Approving a Cyber Budget Increase: A Board Decision Frame

A request for more cyber funding should explain what changed, which risk response the money enables and how management will show whether it worked. More spending is not itself evidence of a better outcome.

The board's decision is also not a blanket judgment that security deserves more or less money. It is a choice about resources, delivery and the exposure the business will retain if the request is approved, reduced or deferred.

This cybersecurity budget approval frame focuses on the incremental request. The fixed-budget portfolio example addresses a different question: how to choose among options when the envelope does not change.

Key takeaways

• Explain the change that makes additional funding necessary.

• Connect each requested line item to a risk scenario and outcome.

• Include recurring costs, internal capacity and dependencies.

• Compare a credible alternative and the effect of deferral.

• Agree on outcome evidence and review points before approval.

Step 1: Establish what changed

Separate a new exposure from an underfunded existing obligation, a delayed project and a price increase for unchanged scope. Each can justify attention, but they require different explanations.

Ask why the current plan cannot address the issue and whether earlier assumptions were wrong. This should support a better decision, not punish management for revising a forecast when evidence changes.

NIST CSF 2.0 links resource allocation to risk strategy, roles, responsibilities and policies. It does not prescribe a spending percentage. A benchmark can provide context, but it cannot establish what this business needs to fund.

Step 2: Connect the request to outcomes

For each material line item, identify the scenario, current control gap, intended change and evidence that will demonstrate effect. Distinguish delivering a capability from proving it operates.

A new monitoring service may increase coverage. Its usefulness also depends on telemetry quality, triage capacity and an authorized response route. Funding the purchase without the dependencies can create an operating cost without the intended result.

Avoid presenting broad risk-reduction percentages that the evidence cannot support. Use specific outcome tests and make assumptions visible. NISTIR 8286B supports prioritizing responses in relation to enterprise objectives and risk strategy, not funding every proposed control equally.

Step 3: Use an incremental decision frame

This is a fictional request structure, not a quote, client example or actual funding recommendation. It intentionally contains no invented cost estimates.

Decision field	What management should provide	What directors can challenge
Reason for increase	Changed exposure, obligation, scope or delivery assumption.	Why the existing plan is insufficient.
Incremental cost	One-time, recurring and internal delivery costs, with uncertainty.	Whether the full commitment is visible.
Intended effect	A defined change in the priority risk scenario.	Whether the proposed capability addresses the actual gap.
Dependencies	People, systems, providers and change windows required.	Whether the funded plan can be delivered.
Alternative	Reduced scope, different response or changed sequence.	What exposure each option retains.
Review point	Evidence, owner and timing for assessing the result.	What happens if the expected effect is not demonstrated.

Use the same cost basis across options. A partial-year quote should not be compared with a full-year operating estimate without adjustment and explanation. Finance should validate the numbers and treatment of commitments.

Step 4: Test the alternative and the wait option

Ask management for a credible alternative, not a deliberately weak option designed to make approval inevitable. A staged response may reduce uncertainty, but its first phase can still create spending or contractual commitments. Make those explicit.

Deferral also needs a plan. Identify the risk owner, interim measures, review date and conditions that would require an earlier decision. Do not describe a refusal to fund as risk acceptance unless the authorized owner has made that decision.

Check delivery capacity across the portfolio. Several individually reasonable increases can depend on the same constrained team. The board should see the combined demand before approving dates that cannot all be met.

Step 5: Tie follow-up to evidence

Agree on what management will report after approval: delivered scope, operating coverage, outcome-test results, remaining gaps and changed assumptions. Do not wait for annual planning if a key dependency fails.

A missed outcome does not always mean the project was a poor decision. It means the next decision needs current facts. Stop, change scope or continue based on the evidence and the authority already granted, not on the pressure to protect a forecast.

Keep project completion separate from the risk conclusion. The budget line can be fully spent while the business exposure remains unresolved.

Sources

NIST, Cybersecurity Framework 2.0, GV.RR and GV.RM; NIST, NISTIR 8286B, prioritization and risk response. The incremental funding frame is an editorial recommendation, not a prescribed budget method.

Frequently asked questions

What percentage of revenue should cyber spending be?

No universal percentage settles this decision. Business model, exposure, obligations and existing capabilities matter. Use benchmarks as context, not proof that a request is appropriate.

Should every request promise a financial return?

No. Some responses address obligations, resilience or risk appetite without a reliable monetary return estimate. Explain the outcome and uncertainty rather than inventing a precise benefit.

Does approval authorize every related purchase?

Only within the actual delegated authority and approved scope. The decision record should distinguish the funding envelope from purchase, contract and implementation approvals.

What if management cannot measure risk reduction precisely?

It can still define observable outcomes and tests. State what those tests establish and what remains uncertain. Lack of perfect quantification is not a reason to substitute unsupported precision.

Closing

Ask for the changed fact, the deliverable response and the consequence of waiting. Approve a decision with follow-through, not a larger number with a reassuring label.