How Do We Build a Cybersecurity Strategy That Actually Supports the Business?

A cybersecurity strategy should not be a list of security projects, tools, frameworks or compliance deadlines.

It should explain how cybersecurity will help the organization manage meaningful risk, protect what matters, support business objectives and adapt as the company changes.

A technically sophisticated strategy can still fail if it is disconnected from how the business operates, what leadership is trying to accomplish, what risks matter most and what resources the organization can realistically sustain.

Hotman Group helps organizations build cybersecurity strategies that connect business objectives, cyber risk, governance, technology, compliance, resources and execution.

The objective is not a document describing everything cybersecurity could do. It is a practical strategy for what the organization should do, why it matters, what comes first and how the work will actually happen.

What Is a Cybersecurity Strategy?

A cybersecurity strategy defines how the organization intends to manage cybersecurity risk in support of its business objectives.

It should establish direction across areas such as:

• Cybersecurity risk.
• Governance and accountability.
• Security capabilities.
• Cyber GRC.
• Technology.
• People and resources.
• Third-party risk.
• Compliance and customer requirements.
• Incident preparedness and resilience.
• Investment priorities.
• Measurement and reporting.

The strategy should create enough clarity that leadership understands where cybersecurity is going and the people responsible for executing it understand what needs to happen next.

Why Should Cybersecurity Strategy Start With the Business?

Because cybersecurity exists to protect and enable an organization.

The organization may be trying to:

• Grow into new markets.
• Win larger customers.
• Enter regulated markets.
• Launch new products.
• Adopt artificial intelligence.
• Move more technology to the cloud.
• Complete an acquisition.
• Prepare for a transaction.
• Improve operational resilience.
• Meet new contractual requirements.
• Reduce risk without creating unnecessary friction.

Cybersecurity strategy should understand those objectives and determine what security capabilities, governance and risk decisions are needed to support them.

Otherwise, security priorities can become disconnected from what the organization actually needs to accomplish.

What Happens When Cybersecurity Strategy Is Not Connected to the Business?

The organization may invest significant time and money without reducing the risks that matter most.

Common symptoms include:

• Security projects are prioritized primarily because a tool vendor recommends them.
• The next audit determines the entire cybersecurity agenda.
• Security teams cannot explain the business value of major investments.
• Leadership receives technical metrics without understanding risk.
• New business initiatives repeatedly surprise cybersecurity.
• Security requirements are introduced too late and slow down projects.
• Important risks remain unresolved while lower-value work receives attention.
• The cybersecurity roadmap contains more work than the organization can realistically perform.

A strategy should help cybersecurity make deliberate tradeoffs rather than simply accumulate more work.

Should Cybersecurity Strategy Be Based on a Framework?

A framework can provide useful structure, but it should not replace strategy.

Frameworks such as the NIST Cybersecurity Framework can help organize security capabilities and identify areas for improvement.

But the organization still needs to determine:

• Which risks matter most.
• Which capabilities need the greatest attention.
• What the business is trying to accomplish.
• What requirements apply.
• What resources are available.
• What level of maturity is appropriate.

The strategy should use frameworks as tools rather than treating framework completion as the business objective.

Should Compliance Drive Cybersecurity Strategy?

Compliance should influence the strategy, but it should not define the entire strategy.

Regulatory, contractual and customer requirements may create mandatory work and important business dependencies.

Those obligations matter.

But an organization can satisfy a framework and still have cyber risks outside its scope.

See why passing a cybersecurity audit does not automatically mean the organization is secure.

The strategy should bring risk, compliance and business needs together rather than forcing one to substitute for the others.

How Should Cyber Risk Shape the Strategy?

Cyber risk should help determine where the organization focuses attention and resources.

The strategy should understand:

• What could materially affect the business.
• Which systems, data and operations are most important.
• Where significant control weaknesses exist.
• What threats and dependencies matter.
• What residual risk leadership is willing to accept.

This allows investments and initiatives to be prioritized according to meaningful exposure rather than whichever issue is easiest to measure.

See what a cybersecurity risk assessment should actually tell leadership.

What Should Leadership Decide During Cybersecurity Strategy Development?

Leadership should help establish the context within which cybersecurity decisions are made.

That may include:

• Business priorities.
• Risk tolerance.
• Critical operations and assets.
• Important customer and market commitments.
• Investment constraints.
• Organizational responsibilities.
• Major strategic changes.

Leadership does not need to design security controls.

It does need to help define what the organization is protecting, what risks matter and what tradeoffs are acceptable.

How Do We Turn Cybersecurity Risk Into Strategic Priorities?

Group individual problems into meaningful capability and risk themes.

For example, dozens of findings involving identity, privileged access and employee terminations may point to a broader identity-governance priority.

Repeated evidence and audit problems may indicate a Cyber GRC operating-model priority.

Several third-party issues may indicate the need for a stronger third-party risk program.

The strategy should address root causes and capabilities rather than simply copying every open finding onto the roadmap.

What Should Be in a Cybersecurity Strategy?

