In 1997, the Information Security
Evaluation (ISE), a variation of the SRE, was used to
identify vulnerabilities in operational, networked information
technology systems. In 1998, CERT researchers
began developing a new approach for managing cybersecurity
risks within an organization based on the principles
of CRM and ISE. This research and the Defense
Health Information Assurance Program (DHIAP) 22 were
the driving forces for developing the Operationally Critical
Threat, Asset, and Vulnerability Evaluation
(OCTAVE) [Alberts 2003]. The goal was to develop a
self-directed risk assessment as part of the DoD effort to
comply with the data security requirements defined by
the Health Insurance Portability and Accountability Act
(HIPAA) of 1996. DHIAP transitioned OCTAVE to the
Air Force and Army in 2001, using the SEI OCTAVE
training. OCTAVE continues to be a widely used information
security risk assessment method.
The View from Others
I think the biggest contribution
was to bring awareness to the subject
[of software risk management],
help legitimize it as a program/project
management
concern, and gave a process for
operationalizing it in a useful way.
– Robert Charette, founder of
ITABHI Corporation and
Chairman of the SEI Risk
Program Advisory Board
A Navy Program Manager stated
in the late 1990s that all of his investment
in the SEI Risk Program
had paid off with the identification
and mitigation of a single catastrophic
risk.
By 2005, software acquisition and development programs
were becoming more distributed in nature, often comprising multiple geographically distributed
organizations. Traditional risk approaches did not readily scale to these networked, highly
complex program environments. In 2006, the SEI began research into managing risks in interactively
complex software-reliant systems. This led to new methods for assessing risk and success
factors in complex networked systems (e.g., Mission (Risk) Diagnostic [Alberts 2008, 2009,
2012]) and a focus on using key drivers of success to produce a systemic view of program risk
22 DHIAP was a small consortium of organizations, including the SEI and the Advanced Technology
Institute (ATI) of the South Carolina Research Authority (SCRA), overseen by a group from the Telemedicine
Advanced Technology Research Center (TATRC) from Fort Detrick, Maryland.
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 141
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.