Domain 1 · Objective reference 1B1 · Chapter 4 of 35
Develop an information-security strategy
About 5 minutes · Detailed public baseline effective 2022; the replacement exam starts 3 November 2026 and its exact revised topic/task mapping remains unverified
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Start with business outcomes not a shopping list.
Explore the anchors
Understand objectives constraints and risk appetite.
Concept matching activity
Match this task or description to its concept:
Define desired outcomes and capabilities.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Management concept and decision mechanism
- Build a strategy and a reviewable roadmap
Management concept and decision mechanism
A strategy connects business objectives, relevant exposure and desired security outcomes. Assess the current position, legal and contractual constraints, stakeholder expectations and the organization’s capacity before proposing a future state. Express outcomes in business terms such as reliable order fulfillment or protected customer information. Then establish initiatives, dependencies, funding, owners and measures of benefit. A technology shopping list is not a strategy because it does not explain why those capabilities are needed or how success changes a business outcome. Review strategy after material organizational, supplier or threat changes.
Build a strategy and a reviewable roadmap
Record the current position, desired outcomes, gaps, assumptions, and constraints before sequencing initiatives. Consider customer commitments, new services, staffing, supplier reliance, and applicable obligations. A roadmap connects those gaps to an accountable sponsor, dependencies, funding decisions, and evidence of benefit. A target date without delivery capacity is an aspiration rather than a reliable commitment.
Maintain stakeholder support by making the decision and tradeoffs clear. Agree what business and technology owners must contribute, report the impact of deferred work, and revisit priorities when context changes. Security governance should use the organization's existing investment and risk decision routes rather than establish a disconnected approval system.
Worked example
A retailer prioritizes tested ordering recovery because the service interruption exceeds tolerance, rather than selecting the most visually impressive monitoring product.
Check your understanding
What must precede a defensible recommendation between two competing initiatives?
Show explanation
A shared understanding of business outcomes, exposure, existing capabilities, cost and expected benefit.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.