Managing Information Security Risks: The OCTAVESM Approach

13.6. Other Considerations

Finally, we present a few additional issues that organizations are addressing when they implement OCTAVE.

Floating Analysis Team, Local Expertise

Section 13.3 illustrated issues related to implementing OCTAVE in a large, dispersed company. Recall that each medium and large site was required to create an analysis team to lead the evaluation. An alternative approach is to create and maintain independent, “floating” analysis teams, which could travel from site to site to lead the evaluations. The analysis team for a site would include the independent team members and a couple of local staff members. Local analysis team members could be given just-in-time training, and the independent team members could lead the evaluation ...