Security Tenets
Significance of Security Tenets
Last Updated: March 8, 2026Setting up an effective information security function within a business requires careful consideration of several key principles, which we call Tenets. These tenets help ensure...
T01: Adopt a Risk-Based Approach
Last Updated: March 8, 2026Effective security is not about eliminating all risk; it is about understanding which risks matter most and directing effort and investment accordingly. Why This Tenet...
T02: Align with Business Values and Objectives
Last Updated: March 8, 2026Security that is disconnected from the business it serves will always struggle for relevance, investment, and lasting organisational support. Why This Tenet Matters Cybersecurity is...
T03: Demonstrate Security Leadership and Governance
Last Updated: March 8, 2026Security leadership is not a title conferred by an organisational chart; it is a reputation earned through visibility, consistency, and the genuine commitment of those...
T04: Foster an Honest Security Culture
Last Updated: March 8, 2026A security programme is only as strong as the behaviours of the people it depends upon, and those behaviours are shaped far more by culture...
T05: Focus on Resilience and Anti-Fragility
Last Updated: March 8, 2026The question is no longer whether a significant security incident will occur, but whether the organisation is genuinely prepared to absorb, respond to, and grow...
T06: Embrace Continuous Improvement
Last Updated: March 8, 2026Security is not a destination that can be reached and held; it is a discipline that must be practised, tested, and refined without pause. Why...
T07: Stay at the Forefront of Technological Advancements
Last Updated: March 8, 2026Technology is the terrain on which security is fought; ISOs who do not understand it cannot navigate it, and those who do not watch its...
T08: Maintain Currency and Adherence with Regulatory Obligations
Last Updated: March 8, 2026Compliance is not the destination of a security programme; it is the baseline from which genuine security begins. Why This Tenet Matters Regulatory compliance has...
T09: Deliver Stakeholder Value Consistently
Last Updated: March 8, 2026The security function earns its organisational standing not through the threats it describes but through the value it demonstrably delivers to the people and interests...
T10: Measure what Matters
Last Updated: March 8, 2026Tenet 10: Measure What Matters The value of the security function is only as visible as the quality of the measures used to demonstrate it....
T11: Embrace Change with Agility
Last Updated: March 8, 2026The ISO who treats change as a disruption to be managed will always be behind it; the one who treats it as an opportunity to...