Beyond technical controls, which organizational elements are typical building blocks of a cyber security strategy?

Staff awareness/training, a security architecture with policies, emergency management with recovery procedures, and an ongoing risk-management process.

Common organizational pillars of a security strategy:

• Awareness & training — targeted education so staff recognize phishing, handle data safely, and follow procedures (addressing the human factor).
• Security architecture & policies — defined guidelines and standards that make protection systematic and repeatable.
• Emergency management & recovery — a plan for when (not if) something goes wrong, with defined restart/recovery procedures (business continuity).
• Risk management — establishing a continuous process to identify, assess, and treat risks.

Tip: Notice these are all ongoing processes, not one-time purchases. A strategy is something you operate continuously, not a box you tick once.

Go deeper:

• Security awareness (Wikipedia) — the training/awareness pillar addressing the human factor.
• Business continuity planning (Wikipedia) — the emergency-management/recovery pillar.