One of the most important tasks to undertake in the planning phase is creating a Security Roadmap that will guide the implementation of the cybersecurity program. In Stage 1, you assessed your digital infrastructure and performed a Business Impact Assessment (BIA) and a Risk Assessment to identify the components of your infrastructure that require the most security. You concluded by performing a Gap Analysis that measured the current state of your organization's cybersecurity against the baseline state put forth by this framework. The results of the Gap Analysis have provided you with a list of controls that need to be implemented into your organization's cybersecurity program. So far in Phase 2, you have assessed possible infrastructure changes for your environment and created the organizational structure for the eventual implementation of security controls. Now, you will need to create a Security Roadmap that will clearly outline and justify the process of implementing new cybersecurity measures in your business.

The Security Roadmap is a document that outlines the path you will take to reach the desired end state. If you have no clear outline of what steps to take, you can quickly derail the projects and end up with scope creep, misconfigurations, and delays. The Security Roadmap is a strategic document that contains three major phases:

  • Phase 1: Foundations
  • Phase 2: Standardization
  • Phase 3: Optimization

These phases create a top-down approach to creating a security program, meaning major strategic changes like building a new network are done first. Phase 2 involves the Standardization of new technologies, such as getting all employees connected to the new network. Finally, Phase 3 optimizes the smaller aspects of the program, such as adjusting MAC address whitelists and Port Security on the new network equipment.

Your Security Roadmap can be a written report, a series of visualizations, or a combination of both. Regardless of what method of presentation you take, the Security Roadmap needs to be a collaborative creation, with the entire Steering Committee and all other Stakeholders informed of the process. The main goal of the Security Roadmap is to justify the costs that will be required to implement new security controls. Therefore, your roadmap needs to answer the following questions:

  1. What are the projects that are going to be pursued? What new controls are being implemented?
  2. Why do we need to implement them?
  3. What is the scope of the new controls? What systems and users will be covered by them?
  4. Who is going to be responsible for the implementation process?
  5. What are the major requirements for successful implementation?
  6. When are we planning on implementing these projects?
  7. What will improve in the business by pursuing these new security controls?

Risk assessment is such an important component in a cybersecurity program because it helps explain sometimes confusing issues to stakeholders in terms they can understand. It is one thing to tell your business partner that you need to have TLS 3.0 encryption on your E-Commerce website to protect your customers and your own image. To a lot of people, that is just word salad. It's another thing to tell your business partner that unencrypted web traffic on your site has a high likelihood of being sniffed, and will likely result in punishment for you two, including large fines and possible jail time. Bringing these issues home with percentages and risk matrices will better justify the costs.