Why most cybersecurity strategies stall
A strategy that a board will fund has to answer three questions in plain language: what is at risk, what are we going to do about it, and what will it cost. Many documents answer none of them. They open with a threat landscape copied from an industry report, list a dozen "pillars", and finish with a roadmap that no one can trace back to the business.
The fix is not better writing. It is a method in which every recommendation is derived from evidence, every score is anchored to a written descriptor, and every initiative carries its own cost and owner. When the board asks "why this first?", the answer is already in the model.
The five phases
A defensible strategy moves through five phases, each producing artefacts that the next phase consumes.
1. Context
Start with the business, not with security. Collect the business strategy, the services the organisation runs and plans to run, the regulatory and contractual obligations that apply, and the expectations of the people who will approve and live with the strategy. Interview stakeholders with a structured guide so that the answers can be compared. Finish the phase with an agreed scope: which entities, services, geographies and third parties are in, and which are out.
2. Assessment
Measure where the organisation is today. Use a single control framework as the spine — ISO/IEC 27001 Annex A or the NIST Cybersecurity Framework are common choices — so that every finding has a fixed place to land. Assess maturity at two levels: the organisational view (policy, people, process) by domain, and the technical view by capability. Add a risk assessment that ties the gaps to the business services they threaten. The output is a baseline that can be re-measured next year using the same descriptors.
3. Analysis
Turn the baseline into gaps. Compare current maturity with the target the business needs, benchmark against peers where reliable data exists, and be honest about the limits of that comparison. Group the gaps into themes, and rate each gap for risk reduction, regulatory pressure and dependency. This is where the strategy becomes a prioritised argument rather than a wish list.
4. Formulation
Write the strategy itself: a short vision, a handful of strategic objectives, and the initiatives that close the priority gaps. Each initiative needs a charter — scope, outcome, owner, dependencies, indicative cost and the KPIs that will show it worked. Keep the objectives few. A board can hold five objectives in its head; it cannot hold fifteen.
5. Roadmap
Sequence the initiatives using a reproducible prioritisation model so that anyone can re-run it and get the same order. Split the roadmap into horizons — quick wins, short term and long term — and cost each year. If parts of the work will be bought in, write the scopes of work now; it is the fastest way to turn an approved strategy into delivery.
What makes it defensible
Four habits separate a strategy that survives scrutiny from one that does not:
- Nothing is asserted that can be calculated. Priority scores, costs and coverage figures come from the model, not from opinion.
- Every score is anchored to a written descriptor. "Level 3" means the same thing to every assessor and every year.
- Every claim carries its provenance. Each finding points back to an interview, a document or a test.
- The numbering is the argument. Objectives, gaps, initiatives and KPIs are numbered so that the chain from evidence to recommendation can be followed line by line.
Common mistakes to avoid
- Starting with tools rather than with business services.
- Assessing against three frameworks at once without a single spine to reconcile them.
- Treating the roadmap as a Gantt chart rather than a funding argument.
- Filing the strategy after approval instead of maintaining the model and re-measuring each year.
Turning the method into a deliverable
If you run strategy engagements regularly — as an in-house security leader or as a consultancy — the time sink is not the thinking but the scaffolding: interview guides, scoring descriptors, prioritisation models, charters and quality checks. Building those once and reusing them is what makes each engagement faster and more consistent.