A Note on What Strategy Means in UTIOM

Strategy in UTIOM means the security operations strategy, not the business strategy. The two are distinct and must not be confused.

Business strategy is an input. It tells you what the organisation is trying to achieve, which services it cannot afford to lose, and what regulatory obligations it carries. UTIOM consumes that; it does not produce it.

The security operations strategy is the answer to it: which adversaries realistically target an organisation of this shape, which assets carry the business consequence, what capability gets built in what order with what owner and what date, and how success will be measured.

They must align, not merely coexist. A security operations strategy that cannot be traced back to a business objective is an engineering plan wearing a strategic title. One that works against business objectives will be routed around and eventually defunded.