A practical cybersecurity strategy may include:

• Business and organizational context.
• Cybersecurity risk priorities.
• Strategic cybersecurity objectives.
• Governance and accountability.
• Current-state capability observations.
• Target-state capabilities.
• Major initiatives.
• Resource implications.
• Technology implications.
• Compliance and customer requirements.
• Dependencies.
• Roadmap and sequencing.
• Measures of progress.
• Executive governance and reporting.

The exact structure should fit the organization rather than a generic strategy template.

How Many Cybersecurity Priorities Should We Have?

Enough to address what matters, but few enough that the organization can actually execute them.

A strategy containing dozens of simultaneous priorities is usually a backlog rather than a strategy.

Strategic prioritization means deciding what should happen first, what can wait and what the organization will intentionally not pursue right now.

How Do We Build a Realistic Cybersecurity Roadmap?

The roadmap should account for:

• Risk.
• Business deadlines.
• Regulatory and contractual commitments.
• Dependencies among initiatives.
• Available people.
• Budget.
• Technology constraints.
• Change capacity across the business.

Initiatives should be sequenced so foundational work happens before projects that depend on it.

For example, clarifying governance and control ownership may need to occur before automating large portions of Cyber GRC.

Should the Cybersecurity Roadmap Include Every Open Finding?

No.

Findings need to be managed, but the strategic roadmap should generally operate at a higher level.

Individual findings may roll into initiatives that address broader root causes or capability improvements.

The remediation process should retain the detailed accountability necessary to resolve each issue.

See who can help remediate cybersecurity findings.

How Do Compliance Requirements Fit Into the Roadmap?

Mandatory requirements and business commitments need to be represented explicitly.

A customer deadline, regulatory requirement or certification date may affect sequencing even when another risk appears more significant from a purely technical perspective.

The roadmap should make those tradeoffs visible.

If the number of requirements itself has become difficult to manage, see where to start when there are too many cybersecurity and compliance requirements.

What If We Have Multiple Cybersecurity Frameworks?

Do not build a separate strategy for every framework.

Frameworks should connect to one underlying cybersecurity program where appropriate.

The organization can identify shared controls, capabilities and evidence while preserving genuinely unique requirements.

See how to build one cybersecurity program across multiple frameworks.

How Does the Cyber GRC Operating Model Fit Into Cybersecurity Strategy?

The strategy defines direction.

The operating model defines how the organization will govern and execute the work.

A strong strategy can fail if ownership, decision rights, controls, risk processes and information flows are unclear.

See how to build a Cyber GRC operating model that actually works.

How Should Cybersecurity Governance Support the Strategy?

Governance should make it possible to make decisions, assign accountability and adjust priorities as conditions change.

The organization should understand:

• Who is accountable for the cybersecurity program.
• Who owns material cyber risks.
• Who approves major priorities.
• How resource decisions are made.
• How significant issues are escalated.
• How progress is reviewed.

The strategy should have an operating governance structure behind it rather than depending on annual planning alone.

Who Should Own Cybersecurity Strategy?

A cybersecurity leader may coordinate and develop the strategy, but leadership participation is important because the strategy involves business priorities, risk and resources.

The CISO, vCISO or other cybersecurity leader may be accountable for cybersecurity direction while executives and business leaders participate in the decisions affecting their areas.

Organizations without appropriate internal leadership may need to evaluate whether they need a vCISO, vGRC, Cyber GRC consultant or full-time hire.

How Should Cyber Risk Ownership Support the Strategy?

Material risks need accountable owners who can make or escalate business decisions.

Cybersecurity can recommend controls and treatment, but it should not become the owner of every risk simply because the issue is cyber-related.

See who should own cyber risk in an organization.

How Do We Connect Cybersecurity Strategy to Technology Strategy?

Cybersecurity and technology strategy should inform each other.

Business technology decisions can create or change cyber risk.

Examples include:

• Cloud transformation.
• Identity modernization.
• Artificial intelligence.
• New enterprise platforms.
• Operational technology.
• Application modernization.
• Data architecture.
• Remote work.

Cybersecurity should be involved early enough to influence those decisions rather than only assessing them after implementation.

Should Cybersecurity Strategy Include GRC Technology?

When GRC technology is relevant to the strategic objectives, yes.

But the strategy should define the problem before prescribing the platform.

The organization may need better evidence management, multi-framework control mapping, risk visibility, third-party workflows or reporting.

Those needs can inform whether technology is appropriate.

See whether the organization actually needs a GRC platform and how to choose the right GRC platform.

How Should Artificial Intelligence Fit Into Cybersecurity Strategy?

AI should be treated as both an opportunity and a source of changing risk.

The strategy may need to consider:

• How the organization is adopting AI.
• What data AI systems can access.
• Third-party AI services.
• Security and privacy implications.
• AI-enabled cybersecurity capabilities.
• Governance and acceptable use.
• Human oversight.
• Emerging regulatory and customer expectations.

AI should not automatically become a separate compliance program disconnected from existing governance and risk processes.

See how to govern AI without creating another compliance silo.

How Does Third-Party Risk Fit Into Cybersecurity Strategy?

Organizations increasingly depend on vendors, cloud providers, SaaS platforms, service providers and other third parties.

