Preview · selected sections of Cybersecurity Strategy v1.0
About this guide
This guide is part of the GreyHyphen Labs Practitioner Guides — three methods a consultant or an internal team can follow, step by step, to design how cybersecurity is set up in an organisation:
| Guide | The question it answers | What it produces |
|---|---|---|
| Cybersecurity Strategy | Where must security go, and what work gets it there? | An evidenced assessment, themes, goals and KPIs, and a costed, prioritised roadmap with initiative charters and scopes of work. |
| Cybersecurity Governance Model | Who decides, on what authority, and how does the governing body know it is working? | Requirements baseline, governance bodies and charter, delegation, RACI, interaction maps, procedures, communication plan and tiered measures. |
| Cybersecurity Operating Model | What does the function deliver, who performs it, how many people does it take and what does it cost? | Service catalogue, capability model, sourcing decisions, structure, sizing, skills, funding, transition plan and service cards. |
The three guides fit together. The strategy sets direction. The operating model organises the function to deliver it. The governance model directs, controls and holds that function to account. Each can be used on its own; used together, the outputs of one become the inputs of the next.
This is a method, not a template to fill in. It describes the sequence of work, the information each step needs, the arithmetic that must be reproducible and the traceability rules that hold everything together. Every organisation will use its own domain set, its own control framework and its own risk register; the sequence and the rules do not change.
How to read this guide. Each phase opens with a phase summary — the information to gather, who supplies it, how to complete the work and what it produces. Each artefact then states what to capture and gives a short how to complete it checklist. Section 9 is the quality review to run before anything is issued, section 10 the final document and the steering-committee pack, and Appendix A the full list of artefacts with a suggested format for each.
Sections and figures marked Example illustrate what a finished artefact looks like. Treat them as illustrations to adapt, not answers to copy.
1. Purpose and scope
A cybersecurity strategy answers four questions in order, and it is only credible if it answers them in that order:
- Where does the organisation stand today, measured against something other than opinion?
- How does that compare to comparable organisations and to recognised practice?
- Where does it need to get to, expressed so that progress is measurable?
- What work closes the gap, in what order, at what cost, and who is accountable?
Most strategies fail on the first and last of these. They open with an assessment whose scoring nobody can reconstruct, and they close with a roadmap whose sequencing is a matter of taste. This method removes both failure modes: every score is anchored to a written descriptor, and every priority is the output of a stated formula over stated inputs.
1.1 Scope
The method covers the full arc from context-gathering to a procurement-ready roadmap. It deliberately does not cover project delivery — once an initiative is approved and scoped, it passes to delivery governance and is tracked there. Nor does it cover control-level compliance assessment, which is a separate discipline that uses the same control framework; this method uses the framework for structure and maturity, not for control-by-control conformity testing.
Its outputs feed the two companion guides. The operating model takes the vision, themes, goals and any initiative that creates a standing service or capability. The governance model takes the themes, goals and strategic KPIs as the strategic tier of its performance measures and the agenda of the governing body.
1.2 Who does what
| Role | Responsibility in this method |
|---|---|
| Strategy owner typically the CISO |
Owns the vision, mission and themes. Approves the assessment scope and the final portfolio. Presents to the board. |
| Strategy lead the consultant or internal lead |
Runs the engagement, facilitates the workshops, maintains the registers and their cross-references, and assembles the document. |
| Assessor internal or external |
Runs the domain and capability assessments, records observations and evidence, and produces findings. |
| Risk function | Supplies the scored risk register and validates the risk-reduction claim behind each initiative. |
| Architecture function | Owns the capability model and validates the target maturity of each capability. |
| Business stakeholders | Supply the business strategy input and their own requirements of security. Confirm goal linkage. |
| Finance / procurement | Validate the rate assumptions, the buffer and the resulting estimates. Use the scopes of work. |
| Governing body | Approves the strategy, the budget envelope and the sequencing. Receives progress against the KPIs. |
3. The method at a glance
The work runs in five phases. Each phase produces artefacts the next phase uses; nothing later in the sequence can be completed honestly without what comes before it.
The phases are not strictly serial in practice — the threat landscape is usually gathered while the assessment is running, and stakeholder interviews often surface findings — but the dependencies are real. Themes cannot be set before the assessment produces findings. Initiatives cannot be prioritised before the risks are scored and the capability targets are agreed. A team that writes the themes first and then goes looking for evidence has produced a deck, not a strategy.
3.1 Working formats
Every artefact in this method can be produced with Word and PowerPoint. Anything with rows that will be cross-referenced is a Word table; anything that will be presented or needs to be seen as a whole is a PowerPoint slide. Where scoring, prioritisation and costing become large, a simple spreadsheet is a convenience, not a requirement.
| Kind of artefact | Suggested format | Tips |
|---|---|---|
| Registers (goals, requirements, drivers, threats, risks, initiatives) | Word table, one row per item | Give each row a simple sequence number so other tables can refer to it. |
| Assessment matrices (domain × component, capability tree) | Word table — or a spreadsheet if large | Keep the score, the descriptor chosen and the observation in adjacent columns. |
| Scoring and costing workings | Word table — or a spreadsheet | Show every factor and assumption in its own column so it can be challenged. |
| SWOT, ladder, roadmap, maturity trajectory | PowerPoint slide | Use the figures in this guide as the starting layout. |
| Initiative and KPI charters | Word, one page each, from a fixed template | One template for every charter so a reader who has read one can read all. |
| Scopes of work | Word document per initiative | Generated from the charter; do not retype what the charter already holds. |
| Final document | Word | Section order in section 10; workshop slides go in the appendix. |
That is the preview. The full publication continues with 11 more sections — every phase summary, checklist, figure, quality check and appendix — available under licence.
Buy the full method