| name | security-strategy |
| description | Build or assess a security program strategy and roadmap — current-vs-target maturity, gaps, prioritized initiatives aligned to business objectives and risk appetite, with outcomes, metrics, and budget framing. Use for security program planning, a strategy refresh, or a maturity assessment. |
Goal
A defensible security strategy: where the program is, where it needs to be (driven by
business risk, not fashion), and the prioritized, resourced roadmap to get there.
Steps
- Business context — objectives, regulatory drivers, crown-jewel assets, risk
appetite, and constraints. Strategy serves the business, not the other way around.
- Assess current maturity — against a recognized model (NIST CSF functions, or a
CMMI-style tier per capability). Be honest about what's real vs. aspirational.
- Define target state — the maturity warranted by the risk appetite and threat
landscape (
threat-modeling, threat intel) — not "max everything."
- Gap analysis — current vs. target per capability; quantify the risk each gap
leaves open (
cyber-risk-quantification).
- Prioritize initiatives — by risk reduction per unit cost/effort and business
alignment; sequence quick wins and foundational work.
- Roadmap — phased (e.g. now / next / later) with outcomes, owners, success
metrics, and budget framing for each initiative.
Output
A strategy document: business context · current vs. target maturity · gaps (with
risk) · prioritized initiative roadmap (phased, with outcomes/metrics/budget). Use
security-reporting; visualize the maturity and roadmap with security-diagramming.
Feed the headline into board-deck.
Notes
Anchor everything to business risk and appetite — a strategy that maximizes controls
regardless of risk burns budget and credibility. Prioritize by risk-reduction-per-
dollar, and make the roadmap outcome- and metric-driven so progress is measurable.
