Topics in this domain
- Exam Technique: Thinking Like a Security Manager
- Security Governance vs Security Management
- Organisational Culture and Tone at the Top
- Ethics, Codes of Conduct and Accountability
- Integrating Security into Corporate Governance
- Legal, Regulatory and Contractual Requirements
- Due Diligence, Due Care and Legal Liability
- Privacy and Data Protection Governance
- Governance Roles, the CISO and Reporting Lines
- The Security Steering Committee
- The Three Lines Model and Independent Assurance
- Aligning Security Strategy with Business Objectives
- Developing a Security Strategy and Roadmap
- Gaining and Keeping Executive Commitment
- Governing AI and Emerging Technology
- Security Frameworks Compared: NIST CSF, ISO 27001 and COBIT
- Selecting and Implementing a Framework
- Governance Models: BMIS and the Security Balanced Scorecard
- Resource Planning and Security Budgets
- Building a Business Case for Security Investment
- Demonstrating Value and Return on Security Investment
Aligning Security Strategy with Business Objectives
Security exists to serve the business
A security program can be technically excellent and still fail. It fails if it protects the wrong things, slows down what the business most needs, or costs more than the risks it reduces. Strategic alignment means security decisions start from what the business is trying to achieve, and it’s the first of the six governance outcomes.
Example. A logistics firm’s security team spends its budget on a data-loss tool. But the board’s priority is keeping warehouses running, and ransomware on operational systems is the real threat. The program is busy, but not aligned.
Understand the organisation first
One of the CISM job tasks is to identify internal and external influences on the organisation that affect the security strategy. Before writing any strategy, the security manager needs to understand:
| Internal | External |
|---|---|
| Business strategy and objectives | Laws, regulations and contracts |
| Culture and risk appetite | The threat landscape |
| Organisational structure | Industry practice and competitors |
| Current security state and maturity | Customers’ and partners’ expectations |
| Budget, people and skills | Economic and geopolitical change |
| Technology and architecture | Emerging technology such as AI and cloud |
Trace every control to a goal
Aligned strategies form a chain: a business goal leads to a security objective, which leads to program initiatives, controls and metrics. Every control should trace back up the chain. If it can’t, ask why it exists. Every important business goal should trace down. If it can’t, there may be an unmanaged risk.
How to stay aligned
- Meet business leaders regularly; learn their plans, priorities and frustrations.
- Express security objectives in business terms: revenue protected, customers retained, regulations met.
- Use the security steering committee to set priorities together with the business.
- Take part in strategic planning, not only IT planning, so security hears about changes early.
- Review the strategy when the business changes direction: new markets, acquisitions, new products, major outsourcing.
Aligned security also enables the business: it can make it possible to enter regulated markets, win customers who demand certifications, or deliver digital services faster because security is built in.
Signs of misalignment
- Workarounds: business units bypass security to get things done.
- Tech-first reporting: reports describe tools and alert counts, not business risk.
- An unfunded program: leaders can’t see why security spending matters.
- Surprises: security learns about major business changes after they’ve happened.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Primary goal of information security governance | Strategic alignment with business objectives |
| First step in developing a security strategy | Understand the business strategy and objectives |
| Best indicator of alignment | Security initiatives trace to business goals, with business support |
| The business enters a new market | Reassess risk and update the strategy |
| Most important input to the security strategy | Business objectives (not threats or technology) |
In short
- Strategic alignment, security supporting business goals, is the primary outcome of information security governance.
- The first step in developing a security strategy is understanding the business strategy, objectives and culture.
- The strategy must account for internal influences (strategy, culture, appetite, resources) and external ones (laws, threats, industry, customers).
- Security objectives should be stated in business terms and trace down to initiatives, controls and metrics.
- Good security enables the business: new markets, customer trust, faster safe delivery.
- Alignment is continuous: when the business changes direction, the security strategy is reviewed.
Exam traps
- Starting a strategy with a technology choice or a threat list, before understanding business objectives, is wrong.
- A strategy that only aims for compliance isn't aligned; compliance is one input.
- Security that blocks the business without explaining risk leads to workarounds and loss of support.
- IT's priorities aren't the same as the business's priorities.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Understand the organisation first
Trace every control to a goal