Managing Information Security Risks: The OCTAVESM Approach

6.1. Overview of Process 4

During process 4 you perform two vital functions. First, you consolidate the information that you documented during the first three processes, formatting the information for data analysis. Consolidating the information enables you to look for inconsistencies and gaps among individual perspectives. The analysis activities constitute the second vital function. You examine the individual perspectives and create a global picture of which assets are important to the organization and how those assets are being threatened.

Process 4 is important because this is where you set the scope for the rest of the evaluation. You use critical assets to focus the infrastructure evaluation in phase 2, and you use threat profiles as the ...