The Security Questions That Belong in Every Capital Request

The new production line got approved in twenty minutes: payback period, capacity, vendor references. Six months later the line's controllers needed a network exception, a vendor VPN, and a monitoring exclusion, and the security team heard about all of it from the firewall logs.

This is how security debt is actually created: not by bad decisions, but by capital decisions made without the security line item. The cost of building security into a project at approval is a rounding error. The cost of retrofitting it after go-live is a project of its own, and it usually loses to next year's projects.

The fix costs nothing: four questions added to the capital request template, so every significant spend arrives with its security consequences already visible.

TLDR

• Security debt accumulates through capital approvals that never asked about security.

• Add four questions to the standard capital request form; do not create a separate review.

• Ask about connectivity, data, vendors, and decommissioning for every significant spend.

• The security budget line belongs in the project's business case, not in a later amendment.

• Review the questions' answers in the same meeting that approves the money.

Why the security question never gets asked

Capital templates are written by finance to compare investments: cost, return, payback, risk in the financial sense. Security is absent not because anyone decided against it, but because the template was inherited from a decade when the new asset was a machine, not a networked machine.

The result is a systematic blind spot. Every project team learns that security review is optional and late, and every year the environment inherits new systems whose security costs were never priced. The discussion of framing a cyber budget increase starts from the same recognition: the money is easier to defend when the need is visible early.

The four questions

The questions are deliberately plain, written for the project sponsor rather than the security team:

1. What does this connect to? Networks, cloud services, vendor remote access, data feeds. 2. What data does it create, hold, or move, and who owns that data? 3. Which vendors gain access to our environment or our information? 4. What does it cost to secure, monitor, and eventually retire this, and is that in the budget?

This fictional example shows the security section of a capital request for a warehouse automation project. It is an illustration, not a prescription.

Question	Answer	Security cost in budget
Connects to	Corporate network, vendor remote support	Segmentation: $18k
Data	Inventory and shipment data	Access controls: included
Vendors	Equipment maker, maintenance firm	Vendor review: $5k
Retirement	10-year life	Decommission reserve: noted

Keep it inside the existing process

The temptation is a separate security review board for capital projects, and it will fail: it adds a gate, projects route around it, and security becomes the department of slow. The questions work because they live inside the form every project already completes.

The security team's role shifts from gatekeeper to consultant: they help sponsors answer the questions well, and they see every significant project at the moment when shaping it is cheap. The comparison work in comparing cyber investments under a fixed budget becomes possible because the requests finally arrive with comparable information.

What changes in the first year

Three things typically happen. First, project teams start calling security early, because the form asks questions they cannot answer alone. Second, security costs stop arriving as surprises after approval. Third, the annual security budget conversation gains evidence: the requests that came through the process, with their costs, instead of a monolithic ask.

None of this requires new headcount or new committees. It requires editing one template and holding the line that the questions get answered.

The related discussion of cyber budget increase is worth your time alongside this one. The related discussion of comparing cyber investments is worth your time alongside this one.

Frequently asked questions

What spending threshold should trigger the questions?

Match your existing capital approval threshold. If a request is big enough to need executive sign-off, it is big enough to answer four security questions. Smaller spends can use a shortened version.

Who answers the questions if the sponsor cannot?

The security or IT team helps, which is the point: the conversation happens during planning. A sponsor who cannot answer any of the four is telling you the project needs that conversation before approval.

Does this slow down approvals?

In practice it speeds them up. Security objections surface while the design is still flexible, instead of as conditions attached to an approval everyone thought was final.

A Defensible Next Step

Find your capital request template and check whether the word security appears anywhere in it. If it does not, adding the four questions is this month's highest-leverage governance change. Book a Decision-Clarity Call if you want the questions tuned to your approval process.