Security work that starts with the business

Many organisations have policy documents in place but lack a shared picture of the risks that actually affect the business. The result is that measures are taken where they are easiest to implement, not where they do the most good.

Useful security work starts with the organisation's objectives and dependencies. Which processes must keep running? Which people, premises, systems and suppliers are critical? Only then does it become meaningful to discuss protective measures.

Once the risk picture is concrete, prioritisation becomes easier. Management can weigh cost against effect and make decisions that can be followed up over time.