Information Security Should Fit the Business

Information security is often associated with extensive policies, technical solutions and significant investment. It is understandable, then, that business leaders ask how much security their organisation actually needs—and how much of it they can realistically put in place.

A startup with a small team may handle highly sensitive information or depend heavily on a handful of cloud services. A large enterprise may have established security structures and still have significant weaknesses or areas that need improvement.

Company size tells us only so much about what an appropriate security approach looks like. The starting point is the business itself.

The questions are similar. The answers are not.

Whatever its size, an organisation needs to understand what matters most. Which information, systems and processes need protecting? Where are the critical dependencies? What would a disruption or security incident mean for the business? And which regulatory, contractual or customer requirements apply?

For an early-stage business, a few well-judged decisions may establish a sound foundation. As the company grows, new systems, integrations and dependencies appear. Responsibilities need to become clearer, and informal ways of working may no longer be sufficient.

A large organisation faces different challenges. Security measures may already be plentiful; the greater opportunity may lie in improving processes, clarifying ownership or connecting security functions more effectively.

That is why a sensible security approach begins with an understanding of the organisation rather than an exhaustive list of controls.

You cannot do everything at once. Priorities matter.

Most organisations have no shortage of potential security improvements. The difficult part is deciding what deserves attention first.

Budgets, time and specialist capacity are limited. Technology cannot always be replaced quickly, and organisational change takes time. Security maturity and company culture also shape what can be implemented successfully.

Taking these constraints seriously does not mean abandoning necessary security objectives. It means finding a credible path towards them.

Suppose a review of the current security posture identifies twenty relevant areas for improvement, but the organisation can address only five in the near term. The other fifteen still matter, and their risks must remain visible and be managed consciously. Some may be reduced through interim measures; others may need more resources or time. In certain circumstances, explicit risk acceptance may be appropriate. Binding legal and contractual obligations still have to be met.

To me, this is pragmatic information security: making sound security decisions that work in the organisation as it actually operates.

The same applies to quick wins. A quick win is worthwhile when it reduces a meaningful risk with a proportionate amount of effort.

Prioritisation should therefore consider more than the technical severity of a risk. The potential financial, operational and reputational impact on the business also matters, as does the effort required to reduce that risk effectively.

A more useful question than “How much security can we implement?” is often: Where can our available resources make the most meaningful difference first?

An ISMS is not the same as certification

An information security management system does not have to be fully developed from day one. It can start with a clear structure and develop systematically over time. Risks need to be assessed in a consistent and traceable way, responsibilities defined, appropriate controls planned and their effectiveness reviewed.

Step by step, this can develop into a complete and effective ISMS that reflects the organisation and its requirements.

The assumption that an ISMS inevitably means a major ISO/IEC 27001 certification programme can create an unnecessary barrier, particularly for smaller or less formal organisations.

An organisation can begin building an ISMS without immediately pursuing certification. The pace and level of detail depend on the organisation, its risks, requirements and available resources. What matters is having a clear target state and planning the path towards it deliberately.

Formal certification to ISO/IEC 27001 is a separate matter. It may be commercially valuable, driven by customer requirements or necessary for particular business opportunities. Certification requires the organisation to meet the requirements of the standard and demonstrate conformity through a formal certification process.

Building an effective ISMS does not, however, depend on having a certification project in place.

Security first – Compliance by Design

Regulatory obligations, contractual commitments, industry standards and customer requirements can all influence the security processes, controls and evidence an organisation needs.

Even so, I believe information security should begin with the organisation’s actual risks. A business that understands its critical information, systems and processes, assesses risks systematically, defines responsibilities and manages security controls in a structured way has a stronger foundation for addressing the requirements that apply to it.

This does not mean that effective security automatically delivers compliance. Different requirements may introduce specific expectations around governance, documentation, accountability, incident reporting, assurance or particular controls. These need to be identified and addressed in their own right.

They also reinforce an important point: information security is not solely a technical responsibility. Depending on the organisation, its sector and the requirements it faces, security may involve responsibilities across senior management, business functions, technology teams and third parties.

A solid security foundation makes this easier to manage. New requirements can be assessed against existing risks, processes and controls rather than treated as isolated compliance exercises. Existing capabilities can be reused where appropriate, while genuine gaps remain visible.

That is what Security first – Compliance by Design means to me: building security around genuine business risks while creating structures in which regulatory, contractual, industry and customer requirements can be addressed systematically.

Security needs a realistic path forward

An honest and independent review of the current security posture will usually uncover more work than can be completed in the near term. What matters is keeping risks visible and addressing improvements in a deliberate order.

The review should provide a clear direction. Where are we today? Which risks matter most? What level of protection do we need or want to reach? What can change soon, and what will take longer?

The result may be a roadmap for the next few months or, for larger transformations, several years. Its value lies not in the number of actions, but in bringing risks, requirements, dependencies and available resources into a coherent plan.

A roadmap should not remain static. New technologies, changes in the business model, emerging threats and regulatory developments can all change risks and priorities. The growing use of AI is one example: it can enable attackers to scale and automate existing techniques, while the organisation’s own adoption of AI may introduce new risks around information, access, third parties and governance. Information security is therefore not a project with a fixed end point. It needs to be reviewed regularly and adapted as risks, business requirements and technology evolve.

Technical risks, business objectives and organisational realities have to be considered together. An independent perspective can help identify blind spots, avoid misplaced priorities and turn possible improvements into a workable course of action.

Ultimately, good information security is not measured by the length of a controls register. It shows in whether an organisation understands its material risks, makes informed decisions about them and improves its security where improvement is genuinely needed.

A strong start does not have to be a big one

A startup, a growing business and a large organisation will organise information security differently. Yet they all need answers to a few fundamental questions: What do we need to protect? Which information security risks matter to our business? Where are we today? And what should we do next?

With sound answers, an organisation does not need to solve everything at once. It can improve security step by step, in line with its business, its risks and the requirements it faces now and in the future.