712-50 Question 411
Single answerAnalyze, forecast and develop the operational budget of the security departmentA newly appointed CISO is preparing next year's operational budget for the security department of a global manufacturing company. The CFO has asked every department to justify budget increases because revenue is expected to remain flat. Over the past 12 months, the security team experienced a 40% increase in phishing-related incidents, higher cloud log ingestion costs due to expanded SaaS adoption, and repeated delays in vulnerability remediation because two analyst positions remained unfilled for six months. The board has also directed management to improve resilience against ransomware, but no new capital projects have been approved. Which approach should the CISO take to develop the most defensible operational budget proposal?
- A
Build the budget primarily by applying a standard percentage increase to last year's spending so the request aligns with the CFO's cost-control expectations.
- B
Develop a zero-based, risk-informed operational budget that ties personnel, monitoring, training, and third-party service costs to incident trends, business growth drivers, and board-prioritized resilience outcomes.
- C
Request the maximum possible budget increase across all security line items because ransomware risk is high and future threats are unpredictable.
- D
Exclude the impact of the vacant analyst roles from the budget forecast because unfilled positions reduced actual spending and improved last year's variance performance.
Show answer and explanation
Correct answer: B
Explanation
The best answer is the risk-informed, driver-based operational budgeting approach. At the CCISO level, the CISO is expected to forecast spending based on business activity, threat trends, control effectiveness, staffing capacity, and leadership priorities rather than rely only on prior-year spend. In practice, this means analyzing cost drivers such as incident volume, cloud expansion, licensing and log ingestion growth, required headcount, retention or outsourcing needs, awareness training, and response readiness. It also means translating board expectations, such as improved ransomware resilience, into operational line items that can be funded within OPEX if no capital projects are approved. This is consistent with generally accepted security governance and budgeting practices reflected in frameworks and guidance such as NIST CSF 2.0's emphasis on governance, risk-informed prioritization, and resource allocation; NIST SP 800-53 controls related to planning and resource management; and ISO/IEC 27001 concepts requiring resources appropriate to the information security management system. A defensible security budget is specific, measurable, linked to risk and business outcomes, and based on realistic operating assumptions.
- A. Incorrect.
This is incorrect because a simple percentage uplift from the prior year is easy to prepare but weak as a governance and planning approach when the threat environment, business operations, and resource constraints have materially changed. In this scenario, phishing volume, cloud consumption, staffing gaps, and resilience expectations have all shifted. CCISO-level budgeting should be based on operational requirements and risk exposure, not just historical spending patterns. A percentage increase may also underfund critical needs or fail to explain why certain line items should grow while others should remain flat or decrease.
- B. Correct.
This is correct because it reflects how a senior security leader should analyze, forecast, and develop an operational budget. A zero-based or at least driver-based budget forces justification of each major cost category rather than assuming prior allocations remain appropriate. Tying the request to measurable incident trends, cloud adoption, staffing shortfalls, training needs, and board-directed ransomware resilience creates a business-aligned case. It also distinguishes operational expenditures such as salaries, MSSP support, log management, awareness training, subscriptions, and response retainers from unapproved capital initiatives. This approach is defensible to the CFO because it links spending to operational demand, risk reduction, and resilience outcomes.
- C. Incorrect.
This is incorrect because although ransomware is a valid concern, asking for the maximum possible increase without prioritization, forecasting assumptions, or linkage to business drivers is not a credible budgeting practice. Executive budget proposals should demonstrate cost discipline, scenario analysis, and alignment to enterprise risk appetite and strategic priorities. Overstating requests can reduce credibility with finance leadership and the board, especially in a flat-revenue environment.
- D. Incorrect.
This is incorrect because vacancy-driven underspend should not automatically be treated as evidence that the function needs less funding. In this case, the unfilled roles contributed to remediation delays, indicating a capacity gap rather than excess budget. A mature CISO should normalize for known staffing shortages when forecasting next year's operating needs and explain the operational impact of under-resourcing. Ignoring that dependency would distort the budget baseline and weaken the case for sustainable service delivery.