A cyber strategy should guide decisions about people, processes, and technology, as well as technical security choices.

### Why this is right The strategy is an organisational guide, not just a technology plan. It influences staffing and training, governance and procedures, and technical investment. ### The concept People make decisions and report concerns; processes define how work and response activities are carried out; technology supports protection, detection, and recovery. These elements interact. For example, a secure remote-access tool is less effective if staff do not understand safe use or if access approval is unclear. ### Terms - **Governance**: the roles, oversight, and decision-making arrangements used to direct an organisation. - **Remote access**: connecting to organisational systems from outside the organisation’s usual workplace. ### Remember A cyber strategy spans organisational choices as well as security products.