Security strategy · Insight
A security strategy should fit on one page.
The detail belongs in the appendix. The strategy is the handful of choices a board can remember, question and fund.
In brief
If leaders cannot repeat the strategy after one reading, they cannot hold anyone to it.
Security strategies tend to grow. Each review adds a threat, a framework, a capability gap and another workstream. The document gets longer, the roadmap gets wider and the board gets a slide with forty initiatives in four colours. Everything is there. Nothing is chosen.
A strategy is useful in proportion to how clearly it says what comes first and what does not happen. That is easier to test on one page than on fifty.
The five lines
- What we protect. The few business services and information assets whose loss would do the most harm, named in the business's language.
- What we fund first. Three to five priorities, each linked to the exposure it reduces and the service it protects.
- What we will not do. The initiatives deliberately deferred, and the risk of deferring them, accepted by a named owner.
- Who owns it. An accountable executive for each priority, not only the security leader.
- How we will know. The evidence of progress at each decision gate, and the conditions that would change the plan.
Why the third line matters most
Every strategy lists what it will do. Very few say what it will not. Yet that line is where the real trade-offs live: the tool that is not renewed, the project that waits a year, the risk that is held rather than reduced. Writing it down forces the conversation with the people who own the consequence, and protects the security team from carrying an unspoken backlog.
The rest still matters
One page does not mean less analysis. Behind it sit the current and target state, the ranking, the investment case and the roadmap. The page is the test that the analysis has produced a decision, and the tool leaders use to keep that decision in view.
Questions for your next leadership meeting
- Could each member of the executive team name our top three security priorities?
- What have we decided not to fund this year, and who accepted that risk?
- What evidence would tell us, a year from now, that the strategy worked?