Fee
Register to see indicative feesConfirmed in writing after scoping01 / Build & Advisory · Standard
Security Strategy & Roadmaps
Security spend has grown without a plan behind it, and the next budget submission needs a sequence you can defend.
Strategy & ArchitectureBuild and advisory
Typical duration
8 to 12 weeksDepends on organisational size and the number of business unitsPrimary artefact
Phased security roadmapPlus three moreWho leads it
Steve SharmaFounder & Principal04 / What this is
What Security Strategy & Roadmaps is
A strategy engagement that produces a sequenced, costed multi-year security roadmap, built against an evidenced current position rather than a maturity opinion.
And what this service produces
The output is designed to be a budget artefact. It goes into a board paper and a funding submission, not into a drive.
05 / Who it is for
Built for a real assurance trigger, not a badge project.
01
This fits when
- Your organisation is spending on security without a plan connecting it.
- A security leader is preparing a multi-year funding case.
- The board is asking what good looks like and what it costs.
- An incident or audit has left you needing a credible forward plan.
02
The usual trigger
- A budget cycle is approaching and last year's ask was refused.
- The board has asked for a multi-year view.
- An audit or incident has forced a rethink.
- A new security leader has inherited an undocumented estate.
06 / The obligation
Why most security roadmaps do not survive their first budget meeting
The roadmaps that fail have three things in common: they are built on an asserted current state rather than an evidenced one, they sequence by control framework rather than by risk, and they present a total rather than a set of fundable phases.
A board does not refuse a security roadmap because it disagrees about security. It refuses because the number has no phases, the phases have no dependencies, and nothing in it can be deferred without the whole thing collapsing.
An evidenced starting point
The assessment of where you are is the input, and it has to be evidenced. A roadmap built on an optimistic self-assessment produces a funding request that fails on its first serious question.
Sequenced by risk, not by framework
The sequencing is the deliverable. Phases are ordered by risk and dependency, so the board can see what must happen before what.
Costed as fundable phases
The costing is the deliverable too. A single total gives a board nothing to approve in part; a set of costed phases does.
Phases that stand alone
We build phases that stand alone and state what each one buys, so deferring one does not collapse the rest.
A roadmap that cannot be partially funded will not be funded.
07 / What you receive
Four artefacts. Each one yours to keep.
- 01
Phased security roadmap
Multi-year, sequenced by risk and dependency, with each phase costed and independently fundable.
Roadmap + spreadsheetBudget-ready - 02
Current-state position
An evidenced assessment against a named framework, not a self-scored opinion.
Assessment reportSecurity leadership - 03
Board paper
The case, the ask and the trade-offs, in the format your board actually reads.
PaperBoard pack - 04
Dependency map
What must happen before what, and what can run in parallel.
MapProgramme planning
08 / Scope
The whole system is visible before work begins.
Current state
- Evidenced assessment against NIST CSF or ISO 27001
- Control effectiveness sampled, not assumed
- Existing spend and tooling reviewed
Risk alignment
- Threat and risk profile
- Business priorities and constraints
- Regulatory and contractual obligations
Target state
- Target maturity defined and justified
- Framework alignment
- What deliberately stays out of scope
Sequencing
- Phases sequenced by risk and dependency
- Each phase independently fundable
- Quick wins separated from structural work
Costing
- Effort and cost per phase
- Internal versus external split
- Run-cost implications stated
09 / Included / not included
A useful boundary is part of the deliverable.
Included
- Evidenced current-state assessment
- Risk alignment and obligations
- Target-state definition
- Sequencing by risk and dependency
- Costing per phase
Not included
- Implementation: We produce the plan. Delivering it is your team, a partner, or separate scoped work.
- Product selection: Vendor-neutral. We state requirements, not preferred products.
- Detailed architecture: Target-state architecture is a separate engagement.
- Ongoing programme management: We can advise, but running the programme is not included.
10 / How we do it
A traceable path from scope to evidence.
Current-state assessment
Evidenced, sampled, and against a named framework.
Risk and target state
Target maturity defined against risk and obligation, not against a generic benchmark.
Sequencing and dependencies
Phases built so each can be funded and deferred independently.
