Delinea: Cybersecurity goals: How to set and achieve them

Cybersecurity goals are critical for your success as a cybersecurity leader.

The rapid proliferation of digital technologies and the growing sophistication of cyber threats have elevated the need to establish robust cybersecurity performance goals that are measurable and follow cybersecurity best practices. Cybersecurity goals, coupled with well-defined, actionable objectives, serve as the foundation of a comprehensive cybersecurity strategy.

For your cybersecurity team, setting goals and objectives communicates expectations and helps them understand how their work impacts the bigger picture. This leads to higher engagement, motivation, and productivity.

They also provide a framework for your communication with leadership and your board of directors. When you align your cybersecurity with business goals, you’ll be more likely to gain buy-in, budget, and a seat at the executive table. Once you’ve gained agreement on your goals, you can refer to them in every briefing and report so you can track performance, show measurable progress, and demonstrate the value of your cybersecurity program.

In this blog post, we’ll delve into cybersecurity goals and discuss how they’re vital to improving your cyber resilience. We’ll walk through examples of cybersecurity goals so you can see how they work in practice and be able to set or adjust your own, increasing cyber resilience and ensuring business continuity.

What’s the difference between cybersecurity goals and cybersecurity objectives?

Cybersecurity goals and cybersecurity objectives aren’t the same. Let’s define them to demonstrate the difference.

• Cybersecurity goals: Broad statements of intent outline the organization's overall aspirations for cybersecurity. For example, your cybersecurity goals likely aim to protect sensitive data, ensure system integrity, minimize cyber risks, comply with industry regulations, and cultivate cyber awareness.
  
  
• Cybersecurity objectives: Describe how an organization will achieve its cybersecurity goals. Compared to cybersecurity goals, cybersecurity objectives are more specific, measurable, and time-bound. Usually, they are broken into smaller, manageable activities focused on cybersecurity performance.

Put another way, cybersecurity goals are where you want to be, while cybersecurity objectives outline how to get there. The table below provides more detail about cybersecurity goals vs. objectives.

A closer look at cybersecurity goals vs. cybersecurity objectives:

What should I consider when setting cybersecurity goals?

Imagine you’ve been tasked with setting cybersecurity goals to improve your organization’s security posture. Where do you start? What must you consider?

Start with a checklist of questions. Your answers will help you understand your company’s needs and the resources you have available so you can then formalize your goals and objectives. Here are key questions to consider:

1. How do cybersecurity goals align with our overall business strategy?
   
   Find out what systems and processes are most important to your company to drive revenue, deliver service to customers, and fulfill promises. For example, a hospital’s primary cybersecurity focus may be on preventing access to systems on which patients’ lives depend, whereas a financial institution may be more concerned about the theft of credit card details. Understanding those business strategies will help you prioritize where you put your cybersecurity resources and how you measure cybersecurity performance.
   
   Ensuring your cybersecurity goals are in lock-step with your business goals will reinforce the message that cybersecurity is there to bolster business sustainability and success. Any disconnect will make buy-in from stakeholders and decision-makers difficult to obtain.
   
   
2. What are my company’s most critical assets to protect?
   
   Identify the most valuable and sensitive data, systems, and assets within your organization. This helps you focus your cybersecurity efforts on what matters most.
   
   
3. How mature is our current cybersecurity posture?
   
   Assess your organization's current cybersecurity performance and capabilities by benchmarking them against established control frameworks (NIST, CIS, etc.), maturity models, and industry peers. This helps you establish a baseline of your current state before you set goals for a future state. For example, you could benchmark your organization’s current Privileged Access Management (PAM) capabilities against the PAM Maturity Model to see where you place.
   
   
4. What cybersecurity risk scenarios do we expect to face, and how well can we address them?
   
   Determine the likely risk scenarios your organization will encounter. You can base this on recent cyberattacks your industry peers have faced and the impact of successful attacks on their operations and finances. Reflect on any past cybersecurity incidents or breaches at your company to see what lessons can inform your goal-setting process. Industry analysis and resources like the Verizon Data Breach Investigations Report can help you learn lessons from other companies.
   
