Managing Information Security Risks: The OCTAVESM Approach

10.6. Create Action List

In the previous two activities you developed a protection strategy for organizational improvement and risk mitigation plans to reduce the risks to your critical assets. In this activity you look for near-term actions that people in your organization can immediately start to implement. By employing a few simple actions, your organization can start to improve in a few areas. By taking these initial steps toward improvement, your organization can start to build the momentum needed to implement its protection strategy and risk mitigation plans.

Action List

An action list defines any action items that people in your organization can take in the near term without the need for specialized training, policy changes, etc. Because ...