Information Security Governance · Topic 2 of 2
Information Security Strategy, Frameworks and Planning
Building an information security strategy from business goals, gap analysis, frameworks such as COBIT and ISO/IEC 27001, budgets and the business case.
- 4 min
- Includes a diagram
- Strategy flows from business objectives and risk appetite.
- Desired state, current state, gap analysis, road map.
- Frameworks are tailored, not adopted blindly.
What it is
The information security strategy is the long-term plan that takes the organization from its current security state to the state it needs to support business objectives within its risk appetite. Governance frameworks and standards provide a proven structure for that work, and strategic planning turns the strategy into a road map with budgets, resources and business cases that management can approve.
How it works
Inputs to the strategy
- Business strategy and objectives: the primary driver.
- Risk appetite set by the board.
- Risk assessment results and the threat landscape.
- Legal, regulatory and contractual requirements.
- Current state of controls, often measured with a maturity model.
- Culture, resources and constraints such as budget, skills and technology.
Developing the strategy
- Understand business goals and get senior management involvement.
- Define the desired state: security objectives that support the business, expressed in business terms.
- Assess the current state.
- Perform a gap analysis.
- Build a road map of initiatives that close the gaps, prioritized by risk and business value.
- Obtain approval and sponsorship.
- Measure progress and revise as the business changes.
A strategy that is approved but has no sponsor, no budget or no metrics rarely gets implemented.
Constraints
Common constraints include legal requirements, culture, cost, available skills, time, existing technology and organizational structure. The manager plans around them rather than ignoring them.
Governance frameworks and standards
| Framework | Use |
|---|---|
| COBIT | Governance and management of enterprise information and technology |
| ISO/IEC 27001 and 27002 | Information security management system requirements and control guidance |
| NIST Cybersecurity Framework | Outcomes organized into functions; useful for profiling current and target states |
| Maturity models (for example CMMI-based) | Rate current and target capability levels |
| Balanced scorecard | Links security objectives to business perspectives |
Frameworks are adapted to the organization's needs; adopting one wholesale without tailoring wastes effort.
Strategic planning: budgets, resources and the business case
A business case for a security investment explains the business problem, the options, costs, benefits (including risk reduction in business terms), risks of not acting and how success will be measured. Senior management decides on funding; the security manager's job is to give them a sound basis for that decision.
Budgets cover people, tools, services and training, and should be planned over several years to match the road map. Early, visible wins help build credibility with executives who are sceptical of the program.
When a question asks how to get executive support or funding, the strongest answer frames security in business terms (risk to objectives, impact, cost of inaction), not technical metrics.
How the exam asks about this
- "What is the MOST important input to the security strategy?" Business objectives (with risk appetite).
- "What should come before building the road map?" Defining the desired state and assessing the current state, to find the gaps.
- "Executives are sceptical of the program." Present risk in business terms and deliver early visible improvements.
What to remember for the exam
- Strategy flows from business objectives and risk appetite.
- Desired state, current state, gap analysis, road map.
- Frameworks are tailored, not adopted blindly.
- A business case speaks in business terms and shows the cost of not acting.
- Senior management approves and funds; the manager proposes and measures.
A strategy built mainly from the latest vulnerability scan or a vendor's product road map becomes a list of technical fixes, not a plan that supports the business.
Common mistakes
Starting from technology instead of business goals.
Skipping the current-state assessment. Gaps cannot be measured without it.
Presenting technical metrics to the board.
Check yourself
What is the primary driver of an information security strategy?
The organization's business objectives, within its risk appetite.
What does a gap analysis compare?
The current state of security with the desired state.
What should a security business case express benefits in?
Business terms, such as reduced risk to objectives and avoided impact.
Topic 2 of 2 in Information Security Governance
Test yourself on Information Security Governance
The full ISACA CISM question bank has 1,044 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.