Security Strategy and Roadmap Guide: Three-Year CSF Plan

Many security programmes are a backlog of projects with a strategy slide on top, which is why they struggle to explain to the board what they will achieve, by when, and what risk is left when they finish. A security strategy states which risks the organisation will reduce, to what level and why; a roadmap sequences the work to get there. This guide shows how to build both from NIST CSF 2.0 Organisational Profiles: scoping, current and target profiles, gap analysis, prioritisation, a three-year roadmap, funding, governance and measurement. It is written for CISOs, security architects and programme managers, and for risk leaders who need the strategy to connect to enterprise risk management. It works with any control framework, but uses CSF 2.0 because its profiles were designed for exactly this current to target exercise.

Key takeaways

Start from business outcomes and risk appetite, not tools. A strategy that cannot be traced to the organisation's objectives and an approved appetite will be funded project by project and abandoned at the first budget squeeze.
Use a Current Profile and a Target Profile. CSF 2.0 defines both, and NIST SP 1301 gives a five-step method: scope, gather, create, analyse gaps and act, then implement and update.
Prioritise gaps on risk reduction and dependency. Foundations such as asset and identity inventory, MFA and logging unlock later work and close the most exploited gaps, so they come first even when they are unglamorous.
Plan in three horizons with annual re-baselining. Commit to year one in detail, year two in outline and year three as direction; update the Current Profile each year and adjust.
Measure outcomes, not activity. Report movement towards the Target Profile and key risk indicators, so the board can see whether risk is falling.

Strategy, roadmap, plan and budget

Artefact	Answers	Horizon	Owner and approver
Security strategy	Which risks matter, what level of risk is acceptable, what we will be able to do in three years	Three to five years	CISO; approved by the board or its risk committee
Target Profile	Which CSF outcomes we will achieve, at what priority	Strategy horizon	CISO with business and risk owners
Roadmap	Which initiatives, in what order, with what dependencies	Three years, detailed for year one	Security programme office
Annual plan and action plan	What will be delivered this year, by whom, by when	One year	Initiative owners
Budget	What it costs and what is funded	One year, with multi-year view	CISO and finance; approved through normal budget cycle

Keep the strategy itself short, typically a few pages: context, risk appetite, three to six strategic objectives, the target state and how progress will be measured. The detail lives in the profiles and the roadmap.

Inputs to collect before you write anything

Business strategy and mission: growth plans, acquisitions, new markets, digital and AI initiatives. CSF GV.OC-01 asks that the mission informs cybersecurity risk management.
Risk appetite and tolerance: the board's stated appetite for cyber risk (GV.RM-02). If none exists, drafting one is the first strategic deliverable. See the Risk Appetite and Tolerance for Cyber Guide.
Legal and regulatory obligations: sector regulation, data protection, NIS2, DORA, SEC rules or contractual requirements (GV.OC-03). See the Regulations and Frameworks Guide.
Threat picture: the attack patterns most relevant to your sector, from threat intelligence and your own incidents.
Current risk register: NIST IR 8286 Rev. 1 (December 2025) describes how cybersecurity risk registers feed the enterprise risk register; reuse the existing register rather than starting again.
Assessments and audit findings: recent penetration tests, audit reports, maturity assessments and incident reviews.
Constraints: budget envelope, headcount, skills, technology lifecycles and change capacity in the business.

Building the Current and Target Profiles

CSF 2.0 (NIST CSWP 29, 26 February 2024) organises outcomes into six Functions, Govern, Identify, Protect, Detect, Respond and Recover, with 22 Categories and 106 Subcategories. A Current Profile records which outcomes are being achieved and how well; a Target Profile records the outcomes selected and prioritised for the organisation's objectives, accounting for expected changes such as new requirements or technology.

Scope the profile. Decide what it covers: the whole organisation, a division, a critical service or a technology estate. NIST SP 1301 notes that organisations can keep several profiles with different scopes. Start with one enterprise profile and add profiles for critical services later.
Gather information and set priorities. Collect policies, risk priorities, requirements and business impact analyses. Community Profiles for your sector can provide a starting baseline.
Create and assess the profiles. For each Subcategory in scope, record current practice and status, then target and priority. Use a simple rating scale, for example not achieved, partially achieved, largely achieved, fully achieved, and back each current rating with evidence. NIST publishes a spreadsheet template for this step.
Analyse gaps and create an action plan. Compare current and target across people, process and technology; record each improvement with action, priority, owner, deadline and resources. Longer remediation can be tracked in a plan of action and milestones.
Implement and update. Deliver the plan, track key performance and key risk indicators, and update the profile as risks change.

