Security strategy, roadmap and budget

A strategy is a choice about what not to do. With limited people and money, the job is to put them where they reduce the most risk for the business, and to explain why.

risk registerNIST CSF profiles (current and target)OKRsroadmap toolsbusiness casesmaturity assessments

Start from the business

Security exists to let the business take risks safely, so a strategy begins with the company's goals, its (the assets whose loss would hurt most), its obligations and its . A fintech, a hospital and a media company defend different things. Understand how the company makes money, what would stop it, and who the plausible adversaries are.

From assessment to roadmap

Assess the current state against a framework: where are we strong, where are the gaps?
Define the target state for the next one to three years, based on risk, not on the maximum.
Prioritize the gap closure by risk reduction per effort and by dependencies; foundations (asset inventory, identity, logging, backups) usually come first.
Sequence into a roadmap with themes, owners, milestones and measures of success; leave room for the unexpected.
Say what you will not do, and which risks you accept for now, in writing.
Review quarterly; update when the business or the threats change.

roadmap-2027.mdmarkdown

## Theme 1: Know and control access (Q1-Q2)
Goal: phishing-resistant MFA for all staff and admins; privileged access just-in-time.
Measure: share of accounts on phishing-resistant MFA (target 95%).
Owner: head of IT security. Budget: identity platform upgrade.

## Theme 2: See and respond faster (Q2-Q4)
Goal: central logging for all critical systems; 24x7 detection with a managed partner.
Measure: mean time to contain high-severity incidents (target under 4 hours).

## Theme 3: Recover (Q3)
Goal: immutable backups; quarterly restore tests of tier-1 systems.

## Accepted for now (with owner and review date)
Legacy billing system without MFA, isolated network segment; review 2027-06.

Budget and the business case

Explain spending as risk reduction: which risk, by how much, at what cost, compared with the alternative (including insurance).
Distinguish run costs (people, licenses) from change costs (projects), and plan for the people to operate what you buy.
Buy fewer, better-integrated tools and use what you already own before adding more; unused tools are cost without protection.
Include people: hiring, training and retention are often the best use of money.
Show outcomes from previous spend; credibility compounds.

Leading the function

Build trusted relationships with engineering, legal, finance and the executive team before the crisis.
Make decisions visible and risk acceptance explicit and owned by the business.
Hire for a mix of skills and grow people; protect the team from burnout, since incidents are demanding.
Own the answer to "are we secure?" honestly: you cannot promise zero risk, but you can show a well-managed one.

Crown jewelsThe assets whose loss or compromise would hurt the organization most. Strategy starts by identifying and protecting them.see in glossary →Risk appetiteHow much risk the organization is willing to accept in pursuit of its goals. It frames which risks need treatment and which can be accepted.see in glossary →

connections on the map

Security metrics and reporting to leadershipinformsSecurity strategy, roadmap and budget
Security risk managementsets priorities forSecurity strategy, roadmap and budget
Security strategy, roadmap and budgetincludesCrisis communication and security culture

updated on 14/10/2026 · sources to go deeper · report an error

Study before

test what you learned

Loading questions…