Managing Information Security Risks: The OCTAVESM Approach

11.2. Before the Workshop: Prepare to Meet with Senior Management

You need to prepare thoroughly for your meeting with senior managers. This task is more difficult than it appears. Since most senior managers have a limited amount of time to spend on efforts such as this, you need to be able to set the context for the managers and get input from them in a span of an hour or two. You must help them understand which assets are critical to the organization, why they are critical, and how they are at risk. You also need to help managers understand what the organization is currently doing well to protect its critical assets and where its protection measures are missing or inadequate. Finally, you need to present solutions that you developed to improve ...