Security Budget Benchmarks: Inside the Sausage Factory

You wanted numbers. You got numbers. But ingest security budget survey benchmarks at your own peril.

December 09, 2002 — CSO — Information security is often called a "grudge spend." CEOs are reluctant to spill hard-earned ducats on security because it's not seen as a value-added expenditure. Yet CSOs fret that they're not spending enough to secure the enterprise—and nobody knows what "enough" really means, anyway.

So a typical strategy in the security budget-setting process is to eyeball your neighbors' plans to see how much they're spending. Just to make sure you're in the right ballpark.

So you want numbers? We got numbers. Gleaned from a security spending survey of 276 CIOs and IT executives, these figures line up pretty well with conventional wisdom. Consultant Karen Avery of Booz, Allen & Hamilton advises security spending should constitute between 5 percent and 8 percent of the IT budget, and our respondents clocked in at an average of 7.2 percent.

But use these numbers at your own peril because CSOs say rough benchmarks of this sort offer a very false sense of, well, security.

There are two reasons for that. First, survey numbers suffer from the sausage effect: You just don't know what's in there. Companies vary greatly in what they include in the security budget proper. How do you account for IT staff whose duties include security along with other tasks? What about e-mail training for new employees? Your company may have a clear sense of how to answer those questions, but it's unlikely to match the policies of a majority of respondents in any given survey. Andy Reeder, CSO of Central DuPage Health, says that in some organizations even basic security items like firewalls and antivirus aren't part of the security budget. "The security office may help manage those things, but they're budgeted and implemented through the IT operational arm," he says. "It's a judgment call."

Many organizations, in fact, don't even craft a separate security budget. Steve Akridge had one of the more frustrating setups as CISO of the Georgia Technology Authority (GTA): The state senate approved a specific allocation for information security, but the money was then rolled into the GTA's IS budget. "I had to lobby the CIO to get access to money that had already been approved by the state," he says.

Another problem is that, unless you're looking at an incredibly detailed survey of best practices companies, you don't know how effectively, or appropriately, the respondents are spending their cash. "I read somewhere that the average infosecurity spending this year was 12 percent of the IT budget. But it's all so highly dependent on what you're doing as a company," Akridge says. He describes a formal sequence for building an appropriate information security plan and says many companies fail to follow the necessary steps.