Request Demo

Thought Leadership

How to Spend Your Cybersecurity Budget Increase

down-arrow

 

In “How to sell cybersecurity to your executive team,” I discussed strategies to sell cybersecurity to your board of directors, executives, and business leaders using a standards-based approach. Ultimately, this strategy would lead to you receiving a larger cybersecurity budget. Ample security budgets are rare, but by speaking the executive team’s language, using metrics and visuals, and getting outside verification, you’re bound to get the occasional healthy budget increase.

So, you’ve followed those steps, and have been rewarded with a larger security budget. Because no good deed goes unpunished, this forces a difficult question: what should you do with the money? Your budget won’t increase every year, so it’s important to make the most of the opportunity. It’s vital that you use a standards-based approach to allocate the funds to measure your return on investment and get optimal improvement.

Use framework to determine allocation

It’s important that you allocate new funds where they will bring your organization the most benefit. Use a framework like the NIST Cybersecurity Framework (CSF) or ISO 27001 to assess your strengths and weaknesses. Your new spending should improve an area of weakness. For example, if you have a high-quality intrusion detection solution, buying another detection solution won’t give you much more cyber strength for the money. Perhaps you’re weaker on your ability to recover from an emergency, and would be better served by a backup system that can get you operational (and profitable) quickly.

If you haven’t done such an assessment, consider third party consultants or a software solution like CyberStrong, which uses artificial intelligence to determine how you can get the most cyber improvement for the least investment, based on your specific situation.

 
ADVERTISING
 

I’ve discovered through our AI that many companies are spending plenty on technological solutions, but they are understaffed and not making the most of the technology. Perhaps your new funds would be better spent adding additional people who can develop things like better incident response plans, employee training programs, and disaster recovery plans. Be sure to balance technology and people. While quality firewalls and SIEMs are important, there is also a lot of low-hanging fruit that can strengthen your cyber resiliency for less cost.

Measure ROI

Russ Verbosky, CIO and CISO at the New Mexico Department of Game and Fish, says, “I keep reading that CISOs should report directly to the CEO. CISOs, therefore, should have their own budgets.”

The reality, however, is that most CISOs are not in total control of their budgets. For this reason, it’s important to demonstrate that you’re providing a strong return on the investment, which will help you continue to get budget increases in the future.

My preferred way to do this is to use quality metrics to measure your current cyber strength, and then demonstrate how much the spending will increase your cyber strength. At CyberSaint, we use the NIST CSF as our metric. For instance, perhaps right now we’ve completed 67% of the NIST CSF, therefore our cyber strength is 67. If we make investment level A, perhaps a medium investment, our cyber strength will increase to 75. If we have less to spend, we can eliminate these two specific items, perhaps security awareness training and insider threat program, and our cyber strength will only be a 71. But if we have additional funds to invest, we can add two specific items that will bump our cyber strength up to an 80, and we will be much more resilient.

This process turns cyber into a measurable business function. You and your board or executive team can decide: This is where we want to have our cyber program in less than one year. Instead of just picking solutions willy-nilly with unknown ROI, we’re now showing a clear return on investment to the board or executive team from this additional spending. And hopefully, seeing clear, measurable results will help you get larger budgets into the future, too.

Originally published in CSO Magazine.

You may also like

CyberSaint user, Silverside ...
on December 6, 2018

    Cutting edge nuclear detection company, SilverSide Detectors, partnered with MassMEP and CyberSaint to become DFARS compliant as they expand their business. Congratulations to ...

100 Million Quora Customers Hit By ...
on December 11, 2018

Quora, one of the largest Q&A internet portals, said hackers breached its servers and obtained information of about 100 million users, almost half of the its entire customer base. ...

Boston-Based Cybersecurity ...
on December 5, 2018

According to the Privacy Rights Clearinghouse, there have been approximately 11.2 billion records exposed in the more than 8,800 data breaches that have been publicly disclosed ...

CyberSaint Closes the ...
on December 3, 2018

BOSTON--(BUSINESS WIRE)--CyberSaint Security, a cybersecurity software firm that powers automated, intelligent compliance and risk management, today released significant new ...

Alison Furneaux
Data Breach Hits 2.6 Million ...
on November 29, 2018

Hospital network Atrium Health informed patients on Tuesday that their personal information was compromised following a breach at technology solutions provider AccuDoc. Atrium ...

2.65 Million Records Exposed in ...
on December 3, 2018

Another massive data breach announcement has made headline, this time for healthcare and wellness program provider Atrium Health, formerly known as Carolinas HealthCare Systems, ...