   Perform a comprehensive risk assessment to see how well your current security controls and processes would help you combat those risks. This will help you identify vulnerabilities or gaps in your current program that need to be addressed through well-defined cybersecurity objectives, such as adding or adjusting controls.
   
   You could base your assumptions of the cost of a cyberattack on third-party data like the IBM/Ponemon report, or calculate your risk scenarios through Cyber Risk Quantification (CRQ). This can help you prioritize the risks you must address in your cybersecurity objectives.
   
   Understand how achieving your cybersecurity goals will affect your organization's overall risk profile. Will it reduce certain risks? How will it contribute to overall security?
   
   
5. What compliance and regulatory requirements do we need to meet?
   
   Determine the relevant industry standards, regulations, and compliance requirements that your organization must adhere to. Make sure your cybersecurity program can provide evidence of cybersecurity performance to demonstrate how you meet those obligations.
   
   
6. What resources (budget, personnel, technology) are available for implementation?
   
   No cybersecurity organization has all the budget or resources they would like. You’ll need to make tradeoffs among tough choices. This is why defining and prioritizing realistic cybersecurity goals and objectives is so important. For example, perhaps you can’t meet certain cybersecurity objectives this year due to budget or a hiring freeze, but you can focus on the highest priorities now and plan for additional objectives next year.
   
   
7. Who is involved in delivering results to meet your cybersecurity goals?
   
   Identify the individuals and teams responsible for implementing and overseeing cybersecurity initiatives. Ensure they are involved in the goal-setting process so they understand when and how their performance will be measured. You’ll want to align cybersecurity performance objectives with their overall performance objectives so they understand the connection and have incentives to carry these goals out.
   
   
8. What considerations are important for my timeline?
   
   Determine a realistic timeframe for short-term cybersecurity objectives to meet long-term cybersecurity goals. You’ll need to consider how long it could take to hire employees, vet new vendors, and implement new software you decide to purchase. There also may be factors that influence your timeline that are outside your control, such as the company’s product launch plans, partnership agreements, or budget cycles.
   
   
9. How will we communicate the goals throughout the organization?
   
   Develop a communication plan to ensure that all relevant teams and individuals know the cybersecurity goals and objectives, their importance, and their roles in achieving them.

Communicating cybersecurity goals and objectives will foster a culture of security awareness and responsibility throughout your organization. By addressing these questions, you can ensure that your cybersecurity goals are well-informed, relevant, and strategically aligned, setting the stage for effective implementation and enhanced cybersecurity.

That said, recognize that the cybersecurity landscape is constantly evolving. Develop a strategy for regularly reviewing and adapting your goals and objectives to address new and emerging threats and any other changes that impact your risk profile, budget, and resources.

8 examples of cybersecurity goals and objectives

To help you build your own plan, here are some examples of common cybersecurity goals and objectives. In each example, note the difference between goals and objectives, as well as the associated security activities and the importance of a timeline.

Example 1. Data Protection and Privacy:

• Goal: Enhance privacy and protection of sensitive, confidential data. 
• Objectives:
  1. Implement end-to-end encryption for all sensitive customer data by [specific date].
  2. Regularly audit and update data access permissions to prevent unauthorized data exposure.

Example 2. User Authentication and Access Control:

• Goal: Enhance user authentication and access control mechanisms to prevent unauthorized access.
• Objectives:
  1. Implement Multi-Factor Authentication (MFA) for all privileged accounts by [specific date].
  2. Implement role-based access controls (RBAC) to limit user access to critical systems and data by [specific date].

