An obligation of means is a duty to take reasonable, proportionate steps toward a result, without promising that the result will always be achieved. In cyber security, this means an organization is expected to design, apply, and review appropriate safeguards, but not to guarantee that no breach will ever occur.
This concept matters because many security and privacy rules judge effort, not perfection. Under frameworks like GDPR Article 24, defenders may need to show risk assessments, access control, patching, logging, vendor oversight, and incident response plans as evidence that their measures were appropriate for the threat model. Attackers exploit gaps when these efforts are weak or poorly documented. Defenders strengthen their position by being able to explain why specific controls were chosen, how they were maintained, and how they matched the sensitivity of the data and the exposure of the system.