<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->

---
technique: implementing-security-roadmap-planning
subdomain: security-leadership
title: "Implementing Security Roadmap Planning"
tags:
  - roadmap
  - strategic-planning
  - program-management
  - prioritization
  - OKRs
metadata:
  mitre-attack: []
---

# Implementing Security Roadmap Planning

> Develop strategic security roadmaps that align security initiatives with business objectives, risk priorities, and resource constraints.

## Overview

Security roadmap planning translates risk assessments and business objectives into a prioritized, time-bound plan of security initiatives. This technique covers stakeholder alignment, initiative scoring, resource planning, and progress tracking for security programs.

## Core Concepts

- **Risk-driven prioritization**: Score initiatives by risk reduction impact and feasibility
- **Business alignment**: Map security initiatives to business objectives and revenue impact
- **Capacity planning**: Match initiative scope to available team bandwidth and budget
- **Milestone tracking**: Define measurable milestones with clear success criteria
- **Dependency mapping**: Identify initiative dependencies and critical path items

## Workflow

1. Gather inputs: risk assessment, audit findings, business strategy
2. Identify candidate security initiatives from all input sources
3. Score initiatives using risk-impact and feasibility matrix
4. Align top initiatives with business objectives and OKRs
5. Estimate resource requirements and timeline for each initiative
6. Map dependencies between initiatives and external projects
7. Build phased roadmap with quarterly milestones
8. Review roadmap with stakeholders and incorporate feedback
9. Publish roadmap and establish progress tracking cadence
10. Review and adjust roadmap quarterly based on threat landscape changes

## Implementation

```python
from dataclasses import dataclass, field
from enum import Enum
from typing import Optional


class InitiativeStatus(Enum):
    PLANNED = "planned"
    IN_PROGRESS = "in_progress"
    COMPLETED = "completed"
    DEFERRED = "deferred"


@dataclass
class SecurityInitiative:
    name: str
    description: str
    risk_score: float
    feasibility_score: float
    effort_weeks: int
    quarter: str
    status: InitiativeStatus = InitiativeStatus.PLANNED
    dependencies: list[str] = field(default_factory=list)
    business_objectives: list[str] = field(default_factory=list)

    @property
    def priority_score(self) -> float:
        return round(self.risk_score * 0.6 + self.feasibility_score * 0.4, 2)


class SecurityRoadmap:
    """Strategic security roadmap planning and tracking."""

    def __init__(self, fiscal_year: str) -> None:
        self.fiscal_year = fiscal_year
        self.initiatives: list[SecurityInitiative] = []

    def add_initiative(self, initiative: SecurityInitiative) -> None:
        self.initiatives.append(initiative)

    def prioritized_view(self) -> list[SecurityInitiative]:
        return sorted(self.initiatives, key=lambda i: i.priority_score, reverse=True)

    def quarter_view(self, quarter: str) -> list[SecurityInitiative]:
        return [i for i in self.initiatives if i.quarter == quarter]

    def progress_summary(self) -> dict:
        total = len(self.initiatives)
        completed = sum(1 for i in self.initiatives if i.status == InitiativeStatus.COMPLETED)
        in_progress = sum(1 for i in self.initiatives if i.status == InitiativeStatus.IN_PROGRESS)
        return {"total": total, "completed": completed, "in_progress": in_progress, "completion_rate": completed / total if total else 0}
```

## Best Practices

- Build roadmaps in 90-day increments—annual plans are too rigid for security
- Score every initiative against risk reduction—avoid pet projects without risk justification
- Include 20% buffer for incident response and emerging threats
- Track roadmap progress with the same rigor as product delivery
- Present roadmap to board in business-risk language, not technical jargon
- Review and reprioritize quarterly based on threat intelligence and incident data

## Initiative Prioritization Criteria

| Criterion | Weight | Scoring |
|---|---|---|
| Risk reduction potential | 35% | 1-5: estimated reduction in likelihood × impact |
| Regulatory / compliance requirement | 25% | 5 = mandatory, 1 = nice-to-have |
| Cost and effort | 20% | 5 = low cost, 1 = high cost relative to benefit |
| Strategic alignment | 10% | Alignment with business goals this quarter |
| Quick win value | 10% | 5 = visible in 30 days, 1 = 12+ month payoff |

## Roadmap Phases

| Phase | Duration | Focus | Key Deliverables |
|---|---|---|---|
| Foundation | Q1 | Visibility, hygiene, critical fixes | Asset inventory, patching SLA, MFA rollout |
| Hardening | Q2–Q3 | Defense-in-depth, detection maturity | EDR full coverage, SIEM tuning, IR playbooks |
| Optimization | Q4 | Automation, metrics, program maturity | SOAR deployment, risk scoring dashboard |
| Innovation | Year 2+ | Advanced capabilities, proactive security | Threat hunting, red team, supply chain program |

## Related Techniques

- [Performing Security ROI Analysis](../performing-security-roi-analysis/SKILL.md)
- [Performing Security Program Review](../performing-security-program-review/SKILL.md)