Example 3. Employee Training and Security Awareness:

• Goal: Foster a culture of security awareness and ensure all employees are well-informed about cybersecurity best practices.
• Objectives:
  1. Provide mandatory cybersecurity training for all employees by [specific date].
  2. Conduct quarterly simulated phishing exercises to improve employees' ability to recognize phishing attempts, starting by [specific date].

Example 4. Network Security and Perimeter Defense:

• Goal: Strengthen network security by implementing advanced perimeter defense mechanisms. 
• Objectives:
  1. Upgrade to next-generation firewalls with intrusion prevention systems by [specific date].
  2. Conduct annual penetration testing to identify and remediate vulnerabilities, starting by [specific date].

Example 5. Compliance and Regulatory Adherence:

• Goal: Achieve and maintain compliance with relevant industry standards and regulations.
• Objectives:
  1. Obtain [specific certification, e.g., ISO 27001] certification by [specific date].
  2. Establish a continuous process to ensure ongoing compliance, starting by [specific date].

Example 6. Privileged Access Management (PAM):

• Goal: Strengthen PAM practices to prevent unauthorized access to critical systems and data.
• Objectives:
  1. Implement a robust PAM solution for managing privileged accounts by [specific date].
  2. Conduct quarterly reviews to confirm and update PAM policies and controls by [specific date].

Example 7. Cloud Security and Data Management:

• Goal: Ensure secure adoption of cloud services while effectively managing data in the cloud environment. 
• Objectives:
  1. Implement cloud security best practices and ensure data encryption for all cloud-stored data by [specific date].
  2. Audit cloud service providers for compliance and security at least annually, starting by [specific date].

Example 8. Business Continuity and Disaster Recovery:

• Goal: Enhance business continuity and disaster recovery capabilities to minimize downtime and data loss.
• Objectives:
  1. Develop and test a comprehensive disaster recovery plan by [specific date].
  2. Conduct mock disaster recovery drills at least quarterly, and update the plan as needed by [specific date].

Your cybersecurity goals and objectives will change as your organization grows

While many cybersecurity goals are based on established best practices and are common across all types of organizations, they can vary based on organization size. Typically, smaller companies have different priorities and challenges from larger ones. Certainly, specific cybersecurity objectives will vary to meet different budgets and resources.

Small and medium-sized businesses (SMBs) often start with foundational cybersecurity goals, such as implementing basic cybersecurity measures, like firewalls, antivirus software, and secure password policies. Their primary concern is establishing a baseline level of protection. Budget constraints may drive cybersecurity goals for SMBs. Goals might include maximizing the impact of limited resources, leveraging affordable but effective security solutions, and outsourcing certain security functions to managed service providers.

Given their relatively smaller workforce, SMBs may prioritize cybersecurity awareness and training programs to ensure employees are well informed about potential threats and best practices.

As the company grows, cybersecurity programs must scale

As the company grows, cybersecurity programs must scale, including goals and objectives. Goals must include formalizing policies, procedures, and incident response plans to address a wider range of threats.

With more people on the team, IAM becomes a priority. Goals may involve implementing Multi-Factor Authentication (MFA), Single Sign-On (SSO), and Role-based Access Controls  (RBAC) to manage user privileges effectively.

In larger companies, goals and objectives for cybersecurity performance start to be tracked in more detail and through technology. Companies may set goals to enhance their threat detection capabilities through SIEM solutions, threat intelligence integration, and faster incident response times. They start to measure goal attainment with Service Level Agreements (SLAs).

At the enterprise level, companies have the capacity to cover numerous aspects of cybersecurity, often managed by multiple teams and vendors. For example, larger budgets enable enterprises to invest in emerging technologies like Zero Trust Architecture, secure cloud adoption, and IoT security.

Large companies often establish sophisticated Security Operations Centers (SOCs) and Security Incident Response Teams (SIRTs) to monitor, detect, and respond to complex threats in real time. Goals may include proactive threat hunting, leveraging advanced analytics, machine learning, and AI to identify hidden threats and vulnerabilities.

