E019 Cybersecurity Strategy is listed under banner number ITEC 6300 and is worth 3 competency units. It examines cybersecurity from a management perspective: analysing threats across policy, people, culture and technology, evaluating cost and investment, and roadmapping the organization's plan. E019 and ITEC 6300 are one requirement. The word that shapes every aspect is strategy, which means choices over time under constraint rather than a list of good things to do.
Four lenses, and culture is the awkward one
The course insists on analysing threats through four lenses, and the fourth is the one students find hardest to write about. Policy is what the organization has committed to. People are who does the work and what they know. Technology is the estate. Culture is what actually happens when policy and convenience disagree, and it is the lens that explains why controls that exist on paper do not exist in practice.
Writing about culture credibly requires evidence rather than assertion. If the scenario mentions that engineers share an administrative account because the request process takes three days, that is a cultural observation with a cause, and the strategic response addresses the three days rather than issuing a reminder about account sharing. Naming the mechanism behind a behaviour is what turns culture from a vague complaint into analysis.
Investment analysis is the second demanding strand. Security investment competes for the same money as everything else, and strategy means deciding what not to fund. That requires comparing options on a common basis: what risk each reduces, at what cost, over what period, with what confidence. A roadmap where everything is a priority is not a strategy, it is a wish list with dates attached.
Roadmapping ties it together. A strategic roadmap has phases with logic between them, dependencies made explicit, decision points where the plan can change, and a stated view of what the organization will look like at the end. It should be recognisable as a plan someone could be held to.
Outcomes are logged as Competent or Not Competent, since WGU issues no letter grades and holds no ordinary grade point average, and 3 competency units is how the course's weight is expressed in a six month flat-rate term.
Turning aspects into a strategy document
If your version of E019 uses a performance assessment, the aspects usually track the four lenses plus investment and roadmap. WGU requires a score of 2 in each aspect for a task to pass and judges each aspect alone, so a thorough technology analysis will not carry an unaddressed culture or investment aspect.
Budget before drafting. Take a rubric with six scored aspects and a target near 2,300 words. Reserve 160 words for the organization and its strategic position, and 120 for the close, leaving 2,020 across six aspects, or roughly 336 each. Weight by demand: two aspects requiring investment analysis and roadmap construction take 460 each, which is 920; the four remaining aspects, one per lens, take 275 each, which is 1,100. Together that is 2,020.
Give each lens the same internal structure so the analysis is comparable: what the lens reveals, what it costs the organization today, and what a strategic response would change. Comparability across lenses is what lets the investment section weigh them against each other later.
Reserve budget for what you will not do. A strategy that funds everything has made no strategic choice, and naming the initiative you deliberately deferred, with the risk that carries, is often the strongest paragraph in the document.
Shape for a cybersecurity strategy
E019 deliverables usually set a multi-year security direction. These proportions fit that document.
| Section | Content | Share |
|---|---|---|
| Strategic context | The business, its direction, and what security has to enable or protect over the period. | 12 percent |
| Policy analysis | What is committed to, where commitments conflict, and where policy has fallen behind the estate. | 13 percent |
| People analysis | Capability, capacity, key person dependencies and the hiring reality behind any plan. | 13 percent |
| Culture analysis | Observed behaviour, the mechanisms causing it, and what would change the incentive. | 15 percent |
| Technology analysis | Estate exposure, technical debt and the capabilities missing rather than the products missing. | 15 percent |
| Investment case | Options compared on a common basis, with what is funded, deferred and declined. | 18 percent |
| Roadmap | Phases, dependencies, decision points and the end state, with measures at each stage. | 14 percent |
Evidence for strategic claims
Strategy documents make claims about the future, which cannot be sourced directly, so the discipline is to source the premises instead. Threat trend claims belong to published research and agency reporting with dates. Cost benchmarks belong to industry data with a stated population. Framework expectations belong to the framework. What you build on top of those is your argument, and it should be visibly yours.
