The Three Step Security Strategy

This document explains how to create and communicate an organizational security strategy by: (1) assessing current context and maturity (a four-stage pyramid from prevent/detect to compare), (2) defining targets and timelines aligned with business goals, and (3) specifying high-level tactics (guiding principles rather than projects). It emphasizes measuring and optimizing controls, keeping strategy stable across multi-year cycles, and broadly communicating strategy statements to reduce operational noise and improve decision-making.