Business goals may include organizing the company to make it more efficient and profitable or redefine the major target markets. Key business goals must also reduce the risk of a data breach, the loss of intellectual property, and the compromise of valuable research data, while protecting employee and customer information. Success requires a business-focused cyber risk management program that includes a complete understanding of business activities and the potential organizational risk when a bad actor compromises one or more of these activities.

Technology goals start with the identified business activities. What technology underpins, enables, supports, or delivers each business activity? To understand security control requirements, we must first identify how the system supports the business activity and the impact of a bad actor on the business. It is essential to consider the risks associated with our systems, applications, and processing environment.