Build an Information Security Strategy
Create value by aligning your strategy to business goals and business risks.
- Many security leaders struggle to decide how to best to prioritize their scarce information security resources
- The need to move from a reactive approach to security towards a strategic planning approach is clear. The path to getting there is less so.
Our Advice
Critical Insight
The most successful information security strategies are:
- Holistic – They consider the full spectrum of information security, including people, processes, and technology.
- Risk aware – They understand that security decisions should be made based on the security risks facing their organization, not just on “best practice.”
- Business aligned – They demonstrate an understanding of the goals and strategies of the organization and how the security program can support the business.
Impact and Result
- Info-Tech has developed a highly effective approach to building an information security strategy, an approach that has been successfully tested and refined for more than seven years with hundreds of different organizations:
- This approach includes tools for:
- Ensuring alignment with business objectives.
- Assessing organizational risk and stakeholder expectations.
- Enabling a comprehensive current state assessment.
- Prioritizing initiatives and building out a security roadmap.
Build an Information Security Strategy
Start here – read the Executive Brief
Read our concise Executive Brief to find out why you should build an information security strategy, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.
1. Assess security requirements
Define the business and security goals of your security program and determine the organization’s security pressure risk overview.
2. Build a gap initiative strategy
Use our best-of-breed security framework to perform a gap analysis between current and target states, and define security goals and duties.
3. Prioritize initiatives and build roadmap
Synthesize the gap analysis into a list of actionable security initiatives, and prioritize these based on cost, effort, security benefit, and alignment with business demands.
4. Execute and maintain
Learn to use Info-Tech’s methodology to manage security projects on the go and identify resources that will help execute the strategy successfully.
Member Testimonials
After each Info-Tech experience, we ask our members to quantify the real-time savings, monetary impact, and project improvements our research helped them achieve. See our top member experiences for this blueprint and what our clients have to say.
9.4/10
Overall Impact
$33,625
Average $ Saved
28
Average Days Saved
Client
Experience
Impact
$ Saved
Days Saved
Psac
Workshop
10/10
$25,000
5
Goodwill Industries of South Florida
Guided Implementation
10/10
$12,395
12
Center For Elders Independence
Guided Implementation
9/10
$61,979
38
Forsyth Technical Community College
Guided Implementation
9/10
$12,395
20
Northwinds Technology Solutions
Guided Implementation
9/10
$6,197
20
College of New Caledonia
Guided Implementation
9/10
$50,000
29
Municipality of Chatham-Kent
Guided Implementation
8/10
$10,000
20
SIS Holdings Group
Guided Implementation
9/10
$12,395
20
LSU Health Sciences Center
Guided Implementation
10/10
$3,718
20
STgenetics
Guided Implementation
10/10
$123K
60
Spark Therapeutics, Inc.
Workshop
10/10
$12,063
20
Parkland College
Workshop
10/10
$30,989
20
Capital Credit Union
Guided Implementation
9/10
$30,989
20
Interdigital Communications
Guided Implementation
10/10
$25,411
5
Albaugh, LLC
Guided Implementation
9/10
$61,979
20
NEPC, LLC
Guided Implementation
8/10
N/A
N/A
Tennessee Supreme Court/Administrative Office of the Courts
Guided Implementation
10/10
$50,000
50
City Of Salem
Workshop
10/10
$30,989
65
Cross Insurance
Workshop
10/10
$100K
20
Digital Armour Corporation
Guided Implementation
10/10
$8,444
4
Victoriaville & co.
Guided Implementation
10/10
N/A
5
Town of Taber
Guided Implementation
10/10
$25,000
20
Ecore International
Guided Implementation
10/10
$49,583
10
City of Birmingham
Workshop
10/10
$117K
100
Massey University
Workshop
9/10
$61,979
20
Barry-Wehmiller
Workshop
10/10
$34,088
20
Scott County Iowa
Guided Implementation
10/10
$117K
50
College of the Ozarks
Guided Implementation
10/10
$25,000
32
California Department of Human Resources
Guided Implementation
10/10
$12,395
120
Elementis Specialties
Guided Implementation
10/10
N/A
10
Security Strategy
Tailor best practices to effectively manage information security.
This course makes up part of the Security & Risk Certificate.
- Course Modules: 5
- Estimated Completion Time: 2-2.5 hours
- Featured Analysts:
- Kevin Peuhkurinen, Research Director, Security & Risk
- Gord Harrison, Senior Vice President, Research
Onsite Workshop: Build an Information Security Strategy
Onsite workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost onsite delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.
Module 1: Assess Security Requirements
The Purpose
Understand business and IT strategy and plans.
Key Benefits Achieved
Defined security obligations, scope, and boundaries.
Activities
Outputs
Define business and compliance.
- Security obligations statement
Establish security program scope.
- Security scope and boundaries statement
Analyze the organization’s risk and stakeholder pressures.
- Defined risk tolerance level
Identify the organizational risk tolerance level.
- Risk assessment and pressure analysis
Module 2: Perform a Gap Analysis
The Purpose
Define the information security target state.
Key Benefits Achieved
Set goals and Initiatives for the security strategy in line with the business objectives.
Activities
Outputs
Assess current security capabilities.
- Information security target state
Identify security gaps.
- Security current state assessment
Build initiatives to bridge the gaps.
- Initiatives to address gaps
Module 3: Complete the Gap Analysis
The Purpose
Continue assessing current security capabilities.
Key Benefits Achieved
Identification of security gaps and initiatives to bridge them according to the business goals.
Activities
Outputs
Identify security gaps.
- Completed security current state assessment
Build initiatives to bridge the maturity gaps.
- Task list to address gaps
Identify initiative list and task list.
- Initiative list to address gaps
Define criteria to be used to prioritize initiatives.
- Prioritize criteria
Module 4: Develop the Roadmap
The Purpose
Create a plan for your security strategy going forward.
Key Benefits Achieved
Set path forward to achieving the target state for the business through goal cascade and gap initiatives.
Activities
Outputs
Conduct cost/benefit analysis on initiatives.
- Information security roadmap
Prioritize gap initiatives based on cost and alignment with business.
- Draft communication deck
Build an effort list.
Determine state times and accountability.
Finalize security roadmap and action plan.
Create communication plan.
Module 5: Communicate and Implement
The Purpose
Finalize deliverables.
Key Benefits Achieved
Consolidate documentation into a finalized deliverable that can be used to present to executives and decision makers to achieve buy-in for the project.
Activities
Outputs
Support communication efforts.
- Security strategy roadmap documentation
Identify resources in support of priority initiatives.
- Detailed cost and effort estimates
- Mapping of Info-Tech resources against individual initiatives