Identifying cyber security risks is only one part of managing them. Security teams also need to decide which risks matter most, determine how much risk the organization is willing to accept, allocate resources, and show executives whether risk treatments actually work.

 

OCTAVE FORTE takes this broader view. Developed by SEI, FORTE applies enterprise risk management principles to security risk and connects executives, managers, and practitioners. SEI designed it for organizations that are building an ERM program as well as those looking to strengthen an existing one.

 

Unlike an assessment methodology that primarily focuses on identifying security risks, FORTE addresses the broader governance lifecycle, including risk identification, analysis, response, monitoring, and improvement.

 

 

What is OCTAVE FORTE?

 

OCTAVE FORTE stands for Operationally Critical Threat, Asset, and Vulnerability Evaluation FOR The Enterprise. SEI introduced FORTE as the latest model in the OCTAVE suite in 2020. It builds on ideas from earlier OCTAVE approaches but shifts the emphasis toward enterprise risk management and executive decision-making.

 

FORTE helps an organization:

 

• Establish risk governance and risk appetite.
• Identify critical services and assets.
• Define resilience objectives.
• Understand existing controls and capabilities.
• Identify and analyze risks.
• Prioritize risks.
• Develop response plans.
• Monitor risk management performance.
• Improve the ERM program over time.

 

How OCTAVE FORTE differs from OCTAVE Allegro

 

If you’ve already used OCTAVE Allegro, the distinction is important.

 

OCTAVE Allegro focuses more directly on information assets and the risks associated with them. Its asset-focused approach makes it useful for conducting a structured information-security risk assessment.

 

OCTAVE FORTE takes that risk analysis into a broader enterprise context. It starts with governance and risk appetite, connects critical services and assets to organizational objectives, considers existing capabilities, and builds toward response planning and continuous improvement. 

 

SEI specifically describes FORTE as incorporating elements of Allegro while adding stronger connections to enterprise risk management.

 

	OCTAVE Allegro	OCTAVE FORTE
Focus	Information-security risk assessment	Enterprise risk management
Starting point	Information assets	Governance and risk appetite
Main emphasis	Asset-related threats and risks	Risk governance, analysis, response, and improvement
Audience	Security and risk practitioners	Executives, managers, and practitioners
Risk treatment	Identify appropriate mitigation	Connect risk response to enterprise objectives and capabilities
Best fit	Asset-focused risk assessment	Building or strengthening an ERM process

 

This distinction is useful when deciding which OCTAVE approach belongs in your program. You don’t need to use FORTE simply because it is newer; its value comes from the broader management context it adds.

 

How the OCTAVE FORTE process works

 

The process gives organizations a route from governance to continuous improvement. The following explains what each stage contributes to the overall risk-management process.

 

1. Establish risk governance and appetite

 

Define who makes risk decisions, how responsibilities are distributed, and how much risk the organization is willing to accept. Create a risk appetite statement that provides teams with a reference point for prioritizing and responding to risks.

 

This step matters because a security team shouldn’t decide risk priorities in isolation from the organization’s business objectives.

 

2. Scope critical services and assets

 

Identify the services the organization cannot afford to disrupt and the assets that support those services. For example, an online bank might identify payment processing as a critical service and map the applications, databases, infrastructure, suppliers, and other assets that support it.

 

3. Establish resilience objectives

 

Define what the organization needs those critical services to withstand or recover from. This gives the risk team a basis for evaluating whether existing capabilities provide enough protection and resilience.

 

4. Identify and assess existing capabilities

 

Review the controls and capabilities already in place. Don’t simply create another control inventory. Compare existing capabilities against the resilience objectives you established and identify gaps that leave critical services exposed.

 

5. Identify risks, threats, and vulnerabilities

 

Examine the critical services and assets and determine what could disrupt them. FORTE considers changes in areas such as technology, operating environments, market conditions, and attack tactics when identifying risks. The resulting findings begin to form the organization’s risk register.

 

6. Analyze risks against capabilities

 

Now compare identified risks with the organization’s current ability to manage them. Look at the available control data, likelihood, impact, vulnerabilities, compliance requirements, supply-chain exposure, and other relevant information.

 

Use the organization’s risk appetite to help prioritize the results. The output should be a risk register that puts the most important risks in an order the organization can act on.

 

7. Plan the response

 

For prioritized risks, define what the organization will do. A response might involve reducing the risk through additional controls, changing an operational process, transferring part of the risk, accepting it within the organization’s risk appetite, or avoiding the activity that creates the exposure. Assign an owner to each response and specify how you’ll track it.

 

8. Implement the response

 

Put the response plans into operation and monitor whether teams actually complete the actions.

 

This moves the process from risk identification to risk treatment.

 

9. Measure and monitor

 

Track whether your risk-management activities are producing the expected results. Useful measures can include risk exposure, response-plan implementation, control performance, and the actual impact of risks when they materialize.

 

FORTE emphasizes using these measurements to determine whether the ERM program needs adjustment.

 

10. Review, update, and repeat

 

Review the ERM program and update it as the organization’s objectives, assets, controls, and risk environment change. FORTE treats risk management as an iterative process rather than an annual assessment that ends when the report is complete.

 

 

Where FAIR fits into OCTAVE FORTE

 

This is one of the most useful aspects of FORTE if you’re building a broader risk-management program.

 

FORTE can use different techniques for risk analysis. SEI specifically discusses using FAIR with FORTE, particularly during the risk-analysis stage. FAIR risk assessment can add greater quantitative measurement capability when an organization needs to express risk in economic terms.

 

The two methodologies therefore can serve different purposes:

 

OCTAVE FORTE

 

• Establish governance and risk appetite.
• Identify critical services and assets.
• Identify and prioritize risks.
• Plan and monitor responses.

 

FAIR

 

• Analyze selected risk scenarios.
• Estimate loss event frequency.
• Estimate loss magnitude.
• Quantify potential loss.

 

You don’t need FAIR for every FORTE assessment. Use it when a quantitative analysis gives decision-makers information they need to compare risks or evaluate investments.

 

When should you use OCTAVE FORTE?

 

OCTAVE FORTE makes the most sense when your organization needs more than an isolated security risk assessment.

 

Consider it when you need to:

 

• Build an enterprise risk management process around cyber security and other organizational risks.
• Establish formal risk governance and risk appetite.
• Connect executive priorities with practitioner-level risk information.
• Prioritize risks across competing business objectives.
• Create structured risk response plans.
• Measure whether your risk-management activities work.
• Establish a repeatable process for reviewing and improving risk management.

 

SEI states that FORTE can support both organizations new to risk management and mature organizations seeking to strengthen an existing ERM program.

 

How CyberArrow supports risk management processes

 

CyberArrow can support the operational aspects of the risk-management process once you have established your FORTE methodology.

 

• Risk management: Centralize risks, assessments, owners, and treatment plans.
• Control mapping: Map controls across multiple frameworks and connect them to identified risks.
• Risk treatment: Assign remediation activities and track progress to completion.
• Evidence management: Associate evidence with controls and risk activities.
• Continuous monitoring: Track changes in risk and control performance.
• Dashboards and reporting: Give management teams a consolidated view of risk exposure and remediation status.

 

Turn OCTAVE FORTE risk analysis into an ongoing, measurable GRC process with CyberArrow.

 

 

FAQs