Security Budgeting
Economic Cost of Information Security
Last Updated: March 9, 2026A mature information security strategy increasingly demands that cyber risk be expressed in financial terms rather than the qualitative ordinal scales, high, medium, and low,...
Right Sizing the Information Security Organization
Last Updated: March 9, 2026Defining the appropriate size of the information security organisation is one of the most consequential and frequently underestimated decisions an organisation makes in constructing its...
Approach: Using Data Breach Cost for Security Budgeting
Last Updated: August 21, 2026Estimating the cost of a data breach is not merely an exercise in quantifying potential losses. When approached rigorously and used deliberately, breach cost estimation...
Approach: Fixed Percentage of IT Budget
Last Updated: March 9, 2026The fixed percentage of IT budget approach is one of the most widely adopted methods for determining the information security budget, offering a straightforward and...
Approach: Regulatory Compliance-Driven
Last Updated: March 9, 2026The compliance-driven approach to security budgeting aligns the organisation’s security investment directly with the specific controls required to achieve and maintain compliance with applicable regulatory...
Approach: Top-Down & Bottom-Up
Last Updated: March 9, 2026Determining how to construct and present the information security budget is as important as determining its size. The process through which a budget is built...
Approach: Maturity-Based
Last Updated: March 9, 2026The maturity-based approach to security budgeting aligns the organisation’s security investment with a structured and progressive improvement of its security capabilities across defined domains, guided...
Approach: Risk-Based
Last Updated: March 9, 2026The risk-based approach to security budgeting is the most analytically rigorous and strategically coherent of the principal budgeting methodologies available to the ISO. Rather than...
Approach: Zero-Based
Last Updated: March 9, 2026Zero-based budgeting represents the most rigorous and analytically demanding of the principal security budgeting methodologies. Unlike incremental approaches that treat the prior year’s budget as...
Approach: Benchmarking Against Industry Peers
Last Updated: March 9, 2026The benchmarking-based approach to security budgeting uses comparative data from industry peers, sector surveys, and established market norms to calibrate the organisation’s security investment against...