Security Strategy & Business Alignment¶
What you'll be able to do in this chapter
- Explain what a security strategy is, and how it differs from a list of controls or tools.
- Derive security objectives from business objectives using the alignment chain.
- State a risk appetite as a strategic decision and use it to set priorities.
The programme that bought everything and protected nothing¶
Picture a different CISO at a different company. In their first quarter they do what looks like serious work: they buy a well-reviewed set of security tools, adopt a respected control framework, and start working through its hundred+ controls. It feels productive. Then, at the budget review, a director asks: What benefit is the business getting from this spending, and how would we know if it was working? There is no answer, because the programme was never tied to anything the business is trying to achieve.
This is the most expensive mistake in security management. A security programme is not an end in itself. It exists to protect what the organisation is trying to do. Your first real act as Scaldimet's CISO is not to buy or build anything. It is to write down what security is for here.
Deriving the security strategy from the business¶
A security strategy is a short statement of where security is going and why, derived from the business. It answers three questions in order: what is the organisation trying to achieve, what would stop it, and what must security therefore do? Notice that security comes last in that chain. Security strategy should therefore be derived from the business objectives and constraints.
The alignment chain runs like this:
| Step | Question | Scaldimet |
|---|---|---|
| Business objectives | What is the organisation trying to achieve? | Deliver in-specification parts on time; renew the major OEM contract; protect its reputation for reliability. |
| What must be protected | What does achieving that depend on? | Continuous production; the confidentiality of customer design data; the ability to prove compliance. |
| Principal risks | What could stop it? | A halt to the French line; leaked engineering drawings; failing the customer's ISO 27001 and NIS2 conditions. |
| Security objectives | What must security therefore do? | Keep production running safely; Prevent a cyber-related halt of production; protect customer IP; reach demonstrable compliance in time. |
Read top to bottom, every security objective traces back to a business objective. Read bottom to top, you can defend every priority to the board in their own language. This structure also makes the priorities easier to defend when resources are challenged, because the answer to "what does this buy the business?" is written into its first line.
Security as an enabler¶
A strategy aligned to the business also changes how security is seen. Scaldimet's compliance work is not a cost imposed by head office; it is part of what lets the company keep winning the contracts that pay the wages. Security does not, on its own, renew a contract or ship a part (it would be arrogant to claim it does). What it does is enable those things: it protects the line that ships the parts, it provides the assurance a major customer now demands, it keeps the door to renewal open. When security is presented as a cost, budget arguments become harder. Linking it to contracts, uptime and customer assurance gives the investment a clearer business case. Part of the CISO's strategic job is to keep making that translation, from technical activity to business consequence, the same "so what, to the business?" discipline the board applies from the other side (Module 6).
Appetite is a strategic decision¶
The four links above describe the situation and derive what security must do. They do not, by themselves, say how much risk Scaldimet will accept in getting there. It is the fifth line of the written strategy, and it is of a different kind: leadership decides it rather than deducing it.
The strategy is also where risk appetite first becomes concrete. Recall from Lesson 1.3 that appetite is how much risk the organisation will accept in pursuit of its objectives, and that setting it is a governance decision. At strategy level, appetite turns vague ambition into a usable boundary. "We value reliability" is an aspiration. "We will not accept any foreseeable risk of a multi-day production stoppage, and we will not accept risks that could breach delivery commitments to a major customer" is a strategic appetite: it tells everyone, in advance, which risks must be treated and which can be lived with. Appetite set at the top is what lets priorities be decided consistently all the way down.
Why this matters for Scaldimet
Scaldimet has never had a security strategy, so later decisions in this Module and the next two have no agreed strategic reference point. Five lines on a single page (business objectives, what we protect, principal risks, security objectives, appetite) would give the whole programme something to be checked against. You will draft those five lines yourself in the Application below, then compare against a worked version.
Application: draft Scaldimet's one-page strategy¶
On paper, write Scaldimet's one-page strategy as five lines: first the four links of the chain (business objectives, what you protect, principal risks, security objectives), then the appetite. Draft it before opening the model answer below, then compare the two.
Two tests for what you wrote. First, traceability: can you draw a line from each security objective back to a business objective? If one cannot be traced, it is probably activity for its own sake, and a candidate to cut. Second, the budget question: imagine a director asking "what does this buy the business?" of each priority. If the strategy answers it in a sentence, it is aligned. If it does not, it is a shopping list that only looks like a strategy.
Model answer: Scaldimet's one-page strategy (open after you've drafted yours)
A reasonable version, fitting on a single page:
- Business objectives: deliver in-specification parts on time, renew the major OEM contract, protect the reputation for reliability.
- What we protect: production continuity, customer design confidentiality, and the ability to demonstrate compliance.
- Principal risks: a production stoppage from a compromise of the French OT; loss of customer IP; failure to meet the contractual ISO 27001 and NIS2 conditions in time.
- Security objectives: prevent a cyber-related halt of production, protect customer IP, and reach demonstrable compliance to the customer's deadline.
- Appetite: no foreseeable risk of a multi-day production stoppage; no risk to major-customer delivery commitments; limited tolerance for short, contained outages of non-production IT.
Yours don't need to match word for word. It passes if every security objective traces to a business objective, and if each priority answers the budget question in a sentence.
Key takeaway
A security strategy is derived from the business, not chosen from a catalogue. The alignment chain runs business objectives, then what must be protected, then principal risks, then security objectives: four links, each derived from the one above. The written strategy then adds a fifth line of a different kind: the risk appetite, which leadership decides rather than derives, turning ambition into a usable boundary so priorities can be set consistently. Every security objective should trace back up to a business one, and framed this way security is an enabler (it helps keep the contract, it protects the line) rather than a tax. Scaldimet's whole programme begins with five lines on one page.