Information security strategy
- Term
- Information security strategy
- Exam
- CISM
- Definition
The long-term plan to move security from its current to its desired state in support of business goals.
- Explained
The strategy defines the desired state of security, assesses the current state and plans initiatives to close the gap, all traced to business objectives and risk appetite. It is approved by senior management and reviewed as the business changes.
- In practice
A three-year plan linking zero trust and supplier assurance initiatives to business growth targets.
- Often confused with
- Security policy
- Exam angle
Starts from business objectives and risk appetite.
- Related