Information Security is something that every business must take into account. With the many perils in play, it is vitally important that organizations implement a security program tailored to their needs. We recommend creating and maintaining a complete holistic Security Operations Program (Security Program) and develop an annual budget for the program’s implementation and ongoing improvement.
The challenge many IT professionals face when developing a Security Program and securing budget for it is that 36% of senior executives do not consider their organization’s Security Budget to be a priority issue (Ponemon Institute: 2015 Global Study on IT Security).
The key to getting your executives to buy into your security budget is making it risk-based, which means clearly presenting them how each budget item changes the overall risk level of your organization. By focusing on how different budget allocations can change the organization’s ability to address risk, it becomes easier to provide more compelling answers to business stakeholders about the budget(s) your present.
In this blog, we will look at how you can tailor your security budget to your organization’s risk and demonstrate to senior management the value your budget has, all in a language they will understand and be happy to buy into. If you want more tips on how to efficiently get your senior management’s support on your security project, here is another blog you will find helpful: Security Metrics Program – how it can help you get your senior management’s buy-in!
Are you just starting to develop a Security Program? Get in touch with us so that we can run a simple security assessment. It will give you a complete picture of your security status and, in turn, help you realize the correlation of risk to your Security Program and your budget. If you need more answers first, this blog will give you a good head start.
Tips – how to get your executives’ approval on your security budget
Every organization must deal with an annual budget process and this is no less true for funding your Security Program. Yet, despite security being a large priority for most organizations, there is a general lack of preparation into creating an annual security budget and an even lower interest by senior executives. If you can’t adequately articulate the value of a Security Program to your organization, there is less likelihood of senior executives allocating funds to security initiatives.
- Tip #1. Present your security budget based on the level of risks (i.e. develop risk-based budget)
One of the most efficient way to adequately articulate your proposed Security Program’s value is to build your security budget with a view into the risks your organization faces. Develop a comprehensive corporate risk analysis and mitigation effectiveness model. This will show the moving targets in your Security Program and help identify critical issues to include in your budget proposal.
By focusing on how different budget allocations can change your organization’s ability to address risk at the organizational level, you can communicate the value of your Security Program to your organization’s business stakeholders.
- Tip #2. Demonstrate security is a COGS to your organization
Another efficient way you can present your budget is to frame your language in terms of Cost of Goods Sold (COGS). COGS is an important business metric that describes the costs needed for the production of goods or services that are produced by an organization.
Most executives see security solely as a function of the IT or security department instead of being integral to every business operation. By developing a risk-based budget (following tip #1), you can tangibly demonstrate that security really is a COGS to the business.
Your Risk-based Budget should tangibly demonstrate the value of security when mitigations are correlated to business operations and any future budgetary needs are properly attributed to your organization’s evolution. This is one of the best ways you can move your organization’s thinking about security to a COGS for the business.
Build your security budget – take a 3-phase approach
- Phase 1. Assess your current environment, define your organization’s security risk tolerance level, and build a holistic Security Program.
In this first phase, you will assess your current security status and define your security risk tolerance level. These will help you define security metrics that can help you meet your security requirements going forward. Based on the outcome of these steps, you will be able to build a holistic Security Program.
- Phase 2. Build your security budget
You’ll analyze the metrics you gathered in Phase 1 as well as identify how security controls relate to your IT systems and business capabilities. We suggest you identify two or three risk profiles and create a budget for each to give your senior executives several options to consider. This will also help demonstrate how changes to the budget can change the risk levels accordingly.
- Phase 3. Present and get an approval on the budget.
This is where you present your budget scenarios to the business and financial stakeholders of your organization. Our recommendation is to “pre-shop” your budget scenarios by holding one-on-one sessions with stakeholders prior to your final group presentation. These earlier sessions will give you valuable feedback to make budget updates as needed.
Understand How Your Risks Can Map to Your Budget
Working with a team of highly experienced security exports is the most cost-effective and efficient way to define and understand your risks and how to map them to a risk-based budget. Armed with this knowledge, you will have the tools to create risk profiles and develop a budget scenario for each. The result is that you can show your senior executives and financial approvers how different levels of risk will affect your organization as a whole and not just at the IT level.
Let your budget process be a win-win for your organization. Whether you are just beginning your budgetary process, or are at the stage of developing a budget, we can help you build and implement your Security Program and get your security budget approved. Contact us today.
Related:
