From technical issue to strategic theme

A cyber incident rarely begins with a spectacular attack. More often, it starts with a stolen account, a vulnerable integration, an incorrectly shared document or a supplier that proves less resilient than expected. What begins as a small technical issue can stop services, expose sensitive information and damage the trust of customers, citizens and partners.

Cybersecurity therefore does not belong to IT alone. It is an enterprise risk that requires choices about continuity, investment, people and acceptable residual risk. The board does not need to know every technical detail, but it must be able to explain which scenarios the organisation prepares for, which controls take priority and how recovery is organised.

Move from lists of threats to concrete risk scenarios

Generic statements such as 'ransomware is increasing' offer little help with prioritisation. A scenario makes the risk tangible: an attacker uses a supplier account to access a core system, encrypts data and interrupts services for several days. Teams can then assess likelihood, impact, existing controls and recovery options.

Start with scenarios that can genuinely affect the mission or core processes. In addition to ransomware, consider identity compromise, loss of cloud or network services, data manipulation, a breach at a chain partner or operational technology failure. This creates a conversation about what needs protection rather than which tool to buy.

Two frameworks with different roles

ISO/IEC 27001:2022 defines requirements for an information security management system. It helps organisations manage context, risks, policies, responsibilities, controls and continual improvement as one system. Certification can add value, but the management system is the means; demonstrable risk control remains the objective.

NIST Cybersecurity Framework 2.0 provides a shared language for desired outcomes. The current version has six connected Functions: Govern, Identify, Protect, Detect, Respond and Recover. The addition of Govern emphasises that strategy, roles, supply-chain risk and oversight direct the other five Functions.

The two can reinforce one another. ISO/IEC 27001 helps make the system governable and auditable; NIST CSF 2.0 helps describe current and target resilience and communicate it across executives, operations and suppliers.

The six Functions as board-level questions

Govern — which risks do we accept?

Are responsibilities clear, do investments reflect the most important scenarios and are supplier requirements followed up with evidence?

Identify — do we know what is critical?

Is there visibility of business-critical processes, data, systems, dependencies and accounts? An inventory adds value only when criticality and ownership are known.

Protect — do we limit likelihood and impact?

Consider strong authentication, appropriate access, secure configuration, timely patching, backups, awareness and protection of sensitive data. Select controls based on scenarios, not fashion.

Detect — do we see anomalies in time?

Logging matters only when teams know which signals need attention, who reviews them and how quickly escalation occurs. Test whether detection works for the selected scenarios.

Respond — can teams act in a coordinated way?

A technical playbook is not enough. Legal, privacy, communications, management and suppliers must know their roles and make decisions together under time pressure.

Recover — how do we resume service?

Verify that backups can actually be restored, recovery priorities are agreed and temporary operating procedures are available. Recovery objectives must match what the organisation can operationally tolerate.

Your supply chain is part of the attack surface

Organisations outsource increasing amounts of technology and management, but not accountability for risk. Segment supplier access, set requirements according to the service and agree how incidents, vulnerabilities and changes are reported. Ask for more than certificates; discuss recovery, dependencies and evidence that controls have been tested.

Awareness becomes behaviour

An annual e-learning course alone changes little. Connect secure behaviour to real work: let service desks practise suspicious requests, discuss data sharing in teams and train managers in incident decisions. Make reporting easy and reward early signals. An employee who raises an alert quickly is a sensor, not a problem.

An achievable 90-day improvement plan

• Prioritise three to five scenarios and ask executives and process owners to confirm impact and risk appetite.
• Check the foundations: critical assets, administrator accounts, strong authentication, vulnerabilities, backups and supplier connections.
• Run one crisis exercise with IT, executives, communications, privacy and a relevant supplier.
• Create a target profile with NIST CSF 2.0 and select a limited set of improvements with owners and deadlines.
• Report meaningful indicators, such as strong-authentication coverage, recovery tests, age of critical vulnerabilities, detection and recovery time, and open actions from exercises.

Resilience is the ability to keep functioning

Perfect security does not exist. A resilient organisation reduces the likelihood of incidents, detects anomalies early, limits damage and recovers in a controlled way. That requires technology as well as leadership, ownership and learning.

Continuous Connect helps organisations connect cybersecurity to governance and operations — from risk scenarios and target profiles to governance, exercises and an executable improvement agenda.

Further reading

• NIST — Cybersecurity Framework 2.0
• ISO — ISO/IEC 27001:2022

← Back to all blogs