The strategy should consider whether those dependencies represent material cybersecurity risk and whether the current third-party risk program is proportionate to that exposure.

See how to build a third-party risk management program that actually works.

How Do Customer Security Requirements Fit Into Strategy?

Customer requirements can materially affect revenue, sales cycles and market access.

Cybersecurity strategy should therefore understand recurring customer expectations rather than treating every questionnaire and contract request as an isolated event.

See why customer security questionnaires become so painful and how to fix the underlying problem and what to do when a customer introduces a new cybersecurity requirement.

How Should Cybersecurity Strategy Address Resources?

The strategy must reflect the organization's actual ability to execute.

That includes:

• Internal leadership.
• Cybersecurity staff.
• Cyber GRC capacity.
• Technical expertise.
• Business control owners.
• External providers.
• Technology.
• Budget.

A strategy that assumes resources the organization does not have is not actionable.

What If Our Cybersecurity Team Is Already Overwhelmed?

The strategy should not simply add more initiatives to an unsustainable workload.

First determine whether the problem is capacity, inefficient processes, duplicate compliance work, unclear ownership or a combination of them.

See what cybersecurity and GRC work should be outsourced when the team is overwhelmed.

Should We Hire More People as Part of the Strategy?

Possibly.

But the resource model should follow the work that needs to be performed.

The organization may need permanent internal roles, fractional leadership, specialist consulting support, outsourced Cyber GRC operations or some combination.

See how to decide between a vCISO, vGRC, Cyber GRC consultant or full-time hire.

How Do We Measure Whether the Cybersecurity Strategy Is Working?

Measure progress toward risk and capability outcomes rather than simply counting completed projects.

Useful measures may include:

• Changes in material residual risk.
• Improved control effectiveness.
• Completion of major remediation.
• Improved resilience.
• Improved cybersecurity governance.
• Reduced duplicate compliance effort.
• Improved audit readiness.
• Better leadership risk visibility.
• Reduced key-person dependency.
• Progress on strategic capability goals.

The measures should show whether the organization is becoming better able to manage cybersecurity risk.

How Often Should Cybersecurity Strategy Be Updated?

The strategy should be reviewed regularly and when material changes occur.

Potential triggers include:

• Major business growth.
• Acquisitions or divestitures.
• Leadership changes.
• New markets.
• Major technology transformation.
• Significant incidents.
• New regulations or contractual requirements.
• Changes in material cyber risk.
• Major shifts in the threat environment.

A cybersecurity strategy should provide direction without becoming so static that it no longer reflects the organization.

What If Our Company Has Outgrown Its Existing Cybersecurity Strategy?

Then the strategy needs to evolve.

A program designed for a smaller, simpler organization may no longer support the company's current risk, technology, customer or compliance environment.

See what to do when a company has outgrown its cybersecurity program.

What If Our Cybersecurity Strategy Is Really Just a List of Projects?

Step back and reconnect the projects to objectives and risk.

For each major initiative, ask:

• What business objective does this support?
• What risk does this reduce?
• Why is it a priority now?
• What outcome should change?
• What dependencies exist?
• How will we know it worked?

Projects are how strategy gets executed. They are not the strategy itself.

What If Our Strategy Is Mostly Driven by the Next Audit?

That may indicate that compliance has become the de facto cybersecurity prioritization process.

Required audits and certifications need to be planned for, but the organization should also consider risks and business objectives outside those assessments.

A successful audit should support broader cybersecurity rather than replace the strategy.

How Should Cybersecurity Strategy Be Communicated to the Board?

The board should understand the strategic direction, material risks, significant investments and how management intends to improve the organization's cybersecurity posture.

It generally does not need the complete project backlog.

See how to explain cyber risk to executives and the board.

How Does Hotman Group Help Build Cybersecurity Strategy?

Hotman Group helps organizations build cybersecurity strategies around the business, risk environment and actual operating constraints.

HG can help evaluate current cybersecurity capabilities, identify material risks, understand compliance and customer requirements, define strategic objectives, prioritize initiatives, establish governance, develop roadmaps, determine resource needs and connect strategy to Cyber GRC operations.

Hotman Group can also help implement the resulting strategy through governance, risk management, framework implementation, remediation, GRC technology, vCISO, vGRC and ongoing program support.

The objective is not a strategy presentation that looks complete.

The objective is a cybersecurity direction the organization can execute and use to make better decisions.

What If We Know We Need a Cybersecurity Strategy but Do Not Know What the Real Priorities Are?

You do not need to arrive with the priorities already defined.

The first step may be understanding business objectives, cybersecurity risk, current capabilities, requirements, resources and what is already not working.

If the organization cannot yet tell whether the need is strategy, governance, risk, technology, remediation or a broader program redesign, see how to approach cybersecurity and GRC problems when you do not know what kind of help you need.

About Hotman Group

Hotman Group is a cybersecurity and Cyber GRC professional services firm that helps organizations solve complex cybersecurity, risk, governance and compliance problems. Hotman Group designs, builds, implements, remediates, operates and matures cybersecurity and GRC programs.

Learn more about Hotman Group's approach to solving complex cybersecurity and Cyber GRC problems.