Building a cybersecurity strategy

Most organisations have some form of security plan. Fewer have a strategy, meaning a document that says what will be deprioritised. A plan listing everything that would be good to do is a wish list, and it gives no guidance the day the budget covers half of it. That difference is what this chapter is about.

It opens with the purpose of a strategy, which is to make prioritisation possible when resources do not stretch to everything. Then follow the seven components, the backbone of the chapter, describing what a complete document has to cover, from target picture and risk appetite to measurement and ownership. One section shows how the ten requirement areas of the Cybersecurity Act can be used as a structuring framework, which has the practical advantage that the strategy then speaks the same language as the supervision and that follow up becomes comparable over time. Zero Trust is treated as a shift from network boundaries to continuous verification, as a principle rather than a product. After that comes the process from current state to roadmap in eight steps, the most practical part and the one that turns the strategy into something you can actually work from. The closing sections deal with the strategy as a living document with a set revision cadence, with the most common mistakes, and with a worked example strategy for a mid sized municipality. The current state the strategy builds on comes out of chapter 14 on risk and gap analysis, and leadership responsibility is covered in chapter 8.

The question has become more concrete since the Cybersecurity Act entered into force. In a review it is not enough to describe ambitions. What is asked for is how the organisation prioritised, on what basis and who took the decision. A strategy without traceable choices does not answer that, however well it is written. The practical consequence is that the strategy has to be written so it can be followed up, not merely read.

This page shows what the chapter covers and why a strategy has to contain choices that deprioritise. The seven components, the eight step process and the example strategy are in chapter 9 of the book.