ACW Soft Solutions

Cybersecurity strategy and risk planning

Decide which security risks need attention and how the work should be owned and sequenced. ACW helps teams assess the current situation and turn findings into a roadmap with named decisions and dependencies.

Contact Us

Address the risks behind competing requests

Security work can arrive as isolated tool purchases, urgent fixes, and customer questions. Start by identifying the business services, information, and access paths involved. Separate confirmed findings from assumptions that need technical investigation.

The strategy should explain what deserves funding, what can wait, and which unresolved risks require an owner’s decision.

Build the plan around four decisions

  • Risk assessment

    Review important systems, dependencies, available findings, and existing controls. Record the evidence and uncertainty behind each priority.

  • Security priorities

    Compare potential business impact and exposure. Identify immediate work, planned improvements, and issues requiring further assessment.

  • Governance and ownership

    Assign responsibility for approving changes, accepting residual risks, and following up on overdue work.

  • Security roadmap

    Sequence actions around delivery capacity, operating constraints, and dependencies. Describe the intended result of each phase.

What the engagement produces

  • A scoped current-state assessment and list of information gaps.

  • A risk register with evidence, priorities, and owners.

  • A target set of security outcomes for the agreed systems.

  • A roadmap with dependencies and verification requirements.

From assessment to an owned plan

  1. Step 01.

    Establish the context

    Review the systems, data, business services, existing policies, and concerns with responsible stakeholders.

  2. Step 02.

    Compare current and intended controls

    Identify gaps without treating a missing document and a demonstrated technical exposure as the same finding.

  3. Step 03.

    Plan the work

    Agree priorities, owners, resources, and decisions that block progress. Name the evidence needed to consider each action complete.

  4. Step 04.

    Set the review rhythm

    Define when the roadmap is revisited and who updates it after system changes or new findings.

Make the roadmap usable

Each action should have an owner, affected systems, a reason for its priority, and a completion check. Unknowns remain explicit. The plan should distinguish assessment work from implementation and identify risks the organisation has chosen to retain.

This is an example of a possible engagement, not an ACW client result.

Illustrative planning question: customer access

A team needs to review how staff access customer information. The plan separates account inventory, permission review, technical verification, and follow-up changes. Each task has an owner; unanswered questions lead to investigation rather than an unsupported assurance.

Questions before planning

Is this a penetration test?

No. Strategy establishes priorities and a roadmap. Technical tests can supply evidence through a separately defined assessment.

Can you use our existing findings?

Yes, after reviewing their scope, age, and evidence. Older findings may require confirmation against the current system.

Does the roadmap establish compliance?

It can organise work against named requirements. A planning document does not by itself demonstrate that controls operate or provide certification.

Explore related services

Bring your security priorities into one plan

Share the systems involved, existing findings, and the decisions your team needs to make.

Contact Us