Enterprises operating across multiple jurisdictions must manage complex data protection laws and regulations. Therefore, goals for larger companies likely include global compliance, data localization, and addressing cross-border data transfer challenges.

At this stage of growth, it’s important to have some goals that every member of the cybersecurity team is tied to, as well as specific goals for different functions and team members. Tracking progress toward cybersecurity performance and goal attainment requires a more sophisticated system, often connected to other Human Resources, management, and learning and development resources.

While the specific goals may differ, the underlying principles of effective cybersecurity—risk management, continuous improvement, user awareness, and collaboration—apply to organizations of all sizes. Tailoring goals to address the unique challenges and opportunities of each size category ensures that cybersecurity efforts are optimized to protect valuable assets and secure the digital future.

No matter the size of your business, I highly recommend you download our eBook Cybersecurity for Dummies and share it with your entire team--it's a quick read and will boost cyber hygiene company-wide.

Measuring success: How do I know if I’m achieving my cybersecurity goals and objectives?

Measuring cybersecurity performance and progress toward your organization’s goals is critical to your success. Research has shown that when metrics are mismatched between business and cybersecurity goals, your security posture and your company suffer.

Key Performance Indicators (KPIs) measure cybersecurity activities completed as well as their effectiveness and impact on reducing risk. They provide insights into performance and the organization's ability to defend against cyber threats.

Here are some KPIs commonly used to measure cybersecurity performance goals:

Time to Detect (TTD): This KPI measures the time taken to detect a cybersecurity incident from the moment it occurs. A lower TTD indicates a more proactive and efficient detection capability, allowing for quicker responses and mitigations.

Time to Respond (TTR): Measures the time taken to respond to and contain a cybersecurity incident once it has been detected. A shorter TTR indicates that the organization can quickly mitigate the impact of security breaches.

Number of security incidents: Tracking the number of security incidents over time helps gauge the overall security posture. A declining trend may indicate improved security measures, while an increasing trend may signify potential gaps.

Percentage of successful phishing simulations: Regularly conducting phishing simulations and tracking the percentage of successful attempts helps assess the effectiveness of security awareness training and the organization's resilience against phishing attacks.

Patch management compliance: Measures the organization's ability to promptly apply security patches to systems and software vulnerabilities. High patch management compliance indicates better protection against known exploits.

Number of access control violations: Monitoring the number of access control violations helps identify potential security weaknesses and incidents of unauthorized access.

Security awareness training completion rate: The percentage of employees who complete security awareness training indicates how well the organization is educating its workforce about cybersecurity best practices.

Percentage of devices with updated antivirus software: This KPI tracks the percentage of devices that have up-to-date antivirus software installed, helping assess the organization's readiness against malware threats.

Mean Time Between Failures (MTBF): Measures the average time between cybersecurity incidents or breaches. A higher MTBF indicates a more robust security program.

Mean Time to Recover (MTTR): Measures the average time taken to recover from a cybersecurity incident. A shorter MTTR indicates a more effective incident response and recovery process.

Security Policy Compliance Rate: Monitoring the organization's adherence to established security policies helps ensure that security practices are followed consistently.

Risk reduction percentage: Quantifies the percentage of risk reduction achieved over a specific period due to cybersecurity measures and investments.

It's important to customize KPIs based on your organization's specific goals, risks, and industry. Regularly reviewing and analyzing these KPIs can help you identify areas for improvement, measure the impact of security initiatives, and demonstrate the value of your cybersecurity program to stakeholders.

Get going on your goals!

As you set and achieve cybersecurity goals, remember that achieving optimal security is not a destination but a continuous quest. With a steadfast commitment to ongoing assessment, adaptation, and improvement, your organization can navigate this journey, embracing the challenges and triumphs of securing the digital realm.

As you move forward, each step you take brings you closer to the pinnacle of cybersecurity resilience, strengthening your organization's ability to thrive in an increasingly interconnected world.