What are the key parameters while defining the security strategy which covers Design, Scope, POC, Implementation and final review?

Design:

-Identify security goals and objectives
-Determine the best approach for meeting those goals

Scope:
-Define the specific areas of the organization that the security strategy will cover
-Identify the types of assets, systems, and networks that will be protected

Proof of concept:
-Conduct a demonstration or test of the security strategy
-Identify any potential issues or weaknesses

Implementation:
-Deploy necessary technologies or processes
-Train employees on new security controls

Final review:
-Assess the effectiveness of the security strategy
-Make any necessary adjustments
-Conduct ongoing monitoring and evaluation to ensure the strategy continues to meet the organization's needs

critical process

As the company moves more and more of its operations onto the cloud over time, the security teams need to update their strategy, architectures, and technologies to keep up. While the magnitude of the changes and the sheer number of them may at first appear to be overwhelming, the modernization of the security program makes it possible for the security team to cast off some of the painful burdens associated with legacy approaches. An organization is able to temporarily function with legacy strategy and tooling, but it is challenging to continue this approach given the rate at which cloud technology and the threat environment are evolving:

If security teams continue to adhere to the outdated mentality of "arms-length" security, in which the initial response to any question about cloud adoption should be "no," there is a good chance that they will be excluded from the decision-making process (instead of working together with IT and business teams to reduce risk while enabling the business).
If security teams only make use of legacy on-premises tools and strictly adhere to the network perimeter-only doctrine for all of their defences and monitoring, then they will have a difficult time detecting and defending against attacks that originate in the cloud.