Most security strategies are either a slide of aspirations or a 60-page project list, and neither gives a board something it can approve, fund and hold management to. This template is the deliverable: a document skeleton for a three-year cyber security strategy, with numbered sections for context, risk appetite, current and target state, strategic objectives and initiatives, roadmap, budget, measures and governance. Each section states what it must contain and gives fill-in text with [Organisation] style placeholders. It is built on the NIST CSF 2.0 Organisational Profile method and the UK Cyber Governance Code of Practice strategy principle, and works with any control framework. The reasoning behind each choice, how to score profiles and how to prioritise gaps, is in the Security Strategy and Roadmap Guide; this page does not repeat it. It is for CISOs, heads of security, security programme managers and the risk leaders who sponsor the strategy.
How to use this template
- Placeholders: replace text in square brackets, such as [Organisation], [Board] and [FY2027], with your own terms. Values in brackets are illustrative, not requirements from any standard.
- Length: keep the main document to [8 to 12] pages. Sections 1 to 4 and 10 to 12 should fit on about four pages; detail goes in the appendices (Current and Target Profiles, initiative charters, cost model).
- Order of work: write section 4 (risk appetite) and section 5 (current state) first. If the organisation has no approved cyber risk appetite, draft one with the Cyber Risk Appetite Statement Template before writing the rest, because every later section is judged against it.
- Language: "must" marks content the board will expect; "should" marks recommended content.
- Horizon: commit to year one in detail, year two in outline and year three as direction, and re-baseline annually (section 11).
- Audience: write sections 1, 4, 6, 7 and 9 for directors with no security background; put technical detail in appendices.
1. Purpose and scope
1.1 This document sets out the cyber security strategy of [Organisation] for [FY2027 to FY2029]. It states which cyber risks the organisation will reduce, to what level and why, what it will be able to do by the end of the period, what it will cost, and how progress will be measured and reported to the [Board].
1.2 Scope: [all entities in the group / named business units], including [operational technology, cloud and SaaS services, suppliers with access to systems or data], and all human and non-human identities (employees, contractors, service accounts, API keys, certificates, workload identities and AI agents) that access them.
1.3 Out of scope: [e.g. physical security, except where it protects information systems; subsidiaries operating under their own approved strategy].
1.4 This strategy supersedes [previous strategy, version, date].
2. Business context
2.1 The strategy must start from the organisation's objectives, not from security tools. Summarise in no more than one page:
| Item | Fill-in text |
|---|---|
| Mission and strategic objectives | [Organisation]'s [corporate plan] commits to [growth in X market, digital service Y, acquisition programme, AI adoption]. |
| Critical services and assets | The services whose failure would most harm customers, revenue or safety are [list 3 to 7], supported by [key systems and data]. |
| Planned change | Over the strategy period [Organisation] expects [cloud migration, new markets, divestment, regulatory change] that will change the risk profile. |
| What the business needs from security | [e.g. win regulated customers, pass due diligence, keep services available within agreed tolerances]. |
3. Threat and obligation context
3.1 Threats: the attack patterns most relevant to [Organisation]'s sector and size are [e.g. ransomware via stolen credentials, supplier compromise, business email compromise, cloud misconfiguration, misuse of service account and API credentials]. Source: [threat intelligence, own incidents, sector body].
3.2 Obligations: [Organisation] must meet [list laws, regulations and contracts, e.g. data protection law, NIS2, DORA, SEC disclosure rules, PCI DSS, customer contract clauses]. See the Regulations and Frameworks Guide.
3.3 Recent findings: summarise the [3 to 5] most significant findings from audits, penetration tests, incidents and assessments in the last [24] months.
4. Risk appetite
4.1 The [Board] approved the following cyber risk appetite on [date]:
"[Organisation] has a [low / moderate] appetite for cyber risk that could disrupt [critical services] for longer than [X hours] or expose [category of data]. It has [no] appetite for [regulatory breach, safety impact]. It accepts [higher] risk in [e.g. innovation pilots] where [compensating condition]."
4.2 Tolerances that translate the appetite into measurable limits are listed in section 10 and Appendix [C].
4.3 The principal cyber risks, taken from the [enterprise risk register], with current and target ratings, are:
| Risk | Owner | Current rating | Target rating by [FY2029] | Within appetite at target? |
|---|---|---|---|---|
| [Ransomware disrupts critical service] | [COO] | [High] | [Medium] | [Yes] |
| [Compromise via supplier access] | [CPO] | [High] | [Medium] | [Yes] |
| [Credential and identity compromise, human and non-human] | [CIO] | [High] | [Low] | [Yes] |
| [Sensitive data exposure] | [CDO] | [Medium] | [Low] | [Yes] |
4.4 Any principal risk that will remain outside appetite at the end of the period must be stated here with the reason and the decision requested of the [Board].
