<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
---
name: performing-octave-risk-assessment
description: >-
  Conduct OCTAVE (Operationally Critical Threat, Asset, and Vulnerability Evaluation) risk assessments that align organizational risk management with information security through asset-driven threat and vulnerability analysis.
domain: cybersecurity
subdomain: threat-modeling
tags:
  - octave
  - risk-assessment
  - asset-driven
  - organizational-risk
  - sei
  - risk-management
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1190", "T1078", "T1530"]
---

# Performing OCTAVE Risk Assessment

## Overview

OCTAVE is a risk-based assessment methodology developed by Carnegie Mellon SEI that focuses on
organizational risk management through asset identification, threat profiling, and vulnerability
analysis. This technique covers OCTAVE Allegro's streamlined approach to risk assessment.

Mode: `[MODE: ARCHITECT]` — Organizational risk assessment and management.

## Prerequisites

- Organizational asset inventory and classification
- Understanding of business processes and critical operations
- Access to vulnerability scan results and threat intelligence
- Stakeholder availability for risk workshops
- Python 3.10+

## Key Concepts

### OCTAVE Allegro Process

| Step | Activity | Output |
|------|----------|--------|
| 1 | Establish Risk Measurement Criteria | Impact scoring framework |
| 2 | Develop Information Asset Profile | Critical asset inventory |
| 3 | Identify Information Asset Containers | Where assets live |
| 4 | Identify Areas of Concern | Threat scenarios |
| 5 | Identify Threat Scenarios | Detailed threat profiles |
| 6 | Identify Risks | Risk statements |
| 7 | Analyze Risks | Quantified risk scores |
| 8 | Select Mitigation Approach | Risk treatment decisions |

### Impact Areas

| Area | Description | Weight |
|------|-------------|--------|
| Reputation | Brand damage, trust loss | High |
| Financial | Direct costs, revenue loss | High |
| Productivity | Operational disruption | Medium |
| Safety | Physical safety implications | Critical |
| Legal/Regulatory | Fines, penalties, litigation | High |

### Risk Treatment Options

| Option | When to Use |
|--------|-------------|
| Mitigate | Risk above appetite, controls feasible |
| Transfer | Risk can be insured or outsourced |
| Accept | Risk within appetite, cost exceeds benefit |
| Avoid | Eliminate the activity creating risk |

## Workflow

### Step 1: Establish Risk Criteria

```bash
node scripts/agent.js --action criteria --output risk-criteria.json
```

### Step 2: Profile Critical Assets

```bash
node scripts/agent.js --action assets --input asset-inventory.json --output profiles.json
```

### Step 3: Identify and Analyze Risks

```bash
node scripts/agent.js --action analyze --input profiles.json --output risks.json
```

### Step 4: Generate Risk Treatment Plan

```bash
node scripts/agent.js --action treat --input risks.json --output treatment-plan.json
```

## Verification

- [ ] Risk measurement criteria established and approved by leadership
- [ ] Critical information assets identified and profiled
- [ ] Asset containers mapped (technical, physical, people)
- [ ] Threat scenarios developed for each critical asset
- [ ] Risks quantified using established impact criteria
- [ ] Risk treatment decisions documented with justification
- [ ] Treatment plan includes owners, timelines, and success metrics

## References

- [OCTAVE Allegro — SEI CMU](https://resources.sei.cmu.edu/library/asset-view.cfm?assetid=8419)
- [NIST SP 800-30 Risk Assessment](https://csrc.nist.gov/publications/detail/sp/800-30/rev-1/final)
- [ISO 27005 Risk Management](https://www.iso.org/standard/75281.html)
