Prioritising the Prioritised - A Framework to Prioritise Cyber Security Priorities

Sep 4, 2026

Uploaded by McQueen

A repeatable and defensible decision framework for prioritising already prioritised cyber security initiatives across their lifecycle. The approach evaluates nine factors spanning current and target maturity, implementation readiness, effort size, prerequisites and dependencies, compliance requirements, business value, risk if not implemented, and financial outlay. It includes color coding guidance (red/green for high or low relevance, orange for medium) to rank initiatives so the highest-priority efforts can be selected from many competing, high-risk options.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages11

Reading Time28 min

AccessFree to download

Prioritising the Prioritised

Prioritisation and Framework Purpose

9 Factors of the Prioritisation Framework

9 Factors Explanation

Colour Coding

Final Output of the Framework

Faisal Khan M. Phil. (Cyber Security UQ) CISSP, CISM, CISA Ex-Director Cyber Security QLD Government Prioritising the prioritised (A framework to prioritise cyber security priorities) • John has just joined Company ABC to lead the cyber security function • There is a long list of Reds (high risk) that need to be addressed. • There are several competing initiatives across the enterprise and the Board has asked John to review all the identified cyber security initiatives and come up with a list of only 5 priorities to keep company ABC safe. • John is wondering where to start from… John needs help How can we help John? How to select the top ones from many cybersecurity priorities where everything is high-risk, urgent, and important John has 30 “high” ranking risks to address so where he can start? Can “high” risk ranking alone be enough to decide the priority of a cybersecurity initiative? Is finance the only other consideration or the availability of resources is even more important? John’s organisation operates in a regulated environment, so how about compliance to take into account? Prioritising the prioritised Prioritisation /prʌɪˌɒrətʌɪˈzeɪʃ(ə)n/ Prioritisation is the activity that arranges items or activities in order of importance relative to each other. Framework: Prioritising the prioritised Presented here is a framework to enable the decision making process to prioritise the already prioritised cybersecurity initiatives, that is repeatable and defendable across its lifecycle. 9 Factors of the Prioritisation Framework Current Maturity Target Maturity Readiness to implement Effort Size Pre-req for others Compliance requirement Business Value Risk if not implemented Financial outlay 9 Factors Explanation Assessed current level of maturity of a capability (using an approved, agreed-upon framework) Identified target level of maturity of a capability (using an approved, agreed-upon framework) A measure of readiness of our people, processes and technologies to implement a capability How much effort is required to implement a capability How much one or more capabilities depend upon a capability A measure of how much a capability is required for compliance with applicable regulation(s), policies, audit recommendations and governance forums' advice How much value the capability can deliver for business e.g. enablement or solving a problem. What is the level of risk if the capability is not established How much finance is needed to implement a capability. Colour Coding Red or Green: High and Low ranking of a factor could be depicted as Green, or Red based on its favourable or unfavourable relevance to an initiative for its prioritisation over others. For instance, - an organisation wants to establish a vulnerability management capability, - their current maturity is Low; this factor (i.e. current maturity) could be colour-coded Green - as, the low maturity of this capability makes it a good candidate to get organisation’s attention. - Similarly, if the target maturity for this capability is High; this factor (i.e. target maturity) could also be colour-coded Green because there is a sizable gap between the current maturity and the target maturity that requires due consideration. Orange: Medium ranking is always depicted as Orange showing that the factor possesses neither too favourable nor too unfavourable relevance to an initiative. In summary, the greener the factors are, the higher the priority of an initiative is. Current Maturity Target Maturity Readiness to implement Effort Size Pre-req for others Compliance requirement Business Value Risk if not implemented Financial outlay Factors with recommended colour-coding Assessed current level of maturity of a capability (using an approved, agreed-upon framework) Low Medium High Identified target level of maturity of a capability (using an approve

FAQs

Can a high-risk ranking alone be enough to decide cyber security priority?

The material frames priority selection as multi-factor evaluation, since considerations like finance/resource availability, compliance, and business value can be important alongside risk.

Sep 4, 2026

Uploaded by McQueen