Managing Information Security Risks: The OCTAVESM Approach

4.2. Obtain Senior Management Sponsorship of OCTAVE

Senior management sponsorship is the top critical success factor for information security risk evaluations. Any successful evaluation requires the time of people in the organization, and senior managers need to participate in the OCTAVE Method. If they support the process, people in the organization tend to participate actively. If senior managers do not support the process, staff support for the evaluation will dissipate quickly. People will miss workshops, and the analysis team will not be able to persuade people to attend. If people know that senior management is committed to the evaluation process, the analysis team will have the authority and backing to persuade people to attend the workshops. ...