T02: Align with Business Values and Objectives

Security that is disconnected from the business it serves will always struggle for relevance, investment, and lasting organisational support.

Why This Tenet Matters #

Cybersecurity is no longer a back-office technical discipline. It is a core component of how modern organisations operate, compete, and create value. As digital technologies have moved from optional enhancements to essential infrastructure, the consequences of poor security alignment have grown from operational inconvenience to existential threat. Equally, the opportunity cost of a security function that impedes rather than enables business has become too significant to ignore. ISOs who fail to ground their programmes in a genuine understanding of what the organisation is trying to achieve will find their function progressively marginalised, regardless of the technical quality of the controls they put in place.

Core Concepts #

Security and Business Strategy #

The relationship between cybersecurity and business strategy has transformed fundamentally over the past two decades. Where security was once a largely defensive function operating at the periphery of organisational decision-making, it is now recognised by governments, regulators, and corporate boards worldwide as both an enabler of commercial opportunity and a source of significant risk to personal, commercial, and national interests. This dual nature is central to understanding what alignment with business values and objectives actually requires.

Cyber Capability as Competitive Advantage #

Cyber capabilities, when well managed, offer genuine competitive advantages: they foster innovation, enhance productivity, improve customer engagement, and enable organisations to pursue opportunities that would otherwise carry unacceptable risk. The ISO’s role in this context is not to constrain ambition but to ensure that the organisation can pursue it safely and sustainably.

New Business Models #