Define the operational boundary
A new security leader inherits existing risks, relationships, promises and incomplete evidence. The first objective is not a dramatic technology purchase; it is to understand which services matter, who owns them, where authority sits and which failure paths require immediate containment. Credibility grows from transparent priorities and delivered commitments.
Document the systems, identities, information and external dependencies inside the decision. The most important failure paths are strategy disconnected from critical services, too many initiatives without owners, unverified assurance inherited as fact, urgent operational exposure hidden by transformation work. Assign one accountable owner and record any boundary that remains outside the current work. This prevents a technically sound control from being mistaken for protection of a wider process it cannot actually cover.
Design controls around the real workflow
Structure discovery around business services, identity, exposure, suppliers, evidence and recovery. Meet accountable owners and frontline operators separately enough to reveal differences between policy and practice. Establish decision criteria for urgent action, planned remediation and accepted risk. Avoid publishing maturity scores before the evidence and intended audience are clear.
Build the control path from service-led discovery, single accountable risk register, clear decision criteria, early incident exercise, evidence-based reporting. Each layer should have a stated purpose, an implementation owner and a safe failure mode. Test ordinary work as well as privileged and emergency journeys. Where the strongest option cannot yet be used, document the temporary safeguard, residual consequence and date by which the design will be reconsidered.
Operate from evidence
Create one risk and action register with named owners, due dates and validation methods. Protect time for operational health: critical incidents, unresolved exposures and failing controls cannot wait for strategy workshops. Report uncertainty honestly and distinguish what has been verified from what is believed.
Useful operational evidence includes service-owner interviews, control validation, incident history, action ownership, recovery exercise results. Protect that evidence from routine administrators where practical, define how long it remains useful and make gaps visible. Measures such as critical services with owners, urgent risks contained, overdue validated actions, commitments completed with evidence should trigger a review, escalation or investment decision; a dashboard without an accountable response path is only decoration.
Prepare for failure and misuse
Use an early tabletop exercise to test leadership contacts, technical authority and recovery assumptions. Review recent incidents and near misses for recurring organisational causes. If a serious event occurs during the transition, stabilise command and evidence first, then update the roadmap rather than defending the original plan.
Exercise a scenario that removes a trusted dependency or exposes an abused privilege. Require the team to use real contacts, alternate authority, preserved records and recovery procedures. Capture what was known, what remained uncertain and which decision changed the outcome. Improvements should be verified through a repeated technical check rather than closed when a document is approved.
Move from a pilot to sustained control
Begin with one representative service and complete the sequence: listen and map the organisation, validate the highest-consequence paths, stabilise urgent exposure, agree a focused roadmap, exercise response and publish accountable measures. Publish the minimum standard, the exception route and the evidence required for acceptance. Expand only after the pilot shows that owners can operate the control without hidden manual work or unsafe workarounds.
Review the design after major platform, supplier, identity or business-process changes. Retire obsolete access and configuration rather than carrying every historical exception forward. Report progress in terms of reduced attack paths, faster verified recovery and clearer ownership. This keeps the programme connected to operating risk instead of measuring activity alone.
What to do next.
- ✓Start with critical services and owners.
- ✓Separate verified facts from assumptions.
- ✓Contain urgent attack paths early.
- ✓Use one accountable action register.
- ✓Exercise incident authority and recovery.
- ✓Commit to a small measurable roadmap.
Use guidance responsibly
Technology, provider behaviour and legal requirements change. Validate implementation details against current official documentation, test changes safely and obtain qualified legal advice where required.
Lerato Molefe
Security Strategy ContributorConnects technical assurance, resilience evidence and investment decisions for executives, boards and transformation leaders.
More from this writerReuben Botha
Enterprise Security ContributorFocuses on security programmes, risk translation and practical roadmaps that connect technical findings to accountable action.
More from this writerDaniel Mokoena
Security Governance ContributorExplores how technical evidence becomes accountable priorities, measures and leadership decisions without losing necessary detail.
More from this writer