Cybersecurity Strategy: Embrace Fault Tolerance and Resilience

Cybersecurity leaders are often so occupied by tactical challenges that they don’t take the time to engage in effective strategic planning. That is a mistake. 

A concrete cybersecurity strategy sets out the medium- to long-term direction of the program. It outlines how the security organization will support and enable the corporate strategy and digital trajectory. It also helps the organization budget and document the rationale behind strategic decisions and resource allocation.

The building blocks of a cybersecurity strategy are similar to those of strategic planning processes. You must:

• Articulate the strategic vision and business drivers.

• Define the current state of cybersecurity in the organization, informed by maturity assessments, vulnerability assessments, risk assessments, audit findings and penetration tests.

• Provide a prioritized roadmap that clearly links projects and corrective actions to the gaps, risks or vulnerabilities identified in the assessments, and to the relevant business, technology and environmental drivers.

With a documented vision, current state and roadmap, cybersecurity leaders can more clearly communicate with business leaders. An enterprise security steering committee should also review, discuss and approve security policy in a collaborative manner before formally documenting, disseminating and communicating it across the organization.

One of the most important elements of a cybersecurity strategy is the vision, which explains the objectives of the cybersecurity program in terms that business executives can understand and support. The strategic vision articulates the desired state that the cybersecurity strategy aims to achieve during the planning period.

Most organizations will base their vision on international standards, such as the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) or ISO 27001.

But don’t stop at standard elements. Incorporate relevant business, technology and environmental drivers specific to your organization. Example drivers include:

Business drivers:

• Cost-cutting programs

• Product diversification

• Geographical expansion

• M&As or divestitures

Technology drivers:

• Digitalization strategy

• Data center consolidation

• Cloud adoption

Environmental drivers:

• Economic downturns and recessions or growth conditions

• Sociopolitical unrest

• Geopolitical tensions, including trade wars

• Impending regulatory changes

Include the specific cybersecurity objectives you want to achieve during the planning period as part of the vision. These objectives should include:

• An overall maturity level for the program, and target maturity levels for specific processes and functions

Once you have defined the vision for the cybersecurity strategy, you will want to identify the gaps between vision and reality.

Use different assessment types to capture the current state. Map the results against the vision statement as part of a gap analysis. Each gap represents a potential action or initiative you may pursue to achieve the vision.

Few organizations have the resources to narrow all the identified gaps in one planning period. Set priorities depending on the level of risk, the required resources and the time-to-value for each one. Include longer and shorter time-to-value projects within the planning period. These priorities, mapped based on the timelines required to execute on them, will populate a cybersecurity strategy roadmap.

With the vision and priorities established, cybersecurity leaders must now communicate the strategy to get buy-in from executive stakeholders.

That communication will typically include a written report and an executive presentation, which describe the current and desired states and how the priorities will help bridge the gaps between them. Focus the presentation on how the projects will contribute to the business value. Explicitly highlight how the cybersecurity strategy aligns with the business strategy.

Even after you gain approval for the strategy, it’s key to establish a quarterly cadence of reporting and communication on progress and challenges. Be clear about:

• Expected benefits that were fully or partially realized and those that were not realized