5. Current state
5.1 The current state was assessed on [date] using [NIST CSF 2.0 Current Profile / ISO/IEC 27001 Annex A / CIS Controls v8.1] covering [scope]. The full Current Profile is in Appendix [A].
5.2 Summary by CSF 2.0 Function:
| Function | Current status | Key gaps |
|---|---|---|
| Govern | [Partially achieved] | [No approved appetite; roles unclear for cloud and suppliers] |
| Identify | [Partially achieved] | [Asset and identity inventory incomplete, service accounts unowned] |
| Protect | [Partially achieved] | [MFA not on all remote access; long-lived secrets in code] |
| Detect | [Not achieved] | [Cloud and SaaS logs not centralised] |
| Respond | [Partially achieved] | [Plan untested with executives] |
| Recover | [Partially achieved] | [Restore times untested against tolerances] |
5.3 Strengths to preserve: [list].
For a structured scoring method, see the Security Programme Maturity Assessment Template.
6. Target state
6.1 By [end of FY2029], [Organisation] will be able to: [write 4 to 6 capability statements in business language, e.g. "restore any critical service within [X hours] from a clean backup"; "know every person and machine identity with access to critical systems, with an owner"; "detect and contain a compromised account within [X hours]"].
6.2 The Target Profile in Appendix [B] lists the CSF outcomes selected and their priority. Targets are set according to risk appetite, obligations and cost, not to reach the highest level everywhere.
7. Strategic objectives and initiatives
7.1 The strategy has [three to six] objectives. Each must trace to at least one principal risk in section 4.3 and one gap in section 5.
| Objective | Risks addressed | Initiatives | Owner |
|---|---|---|---|
| [O1 Know and control every identity] | [Credential compromise; supplier access] | [Phishing-resistant MFA for all remote and privileged access; inventory and ownership of service accounts and API keys; secrets management] | [Head of IAM] |
| [O2 Recover critical services within tolerance] | [Ransomware] | [Immutable backups; tested restores; recovery runbooks] | [Head of IT Operations] |
| [O3 See and stop attacks early] | [Ransomware; data exposure] | [Centralised logging including cloud and SaaS; detection engineering; incident exercises] | [Head of SOC] |
| [O4 Govern supplier and cloud risk] | [Supplier compromise] | [Supplier tiering; contract security clauses; cloud guardrails] | [Head of GRC] |
7.2 Each initiative must have a one-page charter in Appendix [D]: outcome, scope, dependencies, cost, owner, milestones and the measure that shows it worked.
7.3 Where identity fits: identity controls usually form the first objective because stolen credentials and unmanaged machine credentials are among the most common ways in. See the Identity Programme Roadmap Template and the NHI Programme Roadmap Guide.
8. Roadmap
| Horizon | Commitment level | Initiatives and milestones |
|---|---|---|
| Year 1 [FY2027] | Committed: funded, scheduled by quarter | [Foundations: asset and identity inventory, MFA on remote and privileged access, central logging for critical systems, tested restore of top service] |
| Year 2 [FY2028] | Planned: outline scope and cost | [Extend controls to all business units and suppliers; secrets rotation; detection coverage] |
| Year 3 [FY2029] | Direction: indicative | [Automation of access reviews and response; continuous assurance] |
8.1 Sequencing principles: foundations before optimisation; dependencies before dependants; no more than [N] major initiatives running at once given change capacity of [teams].
9. Budget and resourcing
| Line | Year 1 | Year 2 | Year 3 | Notes |
|---|---|---|---|---|
| Capital / one-off | [£] | [£] | [£] | [Projects in section 7] |
| Recurring technology | [£] | [£] | [£] | [Licences, cloud, managed services] |
| People | [FTE / £] | [FTE / £] | [FTE / £] | [New roles, training] |
| Savings and retirements | [-£] | [-£] | [-£] | [Tools consolidated or retired] |
| Total | [£] | [£] | [£] | [As % of IT budget: X%] |
9.1 Funding options presented to the [Board]: [Option A: full strategy, risk at target by FY2029; Option B: reduced, principal risks X and Y remain outside appetite until FY2030; Option C: minimum, regulatory obligations only]. Recommended: [Option A], because [reason]. See the Security Budget Template and Cost Model and, for expressing risk reduction in money, the Cyber Risk Quantification Guide.
10. Measures
10.1 Progress must be reported as outcomes and risk, not activity. The board metric set is:
| Measure | Baseline [date] | Year 1 target | Tolerance |
|---|---|---|---|
| Principal cyber risks within appetite | [1 of 4] | [2 of 4] | [No risk rated Very High] |
| Target Profile outcomes achieved | [X%] | [Y%] | [None set] |
| Remote and privileged access covered by phishing-resistant MFA | [X%] | [100%] | [Below 95% triggers report] |
| Service accounts and API keys with a named owner | [X%] | [Y%] | [Set by board] |
| Critical services with a tested restore within tolerance | [X of Y] | [Y of Y] | [Any failure reported] |
| Strategy milestones on track | [None set] | [90%] | [Below 75% triggers review] |
See the Security Metrics and KPIs Programme Guide.
