A Technical History of the SEI

People who work in small organizations liked the OCTAVE approach but needed a streamlined
method to accommodate their staff size, schedules, and budgets. In response, the SEI developed
OCTAVE-S [Alberts 2005]. 47 While remaining consistent with OCTAVE principles, OCTAVE-S
provides organizations of fewer than 100 people with an efficient, inexpensive approach to identifying
and managing information security risks. Both OCTAVE and OCTAVE-S are supported
with guidance, worksheets, and questionnaires. The SEI developed another alternative, OCTAVE
Allegro [Caralli 2007], in response to OCTAVE users
who were looking for a more information-centric
method that could be institutionalized at the operational
unit level. Allegro helps businesses identify their information
assets and determine how those assets are at risk
by putting them in the context of “containers”—places
where information is stored, transmitted, or processed.
While Allegro can be used in a collaborative workshop
style like the original OCTAVE methods, it is also well
suited for individuals who want to perform a risk assessment
without extensive organizational involvement or
expertise. Allegro developers reduced the amount of risk
analysis and IT knowledge needed, and simplified instructions
and worksheets.
The Consequence: Enterprise Risk
Management and Security Improvement
Organizations using the OCTAVE product suite have
control over their information security activities [Shantamurthy
2011]. Managers can develop a protection
strategy that is appropriate for their particular organizations’
mission and priorities, a strategy that addresses
policy, management, administrative, and technological
aspects, among others. As a result of SEI evaluations,
government and commercial organizations have a
The View from Others
Conducting a security risk analysis
has long been a requirement of the
HIPAA Security Rule and is also
necessary to achieve Stage 1 and
Stage 2 Meaningful Use regarding
the use of electronic health records
(“EHR") systems. OCTAVE
Allegro provides us with a useful
framework for assessing risks to
ePHI, including EHR’s, while at
the same time providing the evidentiary
requirements necessary
for regulatory compliance. Our
clients need something that is easy
to deploy, repeatable, underpinned
by good practice and OCTAVE
provides this.
– Greg Porter, Founder,
Principal Consultant,
Allegheny Digital
clearer view of their information security risk and control over their security posture. They manage
their risk through improvement efforts and periodic assessments, which they schedule and
perform at their own discretion. Many organizations establish a multidisciplinary team that can
perform the follow-up assessments and act as a focal point for the improvement efforts. Important
organizational and individuals’ information are protected. As a result, the organizations improve
not only their own risk profile but also that of the sectors to which they belong—thus contributing
to national security.
One example of information protection and security improvement is the use of the OCTAVE
method and OCTAVE Allegro by various agencies of the county government of Clark County,
Nevada. Clark County adopted the OCTAVE method as a way to comply with the federal HIPAA
47 The development of OCTAVE-S was sponsored by the SEI Technology Insertion, Demonstration,
and Evaluation (TIDE) program, created to help small manufacturing enterprises adopt state-of-thepractice
technologies.
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 189
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.