Tiers: CSF Tiers (1 Partial, 2 Risk Informed, 3 Repeatable, 4 Adaptive) describe the rigour of governance and risk management practices. Use them to set an overall ambition, for example moving from Tier 2 to Tier 3 over the strategy period, but set targets at Subcategory level, where the work is. NIST encourages higher Tiers where risk or mandates are greater or cost-benefit supports it, not as a goal for its own sake. See the NIST CSF 2.0 Guide.

Prioritising the gaps

A typical first assessment produces dozens of gaps. Score each one so prioritisation is explainable to the board and repeatable next year.

Factor	Question	Weighting guidance
Risk reduction	How much does closing this gap reduce likelihood or impact of a top risk in the register?	Highest weight
Obligation	Is it required by law, regulation, contract or audit finding, and by when?	High; hard deadlines override scores
Dependency	Do other initiatives need it first, for example inventory before access reviews?	High for foundations
Exploitation evidence	Is this a gap attackers commonly use, such as missing MFA on remote access?	High
Cost and effort	What does it cost in money, people and business change?	Used to sequence, not to exclude
Business enablement	Does it unblock a business objective, such as a cloud migration or AI rollout?	Medium

For a baseline sense check, compare the high-priority list with a short, prioritised control set. CISA's Cross-Sector Cybersecurity Performance Goals, aligned to CSF Functions and currently listing 38 goals, were written to help organisations of any size focus on a limited number of essential, high-impact actions. CIS Controls Implementation Group 1 serves a similar purpose.

Turning gaps into a three-year roadmap

Horizon	Focus	Typical initiatives	Planning detail
Year 1: foundations	Close the most exploited gaps and build the inventories everything else needs	Phishing-resistant MFA for remote access and admins; asset, identity and NHI inventory; central logging for critical systems; tested backups; risk appetite and governance forum	Committed: quarterly milestones, owners, budget
Year 2: scale	Extend controls across the estate and make them repeatable	Privileged access management rollout; identity governance with access reviews; vulnerability management SLAs; supplier tiering; detection use cases and incident exercises	Planned: half-year milestones, indicative budget
Year 3: optimise	Automate, measure and adapt	Secrets rotation automation; zero trust segmentation for critical services; risk quantification for investment decisions; continuous control monitoring	Direction: outcomes and indicative cost

Build the roadmap as dependency chains rather than a list. For example: identity inventory, then ownership of every account and NHI, then access reviews, then automated deprovisioning. Show the chain, so stakeholders understand why something they want is in year two.

Limit concurrent change. Each initiative needs business time for testing and adoption, so cap the number of major changes landing on any one team per quarter, and plan pilots before estate-wide rollouts. Every initiative should define its rollback: how to revert a control that disrupts the business without abandoning the outcome, such as moving a conditional access policy back to report-only while exceptions are fixed.

Where identity fits

Identity is the most common thread in modern intrusions and the most common dependency in a roadmap. Asset inventory is incomplete without identity inventory, and that now has to include service accounts, API keys, tokens, workload identities and AI agents, which in many organisations outnumber employees. Put identity foundations in year one: MFA on every remote and privileged path, an inventory of human and non-human identities with owners, and removal of shared and orphaned accounts. Measure them with a small set of identity KPIs. See the Identity Security Metrics Guide and the NHI Governance Maturity Model.

Funding and approval

Frame the ask in risk terms: for each strategic objective, state the risk it reduces, the residual risk if unfunded and the cost. Where possible, use the same risk scale as the enterprise risk register.
Separate run from change: show the cost of operating current controls separately from new initiatives, so cuts can be discussed honestly.
Offer options: present a minimum, recommended and accelerated roadmap with the risk position at the end of each. Boards decide better between options than on a single number.
Get explicit approval: the board or its risk committee should approve the strategy and accept the residual risk; CSF GV.RR-03 expects resources commensurate with the strategy.

See the Security Budget and Investment Planning Guide and the Cyber Risk Quantification Guide.

