| name | ciso-security-strategy-board |
| description | 3-year cyber security strategy aligned to NIST CSF 2.0 and business risk. Outputs risk register, control roadmap, investment ask, metrics, and board narrative. |
| argument-hint | ["threat landscape","current controls","regulatory obligations","risk appetite"] |
| allowed-tools | Read, Write |
| audience | CISO |
Board-Ready Security Strategy
A decision-grade playbook for the CISO and executive peers. Use it to move from ambiguous business context to a clear, defensible narrative that a board, exec committee, or investment committee can act on within one working session.
The goal is not a long document — it is a short, sharp, source-cited artefact that survives challenge from a CFO, a CRO, a regulator, and a sceptical non-executive director in the same room.
When to invoke
- Preparing a board or exec-committee paper where the recommendation must land in ≤ 5 minutes of reading.
- Framing a major bet (platform, AI, M&A, transformation) where capital, org change, and risk trade off against each other.
- Responding to an activist question ("Why are we spending £X on this?") with a numerate, honest answer.
- Aligning C-suite peers before a decision is escalated — pre-wire the room, not surprise it.
- Refreshing a strategy that has drifted from current market, technology, or regulatory reality.
Inputs to gather
Ask for these before drafting. If any are missing, state the assumption explicitly in the output — never fabricate a number.
- Business context — strategy on a page, top 3 enterprise OKRs, current financial trajectory.
- Scope — which business units, geographies, product lines, customer segments are in and out.
- Constraints — capital envelope, headcount cap, regulatory obligations, board-imposed guardrails.
- Time horizon — decision window, delivery horizon, first value milestone.
- Stakeholders — decision-maker, approvers, informed parties, known dissenters.
- Prior art — previous attempts, why they succeeded or failed, sunk-cost baggage.
- Success signals — the 3-5 metrics the board will actually track quarterly.
Procedure
- Frame the decision. Write the one-sentence question the paper answers. If the question is fuzzy, stop and sharpen it with the sponsor.
- State the recommendation up front. Executive readers decide in the first paragraph; the rest is evidence.
- Anchor to enterprise value. Tie the recommendation to revenue, cost, risk, or strategic optionality — never to activity metrics.
- Show the alternatives you rejected. Two or three, with the reason each lost. This is the single strongest credibility signal.
- Quantify honestly. Point estimate, range, and the two assumptions that drive it. Use sensitivity, not false precision.
- Surface the risks. Top 5 risks with probability, impact, owner, and mitigation. Include the one risk you cannot mitigate.
- Sequence the plan. 30 / 90 / 180 / 365-day milestones with named owner and exit criteria per stage.
- Define the kill switch. The conditions under which the programme is stopped, not just slowed.
- Pre-wire dissent. List the two objections you expect and the pre-agreed response.
- Close with the ask. Money, people, decisions, and dates — explicit, not implied.
Output format
1. One-page executive summary
- Question: The decision this paper answers.
- Recommendation: One sentence, active voice.
- Why now: The market, technology, or regulatory trigger.
- Value: Range with base / low / high case.
- Ask: Capital, headcount, decisions, dates.
2. Strategic context (½ page)
Where the enterprise is today, where it needs to be, and the gap this decision closes. Reference the enterprise strategy explicitly.
3. Options considered
| Option | Description | Value | Cost | Risk | Verdict |
|---|
| A | Status quo | £ | £ | Medium | Rejected — insufficient pace |
| B | Recommended | £ | £ | Medium | Selected |
| C | Alternative | £ | £ | High | Rejected — execution risk |
4. Financial case
- NPV, IRR, payback, TCO over the horizon.
- Sensitivity on the two assumptions that move the answer most.
- Cash profile by year, capex vs. opex split.
5. Delivery plan
- Waves with entry and exit criteria.
- Owner per wave, RACI at the exec level.
- Dependencies on other programmes, vendors, or hires.
6. Risk & governance
- Top 5 risks with probability × impact heat and owner.
