CYBER

What does a good
cyber strategy
look like?
A good cyber security strategy not only sets out an
organisation’s commitment to delivering effective
cyber security, but how it is going to deliver it.
However, whilst a security programme plan forms
part of the strategy, it is not the only component:
having a plan is not the same as having a strategy.
If the programme plan is your railway timetable, your
strategy tells where you’re trying to get to, and the direction
of travel you’ll take to get there. Most importantly, it tells
you “why”. A good cyber strategy makes a clear link from
business objectives through to a cyberplan, via a series of
logical, interconnected steps.
Defining any kind of strategy can be challenging for an
organisation, and cyber security is no different. It can be
particularly challenging for cyber security subject matter
experts to step away from the comforting detail of their
day job sufficiently to take the “big-enough-picture” view
required to form a strategy.
A strategy can take many different forms, however the
most successful strategies will often consist of some key
components. Firstly, it should set out its cyber security
vision. This should articulate the “end state” for cyber
security within the organisation, and flow naturally into a
series of strategic objectives which break the end vision
into more digestible milestones.
Security is often seen as a blocker in organisations, and
so the vision and objectives should focus as much on
communicating how security can be an enabler as on how
it enables better risk management.
With all of these potential sources of influence, how many
objectives should you have? There’s no “right” answer, but
we would probe into any strategy with more than five or
six. Are they high-level enough? Do they really prioritise the
things which are most important to your business?
A good objective might say “Cyber security risk will be a
business accountability, and we will engage with business
stakeholders to enable them to manage their risk…”.
This isn’t the place to define which standard you’ll use to
build your risk framework, or which person will help them to
use it!
Many organisations also struggle to make the bridge from
strategy to execution, so if you are struggling to distil down
to that number of strategic objectives, consider adding a
subordinate layer of enabling objectives which can be more
targeted and can help you make the leap from objectives to
a plan of action to deliver them.
In order to deliver your strategy effectively, whomever is
responsible for it needs to be appropriately empowered. In
our Global State of Information Security Survey 2016 we
found that 54% of respondents had a CISO in charge of their
security programme. One way to ensure that the CISO is
able to effectively discharge their responsibilities is to use a
CISO mandate and charter.
Defining these often means
The CISO mandate sets out the authority of the CISO with
respect taking to cyber inputs security and from delivering four the key strategy. The
Charter itself will ensure the accountability of the CISO, and
sources of influence:
give the board and other leaders the ability to hold the CISO
to account for delivering the strategy. Many organisations
also
Business
tackle this
strategy:
by setting
analyse
themselves
the business’
objectives
strategic
around
how
objectives
the security
and
function
understand
will integrate
how cyber
with
security
its business
can
stakeholders
enable them,
(which
and
naturally
what support
leads on
business
to the question
leaders
of
target
will
operating
need to deliver.
model, which will be the focus of a future
article in this blog).
Business risk: look both at the current risk appetite,
Ultimately, and at a how cyber strategy security is likely strategy to modify needs to the be risk tailored map, to
suit the and organisation ask what that in will question mean – for whilst cyber there risk. is no “one
size fits all” or silver bullet approach, there are certainly
some
External
key steps
forces:
that all
what
organisations
are the disruptive
can take
forces
to ensure
that acting their strategy on the business is as effective from as outside, possible. what does
that mean for cyber security, and more importantly
Formulate how can your cyber cyber security security enable vision the and business objectives to based
on your react overarching to those forces. information risk appetite and business
goals. This way not only will your information risks be
addressed Regulation: in a coordinated what are the manner, “must do’s” it will in be your done in a way
which business, engages and the how rest is of that the business likely to evolve? and helps achieve
the wider business strategy.
34
34