[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-0-en-105":3,"doc-seo-202699-105":59,"doc-detail-202699-en":122},{"code":4,"msg":5,"data":6},0,"success",[7,13,18,23,28,33,38,43,48,51,55],{"id":8,"doc_module":4,"doc_module_name":9,"category_name":10,"show_sort_weight":11,"slug":12},1,"Document","Story & Novel",90,"story-novel",{"id":14,"doc_module":4,"doc_module_name":9,"category_name":15,"show_sort_weight":16,"slug":17},2,"Literature",80,"literature",{"id":19,"doc_module":4,"doc_module_name":9,"category_name":20,"show_sort_weight":21,"slug":22},4,"Exam",70,"exam",{"id":24,"doc_module":4,"doc_module_name":9,"category_name":25,"show_sort_weight":26,"slug":27},5,"Comic",60,"comic",{"id":29,"doc_module":4,"doc_module_name":9,"category_name":30,"show_sort_weight":31,"slug":32},6,"Technology",50,"technology",{"id":34,"doc_module":4,"doc_module_name":9,"category_name":35,"show_sort_weight":36,"slug":37},7,"Healthcare",40,"healthcare",{"id":39,"doc_module":4,"doc_module_name":9,"category_name":40,"show_sort_weight":41,"slug":42},8,"Research & Report",30,"research-report",{"id":44,"doc_module":4,"doc_module_name":9,"category_name":45,"show_sort_weight":46,"slug":47},9,"Religion & Spirituality",20,"religion-spirituality",{"id":46,"doc_module":4,"doc_module_name":9,"category_name":49,"show_sort_weight":46,"slug":50},"World Cup","world-cup",{"id":52,"doc_module":4,"doc_module_name":9,"category_name":53,"show_sort_weight":52,"slug":54},10,"Lifestyle","lifestyle",{"id":56,"doc_module":4,"doc_module_name":9,"category_name":57,"show_sort_weight":24,"slug":58},19,"General","general",{"code":4,"msg":60,"data":61},"ok",{"site_id":62,"language":63,"slug":64,"title":65,"keywords":66,"description":67,"schema_data":68,"social_meta":115,"head_meta":117,"extra_data":119,"updated_unix":121},105,"en","prioritising-the-prioritised-a-framework-to-prioritise-cyber-security-priorities","Prioritising the Prioritised - A Framework to Prioritise Cyber Security Priorities","","A repeatable and defensible decision framework for prioritising already prioritised cyber security initiatives across their lifecycle. The approach evaluates nine factors spanning current and target maturity, implementation readiness, effort size, prerequisites and dependencies, compliance requirements, business value, risk if not implemented, and financial outlay. It includes color coding guidance (red/green for high or low relevance, orange for medium) to rank initiatives so the highest-priority efforts can be selected from many competing, high-risk options.",{"@graph":69,"@context":114},[70,84,105],{"@type":71,"itemListElement":72},"BreadcrumbList",[73,77,79,82],{"item":74,"name":75,"@type":76,"position":8},"https://docshare.wps.com","Home","ListItem",{"item":78,"name":9,"@type":76,"position":14},"https://docshare.wps.com/document/",{"item":80,"name":40,"@type":76,"position":81},"https://docshare.wps.com/document/research-report/",3,{"item":83,"name":65,"@type":76,"position":19},"https://docshare.wps.com/document/prioritising-the-prioritised-a-framework-to-prioritise-cyber-security-priorities/202699/",{"url":83,"name":65,"@type":85,"image":86,"author":91,"headline":65,"publisher":94,"fileFormat":97,"inLanguage":63,"description":67,"dateModified":98,"datePublished":99,"encodingFormat":97,"isAccessibleForFree":100,"interactionStatistic":101},"DigitalDocument",{"url":87,"@type":88,"width":89,"height":90},"https://docshare.wps.com/thumbnails/prioritising-the-prioritised-a-framework-to-prioritise-cyber-security-priorities/202699.png","ImageObject",300,407,{"name":92,"@type":93},"McQueen","Person",{"url":74,"name":95,"@type":96},"DocShare","Organization","application/pdf","2026-10-30","2026-09-04",true,{"@type":102,"interactionType":103,"userInteractionCount":52},"InteractionCounter",{"@type":104},"ViewAction",{"@type":106,"mainEntity":107},"FAQPage",[108],{"name":109,"@type":110,"acceptedAnswer":111},"Can a high-risk ranking alone be enough to decide cyber security priority?","Question",{"text":112,"@type":113},"The material frames priority selection as multi-factor evaluation, since considerations like finance/resource availability, compliance, and business value can be important alongside risk.","Answer","https://schema.org",{"og:url":83,"og:type":116,"og:title":65,"og:site_name":95,"og:description":67},"article",{"robots":118,"canonical":83},"index,follow",{"doc_id":120,"site_id":62},202699,1788550201,{"code":4,"msg":5,"data":123},{"doc_id":120,"user_id":124,"nickname":92,"user_avatar":125,"doc_module":4,"category_id":39,"category_name":40,"doc_title":65,"doc_description":67,"doc_content":126,"file_id":127,"file_url":128,"file_type":129,"file_size":130,"view_count":52,"is_deleted":4,"is_public":8,"is_downloadable":8,"audit_status":8,"page_count":131,"language":132,"language_code":63,"site_id":62,"html_lang":63,"table_of_contents":133,"faqs":134,"seo_title":135,"seo_description":67,"update_tm":121,"read_time":136,"preview_page_count":4},5909890329169,"https://ap-avatar.wpscdn.com/davatar_9964176cb1d06d4a9deccf72a44ae3dc","Faisal Khan  \nM. Phil. (Cyber Security UQ)  \nCISSP, CISM, CISA  \nEx-Director Cyber Security QLD Government  \nPrioritising the prioritised  \n(A framework to prioritise cyber security priorities)  \n• John has just joined Company ABC to lead the cyber security function  \n• There is a long list of Reds (high risk) that need to be addressed.  \n• There are several competing initiatives across the enterprise and the Board has asked John to review all the identified cyber security initiatives and come up with a list of only 5 priorities to keep company ABC safe.  \n• John is wondering where to start from…  \nJohn needs help  \nHow can we help John?  \nHow to select the top ones from many cybersecurity priorities where everything is high-risk, urgent, and important  \n John has 30 “high” ranking risks to address so where he can start?  \n Can “high” risk ranking alone be enough to decide the priority of a cybersecurity initiative?  \n Is finance the only other consideration or the availability of resources is even more important?  \n John’s organisation operates in a regulated environment, so how about compliance to take into account?  \nPrioritising the prioritised  \nPrioritisation  \n/prʌɪˌɒrətʌɪˈzeɪʃ(ə)n/  \nPrioritisation is the activity that arranges items or activities in order of importance relative to each other.  \nFramework: Prioritising the prioritised  \nPresented here is a framework to enable the decision making process to prioritise the already prioritised cybersecurity initiatives, that is repeatable and defendable across its lifecycle.  \n9 Factors of the Prioritisation Framework  \nCurrent Maturity  \nTarget Maturity  \nReadiness to implement  \nEffort Size  \nPre-req for others  \nCompliance requirement  \nBusiness Value  \nRisk if not implemented  \nFinancial outlay  \n9 Factors Explanation  \nAssessed current level of maturity of a capability (using an approved, agreed-upon framework)  \nIdentified target level of maturity of a capability (using an approved, agreed-upon framework)  \nA measure of readiness of our people, processes and technologies to implement a capability  \nHow much effort is required to implement a capability  \nHow much one or more capabilities depend upon a capability  \nA measure of how much a capability is required for compliance with applicable regulation(s), policies, audit recommendations and governance forums' advice  \nHow much value the capability can deliver for business e.g. enablement or solving a problem.  \nWhat is the level of risk if the capability is not established  \nHow much finance is needed to implement a capability.  \nColour Coding   \nRed or Green: High and Low ranking of a factor could be depicted as Green, or Red based on its favourable or unfavourable relevance to an initiative for its prioritisation over others.  \nFor instance,  \n- an organisation wants to establish a vulnerability management capability,  \n- their current maturity is Low; this factor (i.e. current maturity) could be colour-coded Green  \n- as, the low maturity of this capability makes it a good candidate to get organisation’s attention.  \n- Similarly, if the target maturity for this capability is High; this factor (i.e. target maturity) could also be colour-coded Green because there is a sizable gap between the current maturity and the target maturity that requires due consideration.  \nOrange: Medium ranking is always depicted as Orange showing that the factor possesses neither too favourable nor too unfavourable relevance to an initiative.  \nIn summary, the greener the factors are, the higher the priority of an initiative is.  \nCurrent Maturity  \nTarget Maturity  \nReadiness to implement  \nEffort Size  \nPre-req for others  \nCompliance requirement  \nBusiness Value  \nRisk if not implemented  \nFinancial outlay  \nFactors with recommended colour-coding  \nAssessed current level of maturity of a capability (using an approved,  \nagreed-upon framework)  Low   Medium   High   \nIdentified target level of maturity of a capability (using an approve","cbCaiva19VabbRlW","https://ap.wps.com/l/cbCaiva19VabbRlW","pdf",801169,11,"English","# Prioritising the Prioritised\n## Prioritisation and Framework Purpose\n## 9 Factors of the Prioritisation Framework\n## 9 Factors Explanation\n## Colour Coding\n## Final Output of the Framework","[{\"question\":\"Can a high-risk ranking alone be enough to decide cyber security priority?\",\"answer\":\"The material frames priority selection as multi-factor evaluation, since considerations like finance/resource availability, compliance, and business value can be important alongside risk.\"}]","Prioritising the Prioritised - A Framework to Prioritise Cyber Security Priorities | PDF",28]