Certified: The CISM Prepcast

Welcome to The Bare Metal Cyber CISM Prepcast. This series helps you prepare for the exam with focused explanations and practical context.
An effective information security strategy establishes a long-term plan for identifying, managing, and mitigating organizational security risks. It’s not just a document—it’s a structured approach that guides decision-making and aligns cybersecurity initiatives with the business's broader objectives. A well-crafted strategy reflects the organization’s risk appetite and outlines how resources, controls, and policies will be used to protect assets while enabling business growth. By offering clear direction, a security strategy helps prioritize projects and investments based on what truly matters. It also serves as a communication tool, allowing leaders to explain security’s role in the business to stakeholders and decision-makers at every level.
Strategic planning in security begins with identifying the drivers behind the strategy. Internal drivers include business objectives, key operational processes, and growth plans. If the business is expanding into new markets, launching digital products, or outsourcing operations, each of these introduces new risks and dependencies. External drivers include evolving legal mandates, new or updated regulatory requirements, and changes in the threat landscape. Cybersecurity strategies are also influenced by what peers in the industry are doing, competitive pressures, and how well-prepared other organizations are to manage similar threats.
Executive risk tolerance is a powerful driver that shapes strategic decisions. If the board of directors is willing to accept certain operational risks to enable innovation, the security strategy must reflect that. At the same time, low risk tolerance may lead to more stringent controls and conservative design. Technology trends also have an influence—cloud adoption, AI integration, and digital transformation increase complexity and risk. Strategic planning must incorporate all these influences to build a strategy that is relevant, feasible, and business-aligned.
Setting strategic objectives is one of the most important phases of developing a security strategy. Objectives must be clearly defined, measurable, and tied directly to business needs. They should be written in language that reflects the organization's mission and not rely solely on technical terminology. Good strategic objectives contribute to both risk reduction and operational resilience. This means they should help the organization recover faster from incidents, maintain continuity, and operate with confidence under changing conditions.
When prioritizing initiatives, it is essential to consider both the impact of the initiative and how feasible it is to implement. High-impact, low-effort projects should move forward first. Low-impact, high-effort projects may be reconsidered or postponed. Once these priorities are clear, the strategic objectives help shape policies, controls, and overall program direction. They ensure that every part of the security effort is pointing in the same direction and that teams understand what success looks like.
No security strategy can succeed without input from across the organization. Stakeholders in IT, risk management, legal, human resources, and operations must be engaged early in the process. Each department brings unique insights about system dependencies, business processes, and regulatory pressures. Gathering this input helps identify blind spots and align security with practical realities. It also encourages buy-in from those who will be responsible for executing parts of the strategy.
Security professionals should also incorporate feedback from past audits, incident reviews, and risk assessments. These sources provide valuable lessons and highlight weaknesses in prior planning or execution. In many cases, interviews and cross-functional workshops are useful methods for collecting strategic input. These formats encourage dialogue and ensure that participants feel heard. Before drafting the strategy, teams must build alignment across departments and roles to create a shared vision.
Once input is collected, the next step is evaluating the current security state. This starts with a gap analysis—comparing the organization’s existing controls, processes, and capabilities against what is needed to manage its current and future risks. Maturity assessments using frameworks such as COBIT or ISO 27001 can help establish benchmarks. These tools evaluate how well governance, processes, and technologies are performing across defined levels of maturity.
A thorough evaluation should identify weaknesses not just in technical systems but in governance models, budget allocations, staffing, and training. These gaps may prevent the organization from reaching its target risk posture or meeting compliance obligations. Comparing the current state with desired outcomes reveals the areas where new investments or changes are needed. Capability shortfalls should be documented, and the strategy should clearly state what must be improved and why.
The next step is drafting the strategy itself. A complete security strategy document begins with a clear vision and mission that explain why the strategy exists and what it aims to achieve. Strategic principles—such as “risk-based decision-making” or “security by design”—can provide philosophical anchors. The document should outline initiatives, timelines, and who is responsible for delivery. Activities must align with legal and regulatory requirements and incorporate standards or best practices.
Metrics are also critical. The strategy must include performance indicators to track progress and demonstrate outcomes over time. These metrics may include reductions in risk exposure, improved audit performance, or increased user engagement in awareness programs. Language and formatting are also important. The document should be clear, concise, and accessible to both technical and non-technical audiences. Strategy is about direction, not technical depth—details should be left for supporting documents like implementation plans or technical standards.
A security strategy must also align with the broader governance frameworks of the organization. This ensures consistency across risk, compliance, and operational activities. For example, a strategy might map its goals to the objectives of an enterprise risk management framework. It should also tie directly to control objectives from standards like NIST or ISO. These connections help validate that the strategy is complete and aligned with accepted best practices.
Oversight and accountability structures should be clearly described. Who monitors progress? Who approves changes? Who ensures that activities are completed on time and within scope? Traceability is another essential feature—readers should be able to connect strategic goals to specific implementation plans and activities. This linkage allows for better measurement and ensures that execution aligns with vision.
No strategy is complete until it is endorsed by executive leadership. To gain support, the strategy must be presented in business language, not just technical terms. Leaders want to understand how the strategy supports enterprise goals, what return on investment it provides, and how it reduces exposure to legal or reputational risk. If resource requirements are significant, these must be justified. Budget, staffing, and tools must be aligned with the organization’s ability to support them.
Feedback from leadership is a necessary part of this process. It should be welcomed, discussed, and used to improve the final product. Incorporating this feedback ensures greater ownership and long-term support. Once the strategy is finalized, formal approval should be obtained through a documented process. This approval gives the strategy authority and enables teams to begin execution without delay or confusion.
Communicating the strategy effectively is just as important as creating it. Messages must be tailored for different audiences. Executives will want high-level summaries and business rationale, while technical teams need to understand their operational responsibilities. Use visuals such as charts, timelines, or heat maps to simplify complex points and increase retention. Communication is not a one-time event. It must be ongoing.
Everyone in the organization should understand how their role supports the strategic direction. Whether it’s a software engineer implementing controls or a manager reviewing reports, each role contributes to the strategy’s success. Show how the strategy connects to daily operations and decision-making. Set up communication channels to track progress and share updates. This may include newsletters, dashboards, or regular steering committee meetings.
A security strategy is not static—it must be reviewed and updated regularly. Set intervals for performance reviews, such as quarterly or biannually, to evaluate whether objectives are being met. Track changes in the business, such as mergers, product launches, or geographic expansion, that could affect security priorities. Monitor the external environment as well—new regulations, threat actor behavior, or industry trends may demand a new approach.
Use incident data and audit results to refine the strategy over time. Lessons learned from breaches, near-misses, or failed controls are invaluable for improving future plans. Strategic goals may evolve as the organization grows, enters new markets, or adopts emerging technologies. The goal is not perfection—it is continuous alignment with reality. A strong strategy remains dynamic, resilient, and forward-looking, ready to adapt as the landscape evolves.
Thanks for joining us for this episode of The Bare Metal Cyber CISM Prepcast. For more episodes, tools, and study support, visit us at Bare Metal Cyber dot com.