Managing Information Security Risks: The OCTAVESM Approach

4.5. Select Participants

Since the OCTAVE Method is an organizationwide evaluation, it requires people from throughout the organization to participate in it. The core analysis team members lead all activities during the evaluation; other members of the organization are required to participate in selected activities. The analysis team selects people from multiple organizational levels to participate in processes 1 to 3, and the team can augment its skills, experience, and expertise for specific activities in processes 4 to 8 by including additional participants if necessary.

Evaluation Participants

Table 4-2 provides a summary of the participants for each process required by the OCTAVE Method, as well as estimates for their time. In most cases ...