This content was originally presented to the DFW chapter of the Society for Information Management. The presentation evaluates the role of risk management and security in the strategic planning process that defines the direction and prioritization of resources used by an organization.
4. Opening Thoughts
When businesses do conduct
strategic planning, they often
overlook risk management and
security concerns that affect the
plan’s outcome.
5. Opening Thoughts
Risk and security considerations
often contribute to the way an
organization conducts its business.
8. Strategic Planning
Strategic planning is the process an
organization uses to define its direction
(strategy) and make decisions about how to
allocate resources to pursue this direction.
9. Strategic Planning
“Strategic planning produces fundamental
decisions and actions that shape and guide
what an organization is, who it serves, what
it does, and why it does it, with a focus on
the future.”
~Balanced Scorecard
10. Five Steps to a strategic plan
Where are
you?
What is
important?
What must
you achieve?
Who is
accountable?
Review and
measure
performance
13. Strategy, Risk, and Security
If strategy provides the context for
where we are going, risk and security
tell us how to get there.
Risk
• Big Picture
• Strategic
Security
• Tactics
• Operational
14. Strategy, Risk, and Security
Risk management provides a systematic
approach for identifying, understanding,
and controlling exposures.
Operational Financial Security Contractual Programmatic
15. Strategy, Risk, and Security
The ERM Perspective
• What risks exist?
• What impact will they cause?
• What can I do about it?
• How effective were my choices?
16. Strategy, Risk, and Security
Assessment Action
• Accept
• Change
• Transfer
Review
The Risk Management Cycle
17. Strategy, Risk, and Security
The Security Perspective
• What threats exist?
• What vulnerabilities exist?
• How do I manage them?
• What controls do I use?
• How many layers of defense?
18. Strategy, Risk, and Security
CSC 20
OWASP
10
NIST
RMF
ISO
27000
PCI
DSS
NERC FFIEC
The Security Perspective
The common focus is on applying controls
from a specific standard or requirement.
19. The Long View
How do you develop long-term strategic
planning for security?
20. The Long View
An organization’s culture and priorities make
a difference – especially when incorporating
security into the long-term strategy.
21. The Long View
The Board Executives
Security
Business
LeadersIT
Global Users
The root and
flow of info
is critical!
22. The Long View Strategic Plan
Goal
Objectives
strategies
Objectives
strategies
Goal
Objectives
Placement of
security in the
hierarchy affects
the outcome.
23. The Long View
Placement:
•Is security a strategic goal?
•Is security strategic objective?
•Is security a strategy activity
that supports an objective?
The lower something rests in
the hierarchy, the less important
it is.
25. *Real* Security
If security is a strategic goal, then
compliance is simply an activity in the
strategic planning hierarchy.
26. *Real* Security
Compliance is a significant business driver,
but compliance defines the bare minimum
that you must do to satisfy industry
requirements.
27. *Real* Security
*Real* security considers business drivers
beyond compliance and addresses these
drivers in the strategic plan.
