How should the board approve a cyber security budget?
By linking each item to a risk it reduces and a result it should produce. Ask for the budget in three parts: what keeps the basics running (backups, patching, multi-factor authentication, endpoint protection), what closes known gaps (for example, nobody watching the network at night), and what is optional. For each line, ask what happens if it is dropped and how you will know it works. Compare the total with your own estimate of what a day without systems costs, rather than with industry averages. Prefer tools with published prices and no long lock-in, so the cost is known in advance and can be stopped. NetSenX publishes its prices, from a Free plan with no time limit up to the Enterprise plan; the pricing page lists what each plan includes.
General information, not legal advice. National laws can add to the EU texts quoted here, for example deadlines, forms or reporting channels: check your own country's rules.
Read next
Related questions
- What is the difference between a security alert and an incident?
- How does a cyber incident affect the sale of a company?
- What is cyber risk appetite, and why should the board set it?
- Should the board get cyber security reports from IT or from outside?
- How do we know our IT provider is doing a good job on security?