Managing Information Security Risks: The OCTAVESM Approach

10.5. Create Risk Mitigation Plans

This activity marks a transition from the strategic view of risk to a more tactical, or operational, view. Rather than identifying long-term initiatives that result in organizational security improvement, you develop risk mitigation plans that directly reduce risks to your organization's critical assets. The focus shifts from the organization to critical assets.

Risk Mitigation Plans

Risk mitigation plans are intended to reduce the risks to critical assets. These plans tend to incorporate actions, or countermeasures, designed to overcome the threats to the assets. In some cases these mitigation actions can be directed toward reducing the impact on the organization, but most often you reduce the risk to a critical ...