11. Governance and review
11.1 Accountable executive: [COO / CIO]. Strategy owner: [CISO]. Oversight: [Risk committee / Audit committee].
11.2 Reporting: progress against section 10 is reported to [Risk committee] [quarterly] and to the [Board] [at least annually], using the Board Cyber Report Template.
11.3 Review: the Current Profile is reassessed and the strategy re-baselined [annually] and after any [major incident, acquisition, regulatory change or change in appetite].
11.4 Changes to objectives, budget beyond [X%] or target risk ratings require [Board] approval; other changes are approved by [accountable executive] and reported.
12. Approval
| Role | Name | Date | Decision |
|---|---|---|---|
| [CISO], author | [Name] | [Date] | Submitted |
| [Accountable executive] | [Name] | [Date] | Endorsed |
| [Board / Risk committee] | [Chair] | [Date] | [Approved / Approved with Option B] |
Appendices: [A] Current Profile · [B] Target Profile · [C] Risk appetite and tolerances · [D] Initiative charters · [E] Cost model · [F] Glossary.
Implementation guidance
Building it in eight weeks
- Weeks 1 to 2: collect inputs for sections 2 and 3: corporate plan, risk register, audit findings, obligations and threat picture. Interview [5 to 10] business leaders about critical services.
- Weeks 2 to 4: agree or confirm the risk appetite with the risk committee; assess the Current Profile. NIST SP 1301 sets out five steps: scope the profile, gather information and prioritise outcomes, create and assess the Current and Target Profiles, analyse gaps and create an action plan, then implement and update.
- Weeks 4 to 6: set the Target Profile, group gaps into objectives and initiatives, and cost them. SP 1301 asks that each action records the action, priority, owner, deadline and resources.
- Weeks 6 to 7: test the draft with the accountable executive, finance and two or three business owners; prepare the funding options.
- Week 8: submit to the risk committee, then the board. Record the decision in section 12.
Small and large organisations
- Small organisations: combine sections 2 and 3, keep three objectives, and use a published baseline such as CIS Controls v8.1 Implementation Group 1 for the current and target state instead of a full CSF profile.
- Large or regulated organisations: keep one enterprise strategy and add profiles for critical services or divisions; SP 1301 notes organisations can keep several profiles with different scopes. Align the budget section with the annual planning cycle and the measures with the risk committee's reporting.
Common mistakes to avoid
- A tool list called a strategy: objectives must be outcomes traced to risks, not products.
- No appetite: without section 4 the board has nothing to judge sufficiency against.
- Targets set to the maximum everywhere: unaffordable targets get cut arbitrarily; set them by risk.
- Only people counted as identities: service accounts, API keys and AI agents left out of scope and measures.
- One option only: boards fund decisions; present options with the residual risk of each.
Framework mapping
| Template section | UK Cyber Governance Code | NIST CSF 2.0 | NIST SP 800-53 Rev. 5 |
|---|---|---|---|
| 2 Business context | A1, B1 | GV.OC-01 | PM-1 |
| 3 Threats and obligations | A5, B2 | GV.OC-03, ID.RA-05 | PM-9 |
| 4 Risk appetite | A3 | GV.RM-01, GV.RM-02, GV.RM-03 | PM-9 |
| 7 Objectives (suppliers) | A4 | GV.SC-01 | PM-9 |
| 9 Budget and resourcing | B3 | GV.RR-03 | PM-3 |
| 10 Measures | B4 | GV.OV-03 | PM-6 |
| 11 Governance and review | B4, E1 | GV.OV-01, GV.OV-02, ID.IM-01 | PM-1 |
In ISO/IEC 27001:2022 the strategy supports clause 6.2 (information security objectives and planning to achieve them) and feeds clause 9.3 (management review). See the UK Cyber Governance Code of Practice Guide and the NIST CSF 2.0 Profiles and Tiers Guide.
Standards and references
- NIST: The NIST Cybersecurity Framework (CSF) 2.0, CSWP 29
- NIST: SP 1301, Quick-Start Guide for Creating and Using Organizational Profiles
- NIST: IR 8286 Rev. 1, Integrating Cybersecurity and Enterprise Risk Management
- DSIT and NCSC: Cyber Governance Code of Practice
- NIST: SP 800-53 Rev. 5, Security and Privacy Controls
- ISO: ISO/IEC 27001:2022 Information security management systems
This template is provided for guidance and must be adapted to your organisation. Related NHI Mgmt Group resources: Security Strategy and Roadmap Guide · Cyber Risk Appetite Statement Template · Security Budget and Investment Planning Guide · Risk Register Template · Board Cyber Risk Reporting Guide