Process to Identify Business Needs
Comparing risk to business needs ensures that security measures align with organizational priorities, balancing protection efforts against operational goals and acceptable risk levels.
5 slides · 2 min read · Domain 8
Business needs are all the processes and activities required to run a business and make it profitable. As security professionals, our role is only that of advisors. Security does not dictate what the business does; it merely allows the business to operate safely and securely. However, if the business decides on a course of action, an area of operation, or a means to deliver the business requirements, then that is what the business will do.
Security professionals must understand business drivers, then evaluate the associated risks by whatever means are at their disposal and recommend a course of action to mitigate these risks.
A business follows four basic steps to identify its needs:
1. Discover. The business will use questionnaires and working groups to consult its stakeholders about:
- What they do
- What they think they provide to the business
- What tools they might use to accomplish end goals
2. Evaluate. The business will thoroughly evaluate the responses. Leaders often struggle to articulate clearly what they do and how they do it. As a result, the given responses may be wrong.
3. Agree. Based on the evaluated responses, the business will make assumptions to reconcile its thinking with those of the stakeholders. If all parties agree, the business can produce a business plan.
4. Document. The business should record the process and plan. The plan will become the working model for the business.
2. Evaluate. The business will thoroughly evaluate the responses. Leaders often struggle to articulate clearly what they do and how they do it. As a result, the given responses may be wrong.
3. Agree. Based on the evaluated responses, the business will make assumptions to reconcile its thinking with those of the stakeholders. If all parties agree, the business can produce a business plan.
4. Document. The business should record the process and plan. The plan will become the working model for the business. This is a basic overview of the steps a business might take. Naturally, business needs will change over time. Perhaps the business will expand, contract, or move into different business areas. Maybe it will add or remove geographical locations. Maybe it will make other types of changes.
However, this process does not consider risk. It reflects what the business says it needs. In most cases, the security team, except for the security architect, is not involved in these discussions. Instead, once a decision has been reached and implemented, it falls to the security team to ensure the business plan is secure.