CISO workshop

The CISO Workshop is one of our Security Adoption Framework (SAF) workshops that are designed to help organizations modernize their security programs using Zero Trust strategy, security best practices, and real‑world lessons learned.

The workshop is designed to support security and technology leaders as they align security strategy with evolving business priorities, technology platforms, and the threat landscape.

Use this relationship as your operating model:

  • Use the CISO Workshop to establish business and security outcomes and priorities.
  • Use SAF to organize and manage the security improvement program.
  • Use MCRA to understand and implement the supporting security capabilities and architectures.

Tip

Our Security Adoption Framework (SAF) workshops align with structured SAF guidance.

Why the CISO workshop?

Modern security programs must continuously adapt. Business models change, technology estates expand, and attackers evolve rapidly. Many organizations struggle not because they lack security tools, but because security strategy, roles, metrics, and decision‑making are not aligned.

The CISO Workshop addresses this challenge by helping leaders structure security as a business enabler, not just a technical function. It helps leaders to:

  • Understand how Zero Trust reshapes modern security strategy
  • Communicate security priorities effectively to business stakeholders
  • Align security investments with business risk and outcomes
  • Avoid common antipatterns that reduce security effectiveness
  • Establish realistic metrics and operating models for long‑term success

Rather than focusing only on tools, the workshop emphasizes decision‑making, alignment, and accountability—the areas that most often limit security outcomes.

Who's the workshop for?

The workshop is useful for security teams, IT teams, business leaders, and cloud teams, and is especially relevant for roles with broad strategic responsibility:

  • CISO + Security Directors - Modernizing security strategy, governance, and program components. Integrating security into larger organization.
  • CIO + IT Directors - Integrating security into technology programs, cloud initiatives, and transformation efforts.
  • Enterprise + Security Architects – Designing and aligning security architectures with business strategy and technology priorities.

How the workshop helps with security adoption

Our recommended security adoption path includes guidance for a security strategy, integration, and governance discipline. This discipline focuses on the organizational and operational foundations required to build and sustain an effective security program.

The CISO workshop provides context and practical insights that support this discipline across the adoption journey.

Diagram showing CISO workshop structure with Part A (Context and Fundamentals), Part B (Business Alignment), and Part C (Security Disciplines).

What happens after the workshop?

Workshop completion is the start of execution, not the end of the effort. Use workshop outputs to run an ongoing security improvement lifecycle:

Prepare -> Facilitate -> Capture decisions -> Build roadmap -> Assign ownership -> Implement -> Measure -> Improve

Recommended post-workshop actions:

  1. Confirm desired business and security outcomes.
  2. Capture key decisions, assumptions, dependencies, and unresolved questions.
  3. Prioritize gaps by business impact and security risk.
  4. Assign accountable owners across relevant SAF security disciplines.
  5. Map priority improvements to architecture capabilities with MCRA.
  6. Build or update the security roadmap using SAF journey guidance.
  7. Establish milestones and evidence of progress with security posture guidance.
  8. Reassess periodically and update priorities.

Expected workshop outputs

Depending on scope and workshop format, useful outputs to carry forward typically include:

  • Desired business and security outcomes.
  • Material risks and current-state observations.
  • Target-state priorities and architecture decision themes.
  • Prioritized improvement roadmap.
  • Accountable owners and decision authorities.
  • Key dependencies and unresolved decisions.
  • Progress measures and follow-up cadence.

Workshop availability

We recommend running this workshop as an expert-led delivery through Microsoft Unified. If you have Microsoft Unified, contact your Customer Success Account Manager (CSAM) to request an expert-led workshop delivery that helps you to:

  • Learn from real‑world customer engagements and Microsoft’s internal security teams.
  • Increase security program maturity and improve overall security posture.
  • Make informed decisions, prioritize the right initiatives, and connect strategy to execution across the organization.
  • Strengthen threat detection and response capabilities.
  • Apply Zero Trust principles in realistic, operational ways.

There are also a number of free videos available for this workshop.

Workshop structure and topics

Section Area
Part A - Key Context and Fundamentals Trends that impact security - Including threats, technology, and business transformation trends.

Evolution of security roles and responsibilities, - Including key best practices and trends to monitor.

Recommended strategy and initiatives to improve your program - Including the role of Zero Trust in strategy, the (low) cost for attackers to buy tools and passwords, learnings on getting reliable information, and a business analysis of ransomware attacks.
Part B - Business Alignment Engaging business leaders on security - Guidance to facilitate conversations in the language of leaders to explain security, key program success metrics, and getting support for security goals.

Risk Insights – Discusses the dual mission of security to reduce risk to the organization and enable business goals. Shares tips on aligning security business goals and business risk, and insights on the types of attacker motivations that organizations face.

Security Integration - Guidance for successfully integration of security teams, and integration of security into IT and Business processes. Includes an in-depth discussion on building a posture management program with an operational team focused on preventive controls. This complements the SecOps team focused on detection, response, and recovery.

Business Resilience – Discusses business resilience as the north star of the security programa, cross all the security disciplines. It requires balancing security investments (before, during, and after an incident) and creating a strong feedback loop. This section also includes discussion of the impact of unbalanced strategies (which is a common antipattern).

Maturity models - Describe real world journeys for risk insights, security integration, and business resilience – including concrete actions to help you move up to the next level.
Part C – Security Disciplines Access Control - Discusses how the Zero Trust approach is transforming access control, including identity and network access converging into a single coherent approach, and the emergence of the Known-Trusted-Allowed model, which updates the classic authenticated/authorized approach.

Security Operations – Discusses key leadership aspects of a SecOps or Security Operations Center (SOC) capability, including critical success metrics, key touchpoints with business leaders and functions, and critical cultural elements.

Asset Protection – Discusses two key imperatives for teams that manage and secure assets (often IT Operations or Workload Operations in DevOps). These teams must prioritize security work based on business criticality and must strive to efficiently scale security across the large, growing, and continuously evolving set of assets in the technical estate.

Security Governance – Discusses the role of security governance as a bridge between the world of business goals and technology and how this role is changing with the advent of cloud, digital and Zero Trust transformations. This section also covers key components of security governance including risk, compliance, security architecture, posture management, strategic threat intelligence, and more.

Innovation Security - Discusses how application security evolves into a modern approach (including DevSecOps) and key focus areas to drive success of this capability.

Security Governance Maturity models - Describes real world journeys for security architecture, posture management, and IT security maintenance, including concrete actions to help you move up to the next level.
Next Steps/Closing Wraps up the workshop with key quick wins and next steps.

Note

The Architecture Design session modules discussed in the video aren't yet published for the free workshop.

Audience-specific onward paths

Security leaders

Use these paths to turn workshop outcomes into program direction:

Architects and practitioners

Use these paths to convert priorities into architecture and implementation work:

Partners and facilitators

Use these paths to deliver consistently and connect workshop outputs to execution:

Next steps

  • Last updated on