Practice 02 · Security strategy
A strategy is a list of things you have chosen not to do.
Security strategy that starts from what the business must protect, enable and recover, then ranks every proposed investment by the exposure it removes. The result is a target state, an investment case and a roadmap your board can fund and your teams can deliver.
The problem
When everything is a priority, the budget decides the strategy.
Security plans are often built from findings, vendor roadmaps and the last incident. The result is a long list that grows every year, with no clear link to what the business needs, and no way to say what can safely wait.
The target state is a tool list.
Without a business-led view of what must be protected and recovered, products stand in for direction.
Business cases argue for spend, not for outcomes.
Leaders are asked to fund activity they cannot compare, so funding follows urgency.
The strategy has no owners.
Workstreams start without decision gates or accountable leaders, and the plan drifts within a year.
Our approach
From business outcome to funded roadmap.
Four steps, each ending in a decision leadership takes, not a document it receives.
Start from the business
Agree objectives, critical services, dependencies and the risk appetite that the strategy must serve.
See where you stand
Assess current capability against that need, using the evidence you already hold before asking for more.
Choose the few moves that matter
Rank options by the exposure they remove and what they cost, and make the trade-offs explicit.
Fund, own and sequence
Turn the ranked list into horizons, owners and decision gates, and test it with the people who must deliver it.
What you get
Six outputs. One direction everyone can follow.
Written for a board decision, and detailed enough for delivery teams to start.
Strategy on a page
The ambition, the priorities and what will not be done, in one view for executives.
Current and target state
A capability view of where you are, where you need to be and why, linked to business risk.
Ranked priorities
Each initiative scored by the exposure it removes, its dependencies and its cost, with assumptions shown.
Multi-year investment case
What to fund first, what can wait and the risk of waiting, in terms a finance committee can test.
Security operating model
How security is organised, resourced, sourced and measured to deliver the strategy.
Roadmap with decision gates
Horizons, workstreams, named owners and the points where leadership confirms or changes course.
Outcomes
What a clear strategy makes possible.
- Funding decisions you can explainEvery pound is linked to an exposure it reduces and a business outcome it protects.
- A shorter, sharper listLeaders agree what can wait, so teams stop splitting effort across everything at once.
- Security that enables changeNew services, cloud moves and acquisitions are assessed against one agreed direction.
- Progress the board can followDecision gates show what has been delivered and what the next horizon needs.
Engagement models
Match the depth to the decision.
Every engagement is scoped in a proposal before work begins. All ways to engage
Strategy review
An independent challenge of an existing strategy, roadmap or investment case, with clear recommendations.
Best when: a plan is about to go to the board, or a new leader needs a second view.
Security strategy and roadmap
The full set of outputs, built with your leadership and delivery teams.
Best when: you need a new direction, or the old one no longer fits the business.
Strategy into delivery
A virtual CISO or advisory role that carries the roadmap forward and reports progress at each gate.
Best when: the strategy needs a senior owner to see it through.
Questions
Security strategy, answered.
How is this different from a maturity assessment?
A maturity assessment measures where you are. A strategy decides where you need to be, what to do first and what to leave. An assessment can be an input; it is not the answer.
Will you recommend particular products?
No. The advice is technology-agnostic. Capabilities are defined first; where tools are needed, the criteria to choose them are set out, and existing investments are kept where they fit.
How long does a strategy take?
It depends on the scope: the number of business units, services and stakeholders, and how much evidence already exists. The timeline is agreed in the proposal, with a milestone for each step.
Can the strategy include the architecture?
Yes. Many organisations pair the strategy with an enterprise security architecture blueprint, so the target state is designed as well as described.