In “How to sell cybersecurity to your executive team,” I discussed strategies to sell cybersecurity to your board of directors, executives, and business leaders using a standards-based approach. Ultimately, this strategy would lead to you receiving a larger cybersecurity budget. Ample security budgets are rare, but by speaking the executive team’s language, using metrics and visuals, and getting outside verification, you’re bound to get the occasional healthy budget increase.
So, you’ve followed those steps, and have been rewarded with a larger security budget. Because no good deed goes unpunished, this forces a difficult question: What should you do with the money? Your budget won’t increase every year, so it’s important to make the most of the opportunity. It’s vital that you use a standards-based approach to allocate the funds to measure your return on investment and get optimal improvement.
It’s important that you allocate new funds where they will bring your organization the most benefit. Use a framework like the NIST Cybersecurity Framework (CSF) or ISO 27001 to assess your strengths and weaknesses. Your new spending should improve an area of weakness. For example, buying another detection solution won’t give you much more cyber strength for the money if you have a high-quality intrusion detection solution. Perhaps you’re weaker in your ability to recover from an emergency, and would be better served by a backup system that can get you operational (and profitable) quickly.
I’ve discovered through our AI that many companies are spending plenty on technological solutions, but they are understaffed and not making the most of the technology. Perhaps your new funds would be better spent adding additional people who can develop things like better incident response plans, employee training programs, and disaster recovery plans. Be sure to balance technology and people. While quality firewalls and SIEMs are important, a lot of low-hanging fruit can strengthen your cyber resiliency for less cost.
Russ Verbosky, CIO and CISO at the New Mexico Department of Game and Fish says, “I keep reading that CISOs should report directly to the CEO. CISOs, therefore, should have their own budgets.”
The reality, however, is that most CISOs are not in total control of their budgets. For this reason, it’s important to demonstrate that you’re providing a strong return on the investment, which will help you continue to get budget increases in the future.
My preferred way to do this is to use quality metrics to measure your current cyber strength, and then demonstrate how much the spending will increase your cyber strength. At CyberSaint, we use the NIST CSF as our metric. For instance, perhaps right now, we’ve completed 67% of the NIST CSF, therefore, our cyber strength is 67. If we make investment level A, perhaps a medium investment, our cyber strength will increase to 75. If we have less to spend, we can eliminate these two specific items, perhaps security awareness training and insider threat program, and our cyber strength will only be a 71. But if we have additional funds to invest, we can add two specific items that will bump our cyber strength up to an 80, and we will be much more resilient.
This process turns cyber into a measurable business function. You and your board or executive team can decide: This is where we want to have our cyber program in less than one year. Instead of just picking solutions willy-nilly with unknown ROI, we’re now showing a clear return on investment to the board or executive team from this additional spending. And hopefully, seeing clear, measurable results will help you get larger budgets in the future, too.
Originally published in CSO Magazine.