Security icon

Build, Optimize, and Present a Risk-Based Security Budget

Get the budget you deserve.

Get Instant Access
to this Blueprint

View Storyboard

Solution Set Storyboard Thumbnail


  • David Tyburski, CISO, Wynn Resorts
  • Rich Mason, President & CISO, Critical Infrastructure, LLC
  • Robert Hawk, Information Security Expert, xMatters, Inc.
  • Sky Sharma, CIO
  • Steven Woodward, CEO, Cloud Perspectives
  • Year after year, CISOs need to develop a comprehensive security budget that is able to mitigate against threats.
  • This budget will have to be defended against many other stakeholders to ensure there is proper funding.
  • Security budgets are unlike other departmental budgets. Increases or decreases in the budget can drastically affect the organizational risk level.
  • CISOs struggle with the ability to assess the effectiveness of their security controls and where to allocate money.

Our Advice

Critical Insight

  • CISOs can demonstrate the value of security when they correlate mitigations to business operations and attribute future budgetary needs to business evolution.
  • To identify the critical areas and issues that must be reflected in your security budget, develop a comprehensive corporate risk analysis and mitigation effectiveness model, which will illustrate where the moving targets are in your security posture.

Impact and Result

  • Info-Tech’s methodology moves you away from the traditional budgeting approach to building a budget that is designed to be as dynamic as the business growth model.
  • Collect your organization's requirements and build different budget options to describe how increases and decreases can affect the risk level.
  • Discuss the different budgets with the business to determine what level of funding is needed for the desired level of security.
  • Gain approval of your budget early by preshopping and presenting the budget to individual stakeholders prior to the final budget approval process.

Research & Tools

Start here – read the Executive Brief

Read our concise Executive Brief to find out why you should build, optimize, and present a risk-based security budget, review Info-Tech’s methodology, and understand the four ways we can support you in completing this project.

1. Review requirements for the budget

Collect and review the required information for your security budget.

2. Build the budget

Take your requirements and build a risk-based security budget.

Guided Implementations

This guided implementation is an eight call advisory process.

Guided Implementation #1 - Review requirements for the budget

Call #1 - Determine which efficacy option is needed.
Call #2 - Review risk management work and the mitigation effectiveness assessment.
Call #3 - Review the security strategy and roadmap.

Guided Implementation #2 - Build the budget

Call #1 - Map business capabilities to security controls.
Call #2 - Input all costs including security controls, general expenses, and IT-system specific expenses.
Call #3 - Review three budget outputs based on bare minimum, standard practice, and ideal need, and discuss how to optimize.

Guided Implementation #3 - Present the budget

Call #1 - Develop budget stakeholder presentation.
Call #2 - Collect feedback and incorporate into the final budget request.

Onsite Workshop

Unlock This Blueprint

Book Your Workshop

Onsite workshops offer an easy way to accelerate your project. If you are unable to do the project yourself, and a Guided Implementation isn't enough, we offer low-cost onsite delivery of our project workshops. We take you through every phase of your project and ensure that you have a roadmap in place to complete your project successfully.

Module 1: Review Requirements for the Budget

The Purpose

  • Understand your organization’s security requirements.
  • Collect and review the requirements.

Key Benefits Achieved

  • Requirements are gathered and understood, and they will provide priorities for the security budget.




Define the scope and boundaries of the security budget.

  • Defined scope and boundaries of the security budget

Review the security strategy.


Review other requirements as needed, such as the mitigation effectiveness assessment or risk tolerance level.

Module 2: Build the Budget

The Purpose

  • Map business capabilities to security controls.
  • Create a budget that represents how risk can affect the organization.

Key Benefits Achieved

  • Finalized security budget that presents three different options to account for risk and mitigations.




Identify major business capabilities.


Map capabilities to IT systems and security controls.

  • Identified major business capabilities, mapped to the IT systems and controls

Categorize security controls by bare minimum, standard practice, and ideal.


Input all security controls.


Input all other expenses related to security.


Review the different budget options.

  • Completed security budget providing three different options based on risk associated

Optimize the budget through defense-in-depth options.


Finalize the budget.

  • Optimized security budget

Module 3: Present the Budget

The Purpose

  • Prepare a presentation to speak with stakeholders early and build support prior to budget approvals.
  • Present a pilot presentation and incorporate any feedback.
  • Prepare for the final budget presentation.

Key Benefits Achieved

  • Final presentations in which to present the completed budget and gain stakeholder feedback.




Begin developing a communication strategy.


Build the preshopping report.

  • Preshopping Report

Practice the presentation.


Conduct preshopping discussions with stakeholders.


Collect initial feedback and incorporate into the budget.


Prepare for the final budget presentation.

  • Final Budget Presentation

Member Testimonials

Unlock Sample Research

After each Info-Tech experience, we ask our members to quantify the real time savings, monetary impact, and project improvements our research helped them achieve. See our top member experiences for this Blueprint, and what our clients have to say.




$ Saved

Days Saved

Thompson Rivers University

Guided Implementation




McLaren Health Care Corporation

Guided Implementation




North Carolina Department of Information Technology

Guided Implementation




University of Wisconsin-Madison

Guided Implementation




CRH: Oldcastle Architectural Group

Guided Implementation




CRH: Americas Materials

Guided Implementation




South West Water Limited

Guided Implementation




Visit our COVID-19 Resource Center and our Cost Management Center
Over 100 analysts waiting to take your call right now: 1-519-432-3550 x2019