Be disciplined about extrapolation. A report describing an increase in a particular attack type across a sector supports a claim that the sector faces growing pressure; it does not by itself support a claim about what will happen to this organization next year. Mark the step where you move from evidence to judgement, because that step is what an evaluator is assessing.
Cultural evidence deserves particular care because it is the easiest place to write assumptions as facts. Ground every cultural claim in something the scenario states or in a documented general finding, and where you are inferring, say so. An honest inference is stronger than a confident invention.
Investment figures should show their working. Even rough numbers become defensible when the components are visible: this many staff at this band, this tooling tier, this much implementation effort. A total with no decomposition invites doubt about all of it.
Use the citation style your task names and attach every source to the sentence that depends on it. That table is where the strategic reasoning becomes checkable, and it usually carries an aspect on its own.
Competent strategy and returned work
Competent submissions analyse all four lenses at comparable depth, ground cultural claims in mechanisms, compare investment options on one basis, and produce a roadmap with dependencies and decision points rather than a timeline of good intentions.
Returns follow four shapes. Culture is treated as a paragraph about awareness training. Investment is described without comparison, so no choice is visible. The roadmap lists initiatives by year with no dependencies between them. Or the document never says what will not be done, which means no strategic decision was made.
Measurement across a multi-year plan deserves its own thought. Annual targets are easy to write and easy to miss quietly, so the stronger approach is a small number of measures reported at every phase boundary, chosen so that a bad trend is visible within one reporting period rather than at the end. Naming who receives that report, and what they are expected to do if a measure moves the wrong way, is what stops a roadmap from becoming a document nobody revisits.
Communication is the last piece and it is genuinely strategic. A security strategy that only the security function understands cannot be executed by the rest of the organization, and translating each initiative into what it means for a product team, a finance team or a frontline department is work that belongs in the document rather than being left for later.
A useful test: remove the dates from your roadmap and see whether the order still makes sense. If any phase could be swapped with another without consequence, the dependencies have not been thought through, and dependencies are what distinguish a roadmap from a schedule.
A returned performance assessment costs nothing in grade terms to rework, so a complete draft should go to the evaluator rather than back to you, since an early submission leaves room for a revision cycle. If your section also carries an objective assessment, WGU objective assessments are proctored and our boundary is fixed: preparation only, with strategy frameworks, investment reasoning practice and a candid read on your preassessment result. Sitting an assessment for you is not something we do, are absent for the whole of it, and your portal login is never something we touch.
Roadmap without a strategy behind it?
Send the E019 rubric and scenario. We work all four lenses, build the investment comparison and sequence the roadmap with word targets.
Eight mistakes that cost time in E019
- Culture as awareness training. Find the mechanism causing the behaviour and address that instead.
- Investment without comparison. Strategy is choosing. Put the options on one basis and pick.
- Funding everything. A plan with no deferrals has made no decision and reads that way.
- Roadmaps with no dependencies. Order should be forced by logic, not by which year had space.
- Extrapolating past the evidence. Mark where sourced fact ends and your judgement begins.
- Totals with no components. Decompose every investment figure so it can be interrogated.
- People analysis that assumes hiring. Specialist capacity is scarce. A plan depending on easy recruitment has a hidden risk.
- No decision points. A multi-year plan needs moments where it can legitimately change.
Three questions students ask about E019
How technical should a strategy document be?
How far ahead should the roadmap reach?
Is E019 the same as the graduate cybersecurity management course?
Where E019 sits in WGU's programs
The July 2026 catalog places this code in 1 current WGU program. Open a program page for the complete standard path and term positions. The live Degree Plan remains authoritative after transfer credit, substitutions, and mentor planning.
The assessments, one by one
The public catalog does not publish this course's PA/OA identity or task count. WGU Tutors publishes at most one PA manual per course and only from a WGU-controlled public rubric. Until that source exists, PA help begins from the student's real Course of Study and OA support remains preparation only.