Request Demo

Thought Leadership

How to Spend Your Cybersecurity Budget Increase

down-arrow

 

In “How to sell cybersecurity to your executive team,” I discussed strategies to sell cybersecurity to your board of directors, executives, and business leaders using a standards-based approach. Ultimately, this strategy would lead to you receiving a larger cybersecurity budget. Ample security budgets are rare, but by speaking the executive team’s language, using metrics and visuals, and getting outside verification, you’re bound to get the occasional healthy budget increase.

So, you’ve followed those steps, and have been rewarded with a larger security budget. Because no good deed goes unpunished, this forces a difficult question: what should you do with the money? Your budget won’t increase every year, so it’s important to make the most of the opportunity. It’s vital that you use a standards-based approach to allocate the funds to measure your return on investment and get optimal improvement.

Use framework to determine allocation

It’s important that you allocate new funds where they will bring your organization the most benefit. Use a framework like the NIST Cybersecurity Framework (CSF) or ISO 27001 to assess your strengths and weaknesses. Your new spending should improve an area of weakness. For example, if you have a high-quality intrusion detection solution, buying another detection solution won’t give you much more cyber strength for the money. Perhaps you’re weaker on your ability to recover from an emergency, and would be better served by a backup system that can get you operational (and profitable) quickly.

If you haven’t done such an assessment, consider third party consultants or a software solution like CyberStrong, which uses artificial intelligence to determine how you can get the most cyber improvement for the least investment, based on your specific situation.

 
ADVERTISING
 

I’ve discovered through our AI that many companies are spending plenty on technological solutions, but they are understaffed and not making the most of the technology. Perhaps your new funds would be better spent adding additional people who can develop things like better incident response plans, employee training programs, and disaster recovery plans. Be sure to balance technology and people. While quality firewalls and SIEMs are important, there is also a lot of low-hanging fruit that can strengthen your cyber resiliency for less cost.

Measure ROI

Russ Verbosky, CIO and CISO at the New Mexico Department of Game and Fish, says, “I keep reading that CISOs should report directly to the CEO. CISOs, therefore, should have their own budgets.”

The reality, however, is that most CISOs are not in total control of their budgets. For this reason, it’s important to demonstrate that you’re providing a strong return on the investment, which will help you continue to get budget increases in the future.

My preferred way to do this is to use quality metrics to measure your current cyber strength, and then demonstrate how much the spending will increase your cyber strength. At CyberSaint, we use the NIST CSF as our metric. For instance, perhaps right now we’ve completed 67% of the NIST CSF, therefore our cyber strength is 67. If we make investment level A, perhaps a medium investment, our cyber strength will increase to 75. If we have less to spend, we can eliminate these two specific items, perhaps security awareness training and insider threat program, and our cyber strength will only be a 71. But if we have additional funds to invest, we can add two specific items that will bump our cyber strength up to an 80, and we will be much more resilient.

This process turns cyber into a measurable business function. You and your board or executive team can decide: This is where we want to have our cyber program in less than one year. Instead of just picking solutions willy-nilly with unknown ROI, we’re now showing a clear return on investment to the board or executive team from this additional spending. And hopefully, seeing clear, measurable results will help you get larger budgets into the future, too.

Originally published in CSO Magazine.

You may also like

Downgrade Of Equifax By Moody’s ...
on May 28, 2019

In response to this week’s downgrade by Moody’s of Equifax as a result of its 2017 massive breach of consumer data, six cybersecurity and risk experts offer perspective on this ...

Insights from Verizon’s 2019 Data ...
on May 9, 2019

$40 million stolen from the Binance cryptocurrency exchange yesterday by cybercriminals. Hackers infiltrating hundreds of Amazon merchant accounts late last year. The ongoing ...

CyberSaint Introduces First ...
on April 16, 2019

New CyberStrong™ integrated risk management platform capabilities deliver actionable vulnerability intelligence, single sign-on (SSO), various hosting options, and customer-facing ...

Should There Be ‘Safe Harbor’ ...
on February 20, 2019

Sometimes, you do the best you can, but things happen anyway. You follow all the best practices, all your systems are locked down, you spend twice as much as your peers on ...

Data Center Knowledge
CyberStrong Integrated Risk ...
on February 19, 2019

BOSTON--(BUSINESS WIRE)--CyberSaint Security, a cybersecurity software firm that powers automated, intelligent compliance and risk management, today announced that the company ...

Booz Allen 2019 Cyber Threat Report
on February 7, 2019

@BoozAllen @BoozAllenCyber #cybertrends #cybersecurity #cyber Find out the 8 ways threat actors can make waves in 2019 in the annual Booz Allen Cyber Threat Outlook Report: ...