Cyber Strategy: Risk-Driven Security and Resiliency

Cybersecurity work can become fragmented across teams, frameworks, and technical projects. Cyber Strategy: Risk-Driven Security and Resiliency offers a way to bring those efforts together in a corporate plan—one shaped by business priorities, informed by risk, and designed to be reviewed over time.

Carol A. Siegel and Mark Sweeney organize the book around six steps, moving from preparation and project management to threat analysis, risk assessment, evaluation of current and target states, and performance measurement. The emphasis is on building a repeatable strategy process, not treating cybersecurity as a collection of disconnected tools.

Build a strategy that connects security to the organization

The opening chapters address the groundwork: organizational structure, steering committees, business values, mission and vision, principles, and strategic objectives. The authors then turn those foundations into initiatives, project plans, timelines, and governance tasks. This approach helps readers consider how a security strategy can align with wider business goals and secure meaningful organizational participation.

Assess threats, vulnerabilities, and risk

Later chapters examine threat actors, threat intelligence, vulnerabilities, cyber risk, and controls. The discussion includes risk appetite and tolerance, risk measurement approaches, NIST guidance, and other established assessment frameworks. By placing these subjects within a strategy-development process, the book links technical findings to prioritization and decision-making.

Track progress and refine the plan

Current- and target-state assessments lead into the question of how to measure whether a strategy is working. The book addresses key risk indicators and key performance indicators, reporting, governance cycles, and selecting initiatives for the following year. Project-management aids—including charters, RACI matrices, swimlanes, timelines, and Gantt charts—support the planning and coordination involved.

For cybersecurity and risk-planning practitioners

This book is relevant to readers involved in cybersecurity, cyber resiliency, information security, risk management, or security governance who need to develop or contribute to an organization-wide strategic plan. Its stepwise structure and planning materials make it especially pertinent to people working across technical and business responsibilities.

A practical framework for sustained attention

Rather than treating strategy as a one-time document, Siegel and Sweeney frame it as work that is measured, reported, and refined. The result is a focused guide to connecting cyber risks and organizational objectives with planned action.