Integrating National Security into Business Strategy Insights

Mitch Lawrence, founder of Lawrence Solutions, argues that the discussion surrounding classified security should begin with a fundamental business question: what does security mean for an organization’s ability to fulfill its mission? A recent Government Accountability Office (GAO) review revealed that the Defense Counterintelligence and Security Agency (DCSA) conducts less than 40% of the required security reviews at contractor facilities, which poses a risk to classified information.

In fiscal year 2025, the DCSA conducted over 4,600 security reviews, documented more than 800 security violations, and identified over 1,000 open security vulnerabilities at cleared contractor facilities. The report noted that the DCSA relied on more than 470 personnel for its industrial security mission, spending upwards of $160 million that fiscal year.

Lawrence believes these statistics underscore the necessity for security leaders to articulate security issues in a manner that resonates with senior executives. He stresses that security professionals must understand the organizations they protect, including their products, customers, contracts, and operational pressures. Lawrence, who has experience working with both intelligence agencies and corporate security, asserts that security leaders often remain isolated, failing to engage with the broader business context.

He points out that metrics such as the number of visitors processed or credentials issued may indicate activity but do not convey their significance to executives. Lawrence emphasizes the need to answer the question: 'What’s in it for me?' He argues that security leaders must translate their activities into terms that are meaningful for CEOs, COOs, and other executives.

A 2026 NIST quick-start guide highlights the importance of communication regarding cybersecurity risks and workforce decisions at both organizational and enterprise levels. NIST indicates that senior leaders have risk-management responsibilities that span multiple organizations, and that cybersecurity risk information can inform workforce and risk decisions.

Lawrence believes this framework reinforces a crucial principle: security leaders must explain not only what a control requires but also what a security decision means for the organization. This principle informs what he refers to as his 'pathway to yes' approach, which encourages security professionals to understand applicable requirements, involve legal and financial stakeholders when necessary, consider operational realities, and identify compliant options before concluding that a request cannot be accommodated.

He illustrates this with a hypothetical scenario: requiring flood insurance for someone living on a mountain. Lawrence argues that executives may question security requirements that seem disconnected from actual risks, seeking clarity on their relevance.

Lawrence advocates for a mindset of flexibility, encapsulated in the phrase 'Semper Gumby,' meaning 'always flexible.' He warns that executives make a costly mistake when they treat classified security as an area where they can hire inexpensive, inexperienced personnel, expecting them to learn on the job. In a classified environment, security failures can have serious repercussions, affecting contracts, mission delivery, reputation, and the organization’s ability to perform sensitive work.

The GAO’s 2026 review identified gaps in DCSA’s ability to assess and respond to risks, recommending enhancements to analytic tools, addressing workforce limitations, and strengthening stakeholder engagement. The DOD relies on approximately 200,000 private companies for goods and services, many of which handle sensitive information. The GAO noted that malicious cyber activity targeting the defense industrial base can expose sensitive government data and disrupt business operations.

Lawrence emphasizes the importance of accountability for both security organizations and the executives overseeing them. He believes security leaders should present confidence, business acumen, meaningful metrics, and options to senior management, while also raising challenging issues and offering practical alternatives.

Executives, in turn, should expect security teams to provide choices that consider government requirements, legal implications, financial realities, and operational needs. Lawrence applies this perspective to government acquisition, advocating for security considerations to be explicitly integrated into acquisition decisions involving classified work. He argues that security should not overshadow business considerations but should be incorporated early enough to influence organizational planning and execution.

Lawrence asserts that classified security should be managed with the same level of attention as organizational objectives. He concludes that the most effective security organizations earn their place at the executive table by demonstrating that security is an enabler of the mission, emphasizing that compliance alone does not guarantee success.