PECB ISO-IEC-27005-Risk-Manager Exam - Topic 4 Question 28 Discussion

OCTAVE-S (Operationally Critical Threat, Asset, and Vulnerability Evaluation for Small Organizations) is a risk assessment methodology tailored for small organizations. It provides a structured approach for identifying and managing information security risks. The OCTAVE-S method involves three main phases:

Building asset-based threat profiles, where critical assets and their associated threats are identified.

Identifying infrastructure vulnerabilities by assessing the organization's technological infrastructure for weaknesses that could be exploited by threats.

Developing security strategy and plans to address the identified risks and improve the overall security posture.

The OCTAVE-S method aligns with the description provided in the question, making it the correct answer. MEHARI and TRA are other risk assessment methods, but they do not specifically follow the three phases outlined above.