• United States




How to spend your cybersecurity budget increase

Nov 30, 20174 mins
BudgetingData and Information SecurityIT Leadership

You’ve been rewarded with a cybersecurity budget increase. But how do you decide how to allocate your new funds? It’s vital that you use a standards-based approach to measure your return on investment and get optimal improvement.

In “How to sell cybersecurity to your executive team,” I discussed strategies to sell cybersecurity to your board of directors, executives, and business leaders using a standards-based approach. Ultimately, this strategy would lead to you receiving a larger cybersecurity budget. Ample security budgets are rare, but by speaking the executive team’s language, using metrics and visuals, and getting outside verification, you’re bound to get the occasional healthy budget increase.

So, you’ve followed those steps, and have been rewarded with a larger security budget. Because no good deed goes unpunished, this forces a difficult question: what should you do with the money? Your budget won’t increase every year, so it’s important to make the most of the opportunity. It’s vital that you use a standards-based approach to allocate the funds to measure your return on investment and get optimal improvement.

Use framework to determine allocation

It’s important that you allocate new funds where they will bring your organization the most benefit. Use a framework like the NIST Cybersecurity Framework (CSF) or ISO 27001 to assess your strengths and weaknesses. Your new spending should improve an area of weakness. For example, if you have a high-quality intrusion detection solution, buying another detection solution won’t give you much more cyber strength for the money. Perhaps you’re weaker on your ability to recover from an emergency, and would be better served by a backup system that can get you operational (and profitable) quickly.

If you haven’t done such an assessment, consider third party consultants or a software solution like CyberStrong, which uses artificial intelligence to determine how you can get the most cyber improvement for the least investment, based on your specific situation.

I’ve discovered through our AI that many companies are spending plenty on technological solutions, but they are understaffed and not making the most of the technology. Perhaps your new funds would be better spent adding additional people who can develop things like better incident response plans, employee training programs, and disaster recovery plans. Be sure to balance technology and people. While quality firewalls and SIEMs are important, there is also a lot of low-hanging fruit that can strengthen your cyber resiliency for less cost.

Measure ROI

Russ Verbosky, CIO and CISO at the New Mexico Department of Game and Fish, says, “I keep reading that CISOs should report directly to the CEO. CISOs, therefore, should have their own budgets.”

The reality, however, is that most CISOs are not in total control of their budgets. For this reason, it’s important to demonstrate that you’re providing a strong return on the investment, which will help you continue to get budget increases in the future.

My preferred way to do this is to use quality metrics to measure your current cyber strength, and then demonstrate how much the spending will increase your cyber strength. At CyberSaint, we use the NIST CSF as our metric. For instance, perhaps right now we’ve completed 67% of the NIST CSF, therefore our cyber strength is 67. If we make investment level A, perhaps a medium investment, our cyber strength will increase to 75. If we have less to spend, we can eliminate these two specific items, perhaps security awareness training and insider threat program, and our cyber strength will only be a 71. But if we have additional funds to invest, we can add two specific items that will bump our cyber strength up to an 80, and we will be much more resilient.


This process turns cyber into a measurable business function. You and your board or executive team can decide: This is where we want to have our cyber program in less than one year. Instead of just picking solutions willy-nilly with unknown ROI, we’re now showing a clear return on investment to the board or executive team from this additional spending. And hopefully, seeing clear, measurable results will help you get larger budgets into the future, too.


Scott Schlimmer, CISSP is the co-founder of privacy startup ZenPrivata and is a decorated former CIA officer who has advised multinational companies on security and trained their security teams. Scott co-founded CyberSaint Security--a leading platform for cybersecurity risk and compliance--an was an advisor for SOC Prime. Scott served seven years with the CIA, where he advised the President of the United States, Congressmen, and Generals, and represented the US Government in meetings with foreign officials. He earned a National Intelligence Award for his work on terrorist threats to the homeland and was trained as a Senior Analyst by CIA and a European nation.

Scott also served on the Olympics Counter-Terrorism Task Force, preventing disruption to the 2010 Winter Olympic Games, and has worked at the White House and the Canadian House of Commons.

Scott is co-author of the book "Stories from Langley: A Glimpse Inside the CIA." He is a member of the Mensa high IQ society and (ISC)² as a Certified Information Systems Security Professional.

Scott earned a Master's Degree in Public Policy and a Bachelor's in Political Science from the University of Michigan.