- Governance cadence — who meets, how often, what they decide.
- Reporting metrics and cadence to board.
7. Change & communications
- Impact on org, roles, and ways of working.
- Comms plan for employees, customers, regulators, investors.
8. Appendix
- Assumptions log with source and confidence.
- Benchmarks and comparable programmes.
- Detailed models and working papers.
Anti-patterns to avoid
| Anti-pattern | Why it fails | Replace with |
|---|
| Activity metrics dressed as value | Board sees through it in minutes | Revenue, cost, risk, optionality |
| Single-point ROI with 3-decimal precision | Signals false confidence | Range with sensitivity |
| Hiding the risk that killed prior attempts | Erodes trust when discovered | Name it, own it, mitigate it |
| One-option paper | Reads as advocacy, not analysis | Show the alternatives you rejected |
| Endless appendix, thin summary | Executives read the summary only | 1-page summary carries the paper |
| Passive language ("it is recommended…") | Nobody owns the outcome | Active voice, named accountable exec |
| Boiling-the-ocean scope | Guarantees dilution and delay | Explicit in-scope / out-of-scope list |
| Missing kill-switch | Programmes zombie-walk for years | Pre-agreed exit criteria at each stage |
| No pre-wire with dissenters | Ambush in the room | Meet the sceptics 1:1 before the paper |
| Vendor slideware embedded verbatim | Reads as procurement, not strategy | Independent, source-cited analysis |
Rules
- State the recommendation in the first sentence — never bury the lede.
- Anchor every claim to enterprise value, not activity.
- Show at least two rejected options with reasons.
- Quantify with ranges and sensitivity, never false precision.
- Name the accountable executive on every commitment.
- Include a kill switch with objective exit criteria.
- Pre-wire the two expected objections and the response.
- Cite every external benchmark with source and date.
- Keep the executive summary to one page — always.
- If an input is missing, state the assumption; never fabricate.
Worked example — condensed
Context. A £2B financial services group with a fragmented data estate, six analytical platforms, and rising regulatory demand under DORA and Consumer Duty. The CISO has been asked to bring a decision to the December board.
Question. Should we consolidate to a single lakehouse platform over 24 months, or continue federated with tighter governance?
Recommendation. Consolidate to a single lakehouse under a federated governance model, sequenced in three waves, with a hard kill-switch at Wave 1 exit if unit economics miss target by more than 15%.
Value. Base case £42m NPV over 5 years (range £28m–£61m). Primary drivers: 38% reduction in duplicative platform cost, 22% faster regulatory reporting cycle, and unlock of cross-domain AI use-cases valued at £11m.
Ask. £14m capex over 24 months, 42 FTE peak (28 internal, 14 partner), board decision by 15 December, first value milestone 30 June.
Kill switch. If Wave 1 (foundational domains) does not deliver the target 20% reporting-cycle improvement and £3m run-cost reduction by month 9, the programme is paused and re-scoped before Wave 2 capital is released.
Top risks. Talent scarcity in platform engineering (mitigation: partner-led ramp with knowledge-transfer gates); data-quality debt in legacy domains (mitigation: remediation budget ring-fenced per domain); change-fatigue in analytics community (mitigation: change network with named champions per BU).
Governance. Monthly steering chaired by the CISO, quarterly board update, independent assurance review at each wave exit.
Extension prompts
- "Draft the board slide version of this recommendation in exactly 6 slides."
- "Generate the sensitivity table for the top three financial assumptions."
- "Write the response to the objection that we should defer this by 12 months."
- "Produce the 90-day mobilisation plan with named workstream leads."
- "Draft the kill-switch criteria as an assurance checklist."
Companion skills
- executive-briefs — for the shorter decision-memo format.
- cto-technology-strategy — when the decision is architecture-led.
- cio-digital-transformation-roadmap — for enterprise-wide programmes.
- cfo-technology-investment-case — for the deep financial appendix.
- cxo-ai-governance-council — when the decision touches AI risk.