Costing and board paper
Costed per phase, then written into the format your board reads.
Mapped againstNIST Cybersecurity FrameworkISO/IEC 27001CIS Controls
11 / Timeline
8 to 12 weeks of work.
Elapsed time and customer effort are separated because they are not the same number.
Weeks 1 to 4
Current-state assessment
Evidence the current position against a named framework, sampling controls rather than accepting answers.
Customer effort
6-10 interviews of 45 minutes, plus system and documentation access.
Weeks 5 to 6
Risk profile and target state
Define target maturity against your risk and obligations.
Customer effort
One half-day workshop with the executive team.
Weeks 7 to 9
Sequencing and dependency mapping
Order the phases by risk and dependency so each can be funded on its own.
Customer effort
Two review cycles with security and technology leadership.
Weeks 10 to 12
Costing, board paper, readout
Cost each phase and write the board paper. Across the engagement, expect roughly 20-25 hours of your team's time, most of it in the assessment phase.
Customer effort
One readout session of 90 minutes.
Our work: 8 to 12 weeks
12 / Scope check
Test whether Security Strategy & Roadmaps
is the right next move.
We will cover likely scope, cost and fit.
Book a confidential strategy sessionWith Steve Sharma, who would lead.13 / Who leads the engagement
Named lead. Direct assessment.
Your engagement lead
Steve Sharma
Founder & Principal
Runs the executive workshop and authors the board paper.
ASD-endorsed IRAP AssessorCISSPCREST
Every engagement has a named lead. Where a second executive or specialist is needed, they are named in the proposal and subject to client approval.
Review leadership record14 / Why Cybersecurity Link
Three decisions.
Accountability.
Phases that can be funded independently.
A roadmap that collapses if partially funded will not be funded. Ours states what each phase buys on its own.
Evidenced current state, not a self-score.
The assessment samples controls rather than accepting a questionnaire. A roadmap built on optimism fails its first serious question.
The board paper is a deliverable, not an appendix.
The plan has to survive a room you will be in without us. We write for that room.
15 / The boundary
What this engagement does not claim.
Delivery
We produce the plan. We do not deliver it.
Implementation and programme management sit with your team, a partner, or separately scoped work.
Independence
We are vendor-neutral and take no product margin.
The roadmap states capability requirements, not preferred products.
Operations
We are not a managed security service.
The engagement produces a plan and a funding case; it does not run security operations.
Frameworks
One roadmap, mapped across three references.
The work maps to the NIST Cybersecurity Framework, ISO/IEC 27001 and the CIS Controls.
What moves the fee
Per additional business unit, reflecting organisational size.
Where a recent assessment and existing documentation can be used.
Where multiple regulatory regimes apply.
A starting fee, confirmed in writing after scopingRoadmap, current-state position, board paper and dependency mapExecutive workshop and readout sessionImplementation and product selection excluded
18 / How this fits
Where this sits in the wider programme.
19 / When this is not right
Sometimes the best recommendation is a smaller service, or a later date.
01
You already have a recent evidenced position and just need the plan.
We can scope a shorter sequencing engagement instead.
02
The real need is a specific control gap.
An assessment or the relevant service is faster and cheaper.
03
Nobody is resourced to deliver the roadmap.
A plan with no delivery capacity is an expensive document. Talk to us about capacity first.
20 / FAQ
The questions that change the decision.
An assessment tells you where you are. This tells you where to go, in what order, at what cost. The assessment is an input to this, and if you have a recent one we will use it rather than redoing it.
No. We are vendor-neutral and take no product margin, so the roadmap states capability requirements. Selection is yours or a partner's.
That is the design intent. Every phase is built to stand alone and states what it buys on its own. A roadmap that collapses when partially funded is the most common reason boards refuse them.
The sequencing usually holds for 18 to 24 months. The costing ages faster. We state a review point rather than implying it is permanent.
Some of it, as separate scoped work. We will also say where your own team or a cheaper provider is the better option.
21 / Next move
If Security Strategy & Roadmaps is what you need, the next step is a conversation about scope.
A 45-minute conversation with Steve Sharma, who would lead the engagement: what your scope looks like, what it involves, and whether this is the right service for you at all.