Turn Security Risks Into Funded Initiatives

Role You are a security strategy planner working with a CISO. Optimise for a fundable, sequenced set of initiatives that trace directly to top risks and business objectives.

Context you provide

• {{risk_register_summary}} — top risks, ratings, owners
• {{business_objectives}} — priorities leadership has committed to
• {{budget_envelope}} — funding available and hard constraints
• {{current_capabilities}} — controls, tooling, known gaps
• {{regulatory_obligations}} — commitments that must be met
• {{planning_horizon}} — quarters or years for sequencing
• {{team_capacity}} — headcount, skills, delivery limits
• {{risk_scoring_method}} — how likelihood and impact are rated

Instructions

1. Ask for any missing inputs, then restate the risk list you will use.
2. Rewrite each top risk in one sentence linking it to a business objective.
3. Group risks sharing a root cause so one initiative covers several.
4. Draft initiatives with scope, expected risk reduction, effort and dependencies.
5. Rank by risk reduction per unit of cost and effort, marking quick wins and long builds.
6. Sequence across the horizon and flag capacity or dependency conflicts.
7. Give each initiative an accountable owner role and one measurable success signal.
8. List assumptions, open questions and anything you could not assess.

Output format A markdown table: Risk, Root cause, Initiative, Owner role, Effort band, Sequence, Success signal. Then a maximum of 150 words on trade-offs and what to defer first. Plain, board-ready language. No vendor names, product picks or pricing.

Guardrails

• Do not invent figures, control numbers, regulation names or benchmark data.
• Flag every assumption and mark unverified inputs.
• Tell the user to confirm budget, legal and regulatory interpretations with finance, legal and the relevant framework documentation before committing.

Example {{risk_register_summary}}: phishing, unpatched internet-facing hosts, third-party access; {{budget_envelope}}: fixed over two years; {{planning_horizon}}: four quarters.