Lesson 1.11: A security strategy that follows the business
A security strategy isn't a list of projects the security team likes. It's the few objectives that let the business do what it plans (new markets, new products, new platforms) within its risk appetite, with key results that show progress. In the lab Northwind's business plans and top risks are on the table next to the security team's six proposed objectives. You check that every objective serves a business goal or a top risk, that every goal and risk is covered, drop what serves neither, and make sure each objective has a measurable key result.
20 min
You will learn to
- Tie security objectives to business goals and top risks
- Find orphan objectives and uncovered goals
- Write objectives and key results (OKRs) that can be measured
- Reuse KRIs from earlier work as key results
- Record the strategy decision
Key terms
- Security strategy
- A few objectives that let the business pursue its plans within risk appetite.
- OKR
- Objectives and key results: a qualitative objective with a few measurable results showing progress.
- Traceability
- Each objective links to a business goal or a top risk.
- Orphan objective
- An objective that supports no goal or risk.
← Monte Carlo: risk as a distribution, not a number · All lessons · What is Linux? →