Software Engineering Institute | Carnegie Mellon University
Software Engineering Institute | Carnegie Mellon University

Assessing Information Security Risk Using the OCTAVE Approach - eLearning

In this 11 module, online course participants learn to perform information security risk assessments using the Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) Allegro method.

The OCTAVE Allegro approach provides organizations a comprehensive methodology that focuses on information assets in their operational context. Risks are identified and analyzed based on where they originate, at the points where information is stored, transported, and processed. By focusing on operational risks to information assets, participants learn to view risk assessment in the context of the organization's strategic objectives and risk tolerances.

For organizations required to be compliant with PCI-DSS v2.0, OCTAVE Allegro satisfies the requirement for an annual risk assessment outlined in paragraph 12.1.2 of the standard.

Through 27 video lectures the course covers the OCTAVE-prescribed activities for risk identification, analysis, and response. After completing the course, attendees will be able to use OCTAVE Allegro to:

  • gather and organize risk information via interviews, documentation reviews, and technical analysis
  • create risk evaluation criteria to assess risk commensurate with the organization's risk appetite and tolerances
  • identify, analyze, and prioritize information security risks
  • improve vulnerability management activities by viewing them in a risk context
  • why managing operational risk is important to managing enterprise risk
  • develop risk response strategies appropriate for the organization's business requirements

This course is also offered as instructor-led training.

Who should attend?

  • Individuals who would like an in-depth understanding of the OCTAVE Allegro Risk Assessment Methodology
  • Security professionals, business continuity planners, compliance personnel, risk managers, and other professionals requiring the knowledge and skills to understand operational risk and perform risk assessments
  • Personnel needing to perform formal risk assessment to satisfy PCI-DSS requirements


  • introduction to OCTAVE Allegro as a structured, repeatable risk assessment method that can be used across the organization
  • the importance of risk evaluation criteria in the risk management process
  • a starting set of impact categories and guidance is provided to establish your organization's risk tolerances
  • profiling high-value information assets and understanding their role in service delivery
  • the role of threat and vulnerability identification in risk management
  • prioritization of risk response based on organizational impact

Assessing Information Security Risk Using the OCTAVE Approach online version will require a minimum of 5 hours of study time. The 11 module course contains 27 video lectures. Once registered, learners will be granted 24-hour-a-day access to the course material for 12 months.

Learners can proceed through the course at their convenience and can review and repeat individual sections as often as needed.


This course will help participants to

  • gain a foundational overview of the various elements of operational risk
  • understand the connection between information security, business continuity, IT operations and operational risk management
  • obtain a working knowledge of operational risk, threat, vulnerabilities, impact, services, and their related assets
  • understand the purpose of the OCTAVE Allegro structured risk management approach
  • understand what is required to prepare an organization for a risk assessment using OCTAVE Allegro
  • understand how to get started and when to tailor the process to meet unique organizational needs


To access CERT STEPfwd, your computer must have the following:

  • Web browsers - Internet Explorer 7+ or Firefox 3+
  • Adobe Flash version 10+
  • JRE Version 6+
  • Computer system and network settings that allow access to streaming video from internet sources
  • Minimum client resolution of 1280x1024 to enable proper Video and Lab Player display; Internet connection of 384 Kbps or greater (to sustain downloads with no more than 230ms of latency)


  • Recorded instruction presented by SEI instructors
  • 27 video training sessions with transcripts

This course is presented in the form of video-recorded training sessions that were presented by SEI instructors to a classroom of students representing a variety of industries.

Instructor demonstrations included with the course explore and reinforce the concepts taught and how they can be successfully applied.

Training courses provided by the SEI are not academic courses for academic credit toward a degree. Any certificates provided are evidence of the completion of the courses and are not official academic credentials.

Course Details

Course Fees [USD]

eLearning: $700

This self-paced course is available online via the SEI Learning Portal.


If you wish to purchase this course for a group of learners, please email or telephone at +1 412-268-7622 for group rate details.

For More Information

Phone: 412-268-7622