Governing and measuring the strategy

Cadence: report progress to the governance forum quarterly and to the board at least twice a year; re-baseline the Current Profile annually and after major incidents, acquisitions or regulatory change. CSF GV.OV-01 to GV.OV-03 cover review and adjustment of the strategy.
Triggers for change: a major incident, a material change in threat, a new regulation or a change in business strategy should trigger a strategy review, not wait for the annual cycle.
Link to board governance: the board's role in directing and monitoring security is described in ISO/IEC 27014. See the ISO/IEC 27014 Governance of Information Security Guide and the Board Cyber Risk Reporting Guide.

Metric	What it shows
Target Profile Subcategories achieved, by priority	Progress from current to target state
Top register risks within appetite	Whether the strategy is reducing the risks that matter
Year-one milestones delivered on time	Delivery capability and realism of the plan
Coverage of foundational controls, for example MFA on remote and privileged access	Closure of the most exploited gaps
Identities and NHIs with a named owner	Readiness for identity governance and automation
Open high-severity audit findings and their age	Assurance view of residual weaknesses

Decision guidance

Which framework to profile against: CSF 2.0 for an outcome view that boards understand and that maps to most others; ISO/IEC 27001 Annex A where certification is the driver; CIS Controls where you need prescriptive, technical safeguards. Many organisations profile in CSF and implement with CIS or ISO controls. See the NIST CSF to ISO 27001 Mapping Guide.
Small organisations: use a single enterprise profile, limit the Target Profile to the highest-priority Subcategories, and lean on a baseline such as the CISA CPGs. A one-page strategy and a quarterly roadmap review are enough.
Large organisations: maintain an enterprise profile plus profiles for critical services or business units, aggregate risks through the enterprise risk register, and run the roadmap as a portfolio with a programme office.
Three years or five: three years suits most organisations because technology and threat change quickly; five years can suit regulated or OT-heavy sectors with long asset lifecycles, with the later years kept at direction level.

Framework mapping

Framework	Reference	Relevance
NIST CSF 2.0	GV.OC-01, GV.RM-01, GV.RM-02, GV.RM-04	Mission, risk objectives, appetite and strategic direction
NIST CSF 2.0	GV.RR-03, GV.OV-01 to GV.OV-03, ID.IM-01	Resourcing, strategy review and improvement
NIST SP 800-53 Rev. 5	PM-1, PM-9, PM-6	Programme plan, risk management strategy, measures of performance
NIST IR 8286 Rev. 1	Cybersecurity risk registers	Connecting strategy to enterprise risk management
ISO/IEC 27001:2022	Clause 6.2 objectives and planning, 9.3 management review	Security objectives and their review in an ISMS

Common failure patterns

Tool-led strategy: the roadmap is a list of products to buy, with no link to risks or outcomes, so success is declared on deployment rather than risk reduction.
Target everything at Tier 4: targets are set uniformly high, making the gap unfundable and the plan unbelievable.
Self-assessment without evidence: current ratings are optimistic, so the gap analysis misses the real weaknesses.
Skipping foundations: advanced initiatives start before inventory, identity and logging basics are in place, and stall.
No re-baseline: the strategy is written once and never updated, so after a year it no longer reflects the business or the threat.
Too much concurrent change: the business cannot absorb the roadmap, so initiatives slip together.

Lessons from incidents

The Change Healthcare breach began on 12 February 2024 with compromised credentials used on a Citrix remote access portal that lacked multi-factor authentication, according to UnitedHealth's CEO in testimony to Congress. UnitedHealth later put the number of affected people at 192.7 million and projected 2024 cyberattack costs at 2.87 billion US dollars. For strategy, the lesson is about sequencing: a foundational control on a remote access path outranks any advanced initiative, and a Current Profile assessed with evidence, not assertion, is what finds such gaps before an attacker does.

Practitioner checklist

Collect business strategy, risk appetite, obligations, threat picture, risk register and recent findings before drafting.
Scope an enterprise CSF 2.0 profile and agree who owns it.
Build the Current Profile with evidence for each rating.
Set Target Profile priorities at Subcategory level, informed by Tiers and appetite.
Score gaps on risk reduction, obligation, dependency, exploitation evidence and cost.
Sequence a three-year roadmap as dependency chains, with identity and inventory foundations in year one.
Present options with residual risk and obtain board approval of the strategy.
Report outcome metrics quarterly and re-baseline the Current Profile annually or after major change.

Security Strategy and Roadmap Guide: Building a Three-Year Plan From CSF Profiles