Information Security Strategy and Leadership
Domain 2 - Information Security Strategy and Leadership
This domain tests your ability to convert business direction into a funded, measurable security strategy and to lead change across executives, engineers, and third parties.
Core rules and concepts
- Start from business strategy: revenue models, regulatory exposure, digital initiatives, and risk appetite. A security strategy that lists tools without these links is a plan, not a strategy.
- Define a small set of strategic pillars, each with outcomes, owners, metrics, and a roadmap. Use maturity assessments (for example, NIST CSF tiers or C2M2) to baseline and show movement.
- Leadership means making trade-offs explicit: fund risk reduction where business impact is highest, retire low-value controls, and communicate in business terms (downtime, revenue, trust).
- Build an operating model: centralized versus federated roles, security champions, decision forums, and escalation paths. Culture and incentives determine whether policy becomes behavior.
Worked example
A retailer's strategy emphasizes e-commerce growth and same-day delivery. The CISO's assessment shows weak API security and third-party logistics visibility. The strategy proposes three pillars: secure digital channels, supplier risk transparency, and resilient fulfillment. Each has a sponsor, budget, 12-month milestone, and KPI such as critical API findings closed within 30 days. The board approves because the plan maps directly to growth risks and names trade-offs, including delaying a lower-value endpoint tool.
Traps that cost marks
- Presenting a technology roadmap as a business strategy.
- Setting goals without baselines, owners, or funding.
- Ignoring organizational culture and incentive structures.
- Communicating only in technical severity rather than business impact.