Creating a business objective model
The business objective model involves defining business outcomes. It is similar to the AWS Cloud Adoption Framework and the AWS Well-Architected Framework. This approach focuses on what the business is interested in by interpreting the target business outcomes. The value of this approach is that it is easy to tie business objectives to security objectives. An example of a business objective is "Enable secure external connections and accelerated provisioning of new users and environments, by automating visibility and measuring against best practices to continuously drive down risk." You establish technology objectives that help you meet corresponding business outcomes. The business objective model ties back to security objectives, such as maintaining visibility. You then implement a technical objective, such as AWS Identity and Access Management (IAM) security best practices, in order to reduce security risk.
Advantages of business objective approach:
-
Includes cost justification
-
Provides a clear, business-aligned security direction
-
Defines measures of success through achieving target business outcomes
Disadvantages of business objective approach:
-
Can be time consuming because you have to figure out what the business wants
-
Is business-focused rather than technology-focused
