u Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE)—[197]
The SEI’s OCTAVE differs from MORDA in that it offers a qualitative
approach. OCTAVE inventories critical assets, threats to those assets,
vulnerabilities associated with those assets, and risk levels. The user is