Developing a Security Strategy and Roadmap

What a strategy is

A security strategy answers three questions:

1. Where do we need to be? The desired state, defined by what the business needs.
2. Where are we now? The current state.
3. How do we get there? The roadmap.

Without a strategy, security spending follows the latest incident, audit finding or vendor pitch instead of the business’s priorities. With one, the security manager can explain every investment and every “no”.

From current state to desired state

Defining the desired state

The desired state describes what security must look like for the business to meet its objectives, at a level of risk it accepts. It’s agreed with business leaders and often expressed using recognised frameworks:

• Control objectives from COBIT or ISO 27001
• Maturity targets, for example level 3 for access management and level 4 for incident response
• a NIST CSF target profile
• risk targets: key risks reduced to within appetite

The desired state isn’t “maximum security”. It’s the level the business needs and can afford.

Assessing the current state

• risk assessments
• maturity or capability assessments
• audit and regulatory findings
• the business impact analysis
• existing metrics and incident history

Gap analysis and roadmap

The gap between the two states becomes a list of things to change. The roadmap puts them in order, considering:

• risk reduction: the biggest risks first
• dependencies: an asset inventory before data classification, identity management before zero trust
• quick wins that build credibility
• cost and available resources

Constraints shape the route

Every strategy works within constraints: legal and regulatory requirements, budget, culture, available people and skills, existing technology, time, and the organisation’s capacity for change. A strategy that ignores them looks good on paper and fails in practice.

The roadmap

Example. A new CISO finds no asset inventory, MFA only for email and no incident plan. The roadmap starts with MFA for admins and remote access (a quick win), then inventory and identity management (foundations), then automation and metrics (maturity). The board approves a three-year budget tied to these phases.

A complete strategy document usually includes the business context, security objectives, the current and desired states, the gap analysis, the roadmap, resource and budget needs, risks, and the metrics that will show progress. It’s approved by senior management and reviewed at least yearly and whenever the business changes significantly.

How the exam asks about it

In short

• A security strategy is a plan to move from the current state to a desired state that supports business objectives.
• The desired state is defined with business input, often using frameworks or maturity targets (COBIT, CMMI, ISO 27001, NIST CSF).
• The current state comes from risk assessments, maturity assessments, audit findings, BIA results and metrics.
• Gap analysis shows what must change; the roadmap orders initiatives by risk, dependencies, cost and quick wins.
• Constraints (legal, budget, culture, skills, technology, time) shape the route and pace.
• The strategy is approved by senior management and reviewed regularly, and whenever the business changes.

Exam traps

• Don't start with solutions: define objectives and assess the current state first.
• A list of projects isn't a strategy unless it links to business objectives and a desired state.
• Ignoring culture or budget constraints gives a strategy that can't be delivered.
• The desired state isn't 'maximum security'; it's the level the business needs and can afford.

Slides

Click the slide and use the arrow keys. F toggles full screen.