Managing Information Security Risks: The OCTAVESM Approach

6.3. Select Critical Assets

This activity requires you to make decisions that shape the remainder of the evaluation—selecting your organization's critical assets. Depending upon the size of the organization, the number of information assets identified during processes 1 to 3 could easily exceed a hundred. To make the analysis manageable, you need to narrow the focus of the evaluation by selecting the few assets that are most critical to achieving the mission and meeting the business objectives of your organization. These are the only assets that you will analyze during later activities.

Step 1: Identify Critical Assets

Select your organization's five most critical assets. When you select critical assets, you are not bound to choose only five. ...