Topics in this domain
- Exam Technique: Thinking Like a Security Manager
- Security Governance vs Security Management
- Organisational Culture and Tone at the Top
- Ethics, Codes of Conduct and Accountability
- Integrating Security into Corporate Governance
- Legal, Regulatory and Contractual Requirements
- Due Diligence, Due Care and Legal Liability
- Privacy and Data Protection Governance
- Governance Roles, the CISO and Reporting Lines
- The Security Steering Committee
- The Three Lines Model and Independent Assurance
- Aligning Security Strategy with Business Objectives
- Developing a Security Strategy and Roadmap
- Gaining and Keeping Executive Commitment
- Governing AI and Emerging Technology
- Security Frameworks Compared: NIST CSF, ISO 27001 and COBIT
- Selecting and Implementing a Framework
- Governance Models: BMIS and the Security Balanced Scorecard
- Resource Planning and Security Budgets
- Building a Business Case for Security Investment
- Demonstrating Value and Return on Security Investment
Resource Planning and Security Budgets
Turning strategy into resources
A strategy without resources is a wish list. Strategic planning, one of the CISM topics in Domain 1, turns the roadmap into a plan the business can fund: what the initiatives need, what the organisation already has, and how to fill the gap.
Four kinds of resource
| Resource | Includes |
|---|---|
| People | The security team, its skills and training, security champions in the business |
| Technology | Tools and platforms, licences, support, integration effort |
| External services | Managed security providers, consultants, penetration testers, incident response retainers |
| Time and attention | Business staff time for assessments and training, executive attention, the organisation’s capacity for change |
Plan them together. A tool that nobody has time to run is wasted money, and an initiative that needs business staff during their busiest season will slip.
The budget cycle
- Start from the strategy and top risks, not from last year’s spend plus inflation.
- Estimate two kinds of cost: run (keeping existing controls working) and change (new initiatives). Note which are capital expenditure and which are operating expenditure.
- Prioritise by risk reduced per unit of spend, dependencies and business value.
- Approve through the steering committee and senior management.
- Track spend against plan and the benefits delivered.
- Adjust for new risks, incidents and business change.
Security work that’s part of a business project, such as securing a new customer portal, should be costed into that project’s budget from the start. This keeps security from being an afterthought and shows its true cost to the business.
Industry benchmarks, such as the share of IT spend going to security, are useful context but not a justification by themselves. The case rests on the organisation’s own risks.
Build, buy or outsource?
| Option | Good when | Watch out for |
|---|---|---|
| Build in-house | Core capability; need for control; skills available | Hiring, retention and time to build |
| Buy a product | Mature market; standard need | Total cost of ownership; staff to run it |
| Outsource (e.g. MSSP) | 24x7 coverage or scarce skills needed | Contracts and oversight; accountability stays with the organisation |
| Hybrid | Most organisations | A clear split of responsibilities |
Counting the real cost
Total cost of ownership (TCO) includes:
- licences or subscriptions, and their annual increases
- people to configure, run and tune the tool
- integration with existing systems
- training and certification
- support, upgrades and eventual replacement
Example. A SIEM costs 150,000 a year in licences. Running it well needs two analysts (220,000) and integration work (60,000 in year one). The business case uses 430,000, not 150,000, for year one.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| What should drive the security budget? | The strategy and risk priorities |
| Main concern when buying a security tool | Total cost of ownership, including people to run it |
| Benefit of a managed security service | Access to skills and 24x7 coverage |
| Who stays accountable after outsourcing? | The organisation |
| Where should security costs for a business project go? | In the project’s own budget, from the start |
In short
- Strategic planning turns the security strategy into resources: people, technology, external services and time.
- The budget should follow the strategy and risk priorities, not last year's spend plus a percentage.
- Separate 'run' costs (keeping existing controls working) from 'change' costs (new initiatives).
- Total cost of ownership includes licences, people to run tools, integration, training and support, not just purchase price.
- Build, buy or outsource decisions weigh cost, skills, control, speed and risk.
- Security costs should be built into business projects from the start, not added later from the security budget.
Exam traps
- Buying a tool without the people or process to run it is a classic waste.
- Benchmarks (percent of IT budget spent on security) are context, not a justification on their own.
- Outsourcing a security service doesn't outsource accountability.
- Cutting run costs to fund new projects can quietly weaken existing controls.
Slides
Click the slide and use the arrow keys. F toggles full screen.
Four kinds of resource
The budget cycle