Security Strategy Roadmap Builder
Build multi-year security roadmaps aligned with business risk and compliance
What You Can Do
Create strategic security roadmaps that balance risk, compliance, and business objectives. You'll develop phased implementation plans, prioritize security initiatives by impact and threat severity, estimate budgets, and generate executive-ready strategy documents that demonstrate clear ROI and stakeholder alignment.
Features
Design 1-3 year security strategies with phased milestones and dependencies
Rank initiatives using business impact, threat severity, and compliance requirements
Calculate costs per initiative and align total security spending with strategy priorities
Link roadmap initiatives to regulatory requirements (SOC 2, ISO 27001, HIPAA, PCI-DSS, etc.)
Identify current security capability gaps and define remediation sequencing
Map decision-makers, define buy-in criteria, and address organizational barriers
Create realistic phased schedules accounting for resource constraints and dependencies
Define KPIs, maturity models, and measurement frameworks for each roadmap phase
Example Output
Example 1: Executive Summary with Roadmap Phases
Year 1: Foundation (Q1-Q4)
- Implement SIEM and log aggregation (Medium Risk, High Impact)
- Deploy MFA across organization (Critical Risk, High Impact)
- Establish vulnerability management program (Medium Risk, Medium Impact)
Budget: $850K
Year 2: Hardening (Q1-Q4)
- Deploy EDR/XDR platform (Medium Risk, High Impact)
- Implement secrets management vault (High Risk, High Impact)
- Mature identity access management (Medium Risk, Medium Impact)
Budget: $1.2M
Year 3: Optimization (Q1-Q4)
- Automate security testing in CI/CD (Low Risk, Medium Impact)
- Deploy threat intelligence platform (Medium Risk, Medium Impact)
Budget: $650K
Example 2: Risk-Priority Matrix
- Critical/High: MFA deployment, incident response automation
- High/Medium: SIEM implementation, vulnerability scanning
- Medium/Low: Security awareness training, advanced threat hunting
Example 3: Budget Breakdown by Category
- Personnel (45%): Security team expansion, contractor support
- Technology (40%): Platform purchases, licensing, SaaS subscriptions
- Operations (15%): Training, compliance audits, incident response exercises
What's Included
- SKILL.md: Complete security strategy roadmap instructions and decision framework
- Roadmap template: Pre-built structure for multi-year security planning
- Risk assessment checklist: Threat categories and business impact criteria
- Compliance mapping worksheet: Links between initiatives and regulatory frameworks
- Budget estimation guide: Cost modeling for common security investments
- Stakeholder analysis template: Decision-maker mapping and buy-in strategy
- Executive summary template: Board-ready presentation format
Who It's For
- CISOs and Security Executives — Build board-approved multi-year strategies and defense against security budgets cuts
- Security Architects — Create technical roadmaps aligned with business risk priorities
- IT Risk Managers — Develop compliance and risk-driven implementation plans
- Compliance Officers — Map security initiatives to regulatory requirements and audit readiness
- Enterprise IT Directors — Plan security investments alongside business transformation initiatives
Best For
- Creating 1-3 year security strategies from scratch
- Prioritizing competing security initiatives by business impact and risk
- Presenting security plans to boards and executives
- Aligning security spending with enterprise budgets and goals
- Building compliance roadmaps for SOC 2, ISO 27001, or industry regulations
- Designing phased security capability maturity models
You might also like
You'll craft partnership proposals that clearly articulate mutual value, address stakeholder concerns, and systematically mitigate risks. This skill structures complex negotiations into compelling narratives that resonate with decision-makers across finance, operations, and strategy. You'll generate proposal templates, identify critical success factors, model financial outcomes, and prepare responses to anticipated objections before ever presenting to your counterparty.
You can systematically audit construction sites against OSHA 1926 Subpart standards, document observed hazards with proper regulatory citations, and develop corrective action plans with clear remediation timelines. This skill helps you create compliance documentation that withstands inspector scrutiny and demonstrates good faith safety efforts, while prioritizing findings by risk severity for targeted remediation.
You can process soil testing data (density, moisture, CBR, gradation, Atterberg limits) and field compaction measurements to verify compliance with construction specifications. The skill helps you identify non-compliant conditions early, determine when additional testing is required, and produce documented QC reports that withstand owner and contractor scrutiny. You'll work through structured analysis workflows that catch compliance gaps and create defensible decision trails.
You can systematically decode MEP coordination drawings and specifications to identify physical clashes between mechanical, electrical, and plumbing systems before installation begins. The skill helps you flag spatial conflicts, sequencing dependencies, and code violations early—at the planning stage where fixes are exponential cheaper than field rework. You'll generate coordination bulletins and resolution strategies with trade-specific language that prevent costly delays and change orders.
You can develop comprehensive data strategies that align technology roadmaps with business objectives and secure executive buy-in. This skill helps you assess organizational readiness for data transformation across people, processes, and technology; create ROI-backed business cases for funding; and establish governance models that enable collaboration. You'll transform strategic data vision into actionable, phased implementation plans with clear dependencies and resource allocation.
You can input visual observations of weld defects (porosity, cracks, undercut, spatter) along with dimensional measurements, and Claude will cross-reference them against AWS D1.1 acceptance criteria, determine accept/reject decisions with technical justification, and generate consistent, professionally formatted inspection reports. This skill augments your fieldwork by organizing observations, standardizing documentation, and reducing the time spent drafting non-conformance reports while maintaining compliance rigor.
You can process laboratory and field compaction test data—including Standard/Modified Proctor results, nuclear density gauge readings, sand cone tests, and drive cylinder measurements—to make defensible QC decisions aligned with ASTM, AASHTO, and project-specific standards. The skill structures your analysis across density compliance, moisture verification, and field conditions, then documents non-conformances with clear remediation paths and technical reasoning suitable for stakeholder communication.
You can rapidly develop facility-specific confined space entry programs, permit-required confined space (PRCS) identification, and atmospheric monitoring protocols that meet OSHA 1910.146 standards. The skill generates customized hazard assessments, pre-entry checklists, rescue procedures, and competency documentation based on your specific confined spaces, entry procedures, and atmospheric conditions—eliminating the gap between generic templates and legally defensible compliance.