<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

# Program Strategy Development Reference

Deep reference for security program charters, maturity models, and multi-year roadmaps.
Parent skill: [../SKILL.md](../SKILL.md)

---

## Program Charter Template

A security program charter defines mission, scope, authority, and accountability. It is the foundational document signed by executive leadership.

### Charter Sections

```
1. MISSION STATEMENT
   One sentence: what the security program exists to accomplish.
   Example: "Protect [company] assets, data, and reputation by identifying,
   preventing, detecting, and responding to security threats."

2. SCOPE
   - Business units covered (all, or phased rollout)
   - Asset types: endpoints, cloud infrastructure, SaaS, OT/IoT
   - Regulatory scope: PCI, HIPAA, SOX, GDPR, etc.
   - Exclusions (if any) with justification

3. AUTHORITY & REPORTING
   - CISO reports to: CTO / CRO / CEO / Board
   - Budget authority: direct budget line vs. allocated from IT
   - Escalation path for risk acceptance decisions
   - Board reporting cadence (quarterly minimum)

4. STRATEGIC OBJECTIVES (3-year)
   - Year 1: Foundation (visibility, baseline controls, team)
   - Year 2: Maturity (detection, response, compliance)
   - Year 3: Optimization (metrics-driven, proactive threat hunting)

5. KEY STAKEHOLDERS
   | Stakeholder | Role | Engagement |
   |------------|------|-----------|
   | CEO/Board | Risk oversight | Quarterly briefing |
   | CTO | Architecture alignment | Monthly sync |
   | Legal | Regulatory compliance | Incident notification |
   | HR | Insider threat, awareness | Quarterly program |
   | Business units | Risk ownership | Annual risk review |

6. SUCCESS METRICS
   - MTTD, MTTR reduction targets
   - Compliance posture (audit findings trend)
   - Coverage metrics (ATT&CK, CIS benchmark %)
   - Security culture score (phishing simulation rate)
```

---

## Maturity Models

### Capability Maturity Model for Security (CMM-S)

| Level | Name | Characteristics |
|-------|------|----------------|
| 1 | Initial | Ad hoc, reactive, no formal processes |
| 2 | Developing | Basic policies exist, some tools deployed, siloed |
| 3 | Defined | Documented processes, roles assigned, metrics starting |
| 4 | Managed | Metrics-driven, integrated across business, proactive |
| 5 | Optimizing | Continuous improvement, threat-informed, automated |

### Assessment Domains

Score each domain 1–5 independently:

| Domain | Level 1 Indicators | Level 5 Indicators |
|--------|-------------------|-------------------|
| Governance | No policy | Board-approved, annually reviewed, risk-aligned |
| Asset Management | Incomplete inventory | Real-time CMDB, auto-discovered, risk-scored |
| Access Control | Shared accounts | ZTA, PAM, JIT access, continuous auth |
| Detection | No SIEM | 24/7 SOC, behavioral analytics, purple team validated |
| Incident Response | No plan | Tested quarterly, automated playbooks, < 1hr MTTR |
| Vulnerability Mgmt | Infrequent scans | Continuous, risk-prioritized, SLA-tracked |
| Security Culture | No training | Continuous, measured, department-specific |
| Third-party Risk | No assessments | Continuous monitoring, contractual SLAs |

### Maturity Radar Chart

Plot each domain score on a radar chart to visualize the program's shape.
Imbalanced profiles (e.g., strong detection but weak governance) indicate
strategic misalignment.

---

## 3-Year Roadmap Planning Framework

### Phase Model

```
Year 1: FOUNDATION                Year 2: MATURITY               Year 3: OPTIMIZATION
─────────────────                ────────────────                ──────────────────
├─ Asset inventory               ├─ SIEM deployment              ├─ Threat hunting program
├─ Risk assessment               ├─ Detection engineering         ├─ Purple team exercises
├─ Policy framework              ├─ IR playbook testing           ├─ Security metrics dashboard
├─ Endpoint protection           ├─ Vuln mgmt SLAs               ├─ Automated compliance
├─ Identity baseline             ├─ Security awareness v2         ├─ Risk quantification (FAIR)
├─ Hire core team (3-5)          ├─ Hire specialists (5-8)        ├─ Hire advanced (8-12)
├─ CIS Level 1 controls          ├─ CIS Level 2 + cloud          ├─ ATT&CK coverage > 60%
└─ Compliance gap analysis       └─ First compliance audit        └─ Continuous compliance
```

### Roadmap Governance

| Element | Cadence | Owner |
|---------|---------|-------|
| Roadmap review | Quarterly | CISO + leadership |
| Milestone tracking | Monthly | Security program manager |
| Budget review | Quarterly | CISO + CFO |
| Risk register update | Monthly | Risk manager |
| Board reporting | Quarterly | CISO |

### Budget Allocation Guidelines

| Category | Year 1 | Year 2 | Year 3 |
|----------|--------|--------|--------|
| People | 50% | 45% | 40% |
| Technology | 30% | 35% | 35% |
| Training & certs | 10% | 10% | 10% |
| Consulting/audit | 10% | 10% | 15% |

---

## Business Alignment Methodologies

### Risk-Based Prioritization

Map security initiatives to business risk:

```
Business Risk Register
  ├── Risk: Customer data breach (impact: $50M, likelihood: medium)
  │   └── Security initiative: DLP deployment, encryption, access review
  ├── Risk: Ransomware disruption (impact: $20M, likelihood: high)
  │   └── Security initiative: EDR, backup validation, IR rehearsal
  └── Risk: Compliance failure (impact: $10M fine, likelihood: medium)
      └── Security initiative: Audit remediation, policy updates
```

### Value Communication Framework

Translate security into business language:

| Security Metric | Business Translation |
|----------------|---------------------|
| MTTD reduced from 72h → 4h | "We find breaches 18× faster, limiting data exposure" |
| 95% patch compliance | "95% of known vulnerabilities closed before exploit" |
| 0 critical audit findings | "Clean audit = no regulatory fines or sanctions" |
| Phishing click rate 2% | "Employee awareness reduced social engineering risk by 85%" |

### Executive Reporting Template

```
QUARTERLY SECURITY POSTURE REPORT
──────────────────────────────────
Risk Score:     [7.2 / 10] → [6.1 / 10] (improvement)
Key Wins:       3 critical vulnerabilities remediated, IR plan tested
Active Risks:   Legacy system EOL, third-party vendor gap
Budget Status:  On track (92% utilized)
Next Quarter:   SIEM deployment, security awareness refresh
Ask:            Approve $X for [initiative]
```
