Skip to content
Cyber security roles
ASD ISMISM-0732

ASD ISM 0732 Manage and allocate cyber security budget

What it says

The CISO receives and manages a dedicated cyber security budget for their organisation.

Quoted as published. Everything else on this page is written by Control Stack.

What it means

In plain English

The CISO is responsible for handling the organisation's dedicated cyber security funds.

The Chief Information Security Officer (CISO) needs to oversee and manage a dedicated budget specifically for cyber security. This is important because having allocated funds ensures that the organisation can proactively protect its data and systems from cyber threats, rather than reacting only after an attack occurs.

Why it matters

If the CISO does not manage a dedicated cyber security budget, risk treatments and key security initiatives may not be funded, increasing the likelihood and impact of incidents and data loss.

How to implement

  1. The CISO should work with the finance manager to understand the total amount allocated for cyber security in the annual budget.

    They can do this by reviewing financial reports and discussing future projections for maintaining or improving cyber defences.

  2. The IT team should list all necessary security measures and tools required for the year.

    This includes software licences, staff training programs, and any external consultancy needed. By preparing a detailed wish list, they can help the CISO allocate the budget effectively.

  3. Managers in each department should identify any specific security concerns they have.

    They need to communicate these to the CISO during budget planning meetings so that funds can be distributed to address these particular risks.

  4. Procurement should be involved to ensure that all purchases related to cyber security comply with the organisation's buying policies.

    They should assist the CISO in negotiating contracts with vendors to get the best possible deals.

  5. The CISO should set up regular reviews of the cyber security budget to track spending and adjust priorities as needed.

    These reviews can help ensure that funds are not wasted and that high-risk areas are sufficiently protected.

Keep it running

Maintain a CISO-owned dedicated cyber security budget; review quarterly and reallocate to priority risk treatments, capability uplift, and emerging threats, with clear approvals and tracking of spend.

Evidence and audit

  1. Check 1 of 5What an auditor asks for

    Ask for

    The cyber security budget plan: Request a document that outlines the budget allocation for various security measures.

    Look at

    How funds are divided between different areas, such as software, training, and consulting.

    Good evidence

    Is a detailed breakdown showing alignment with the organisation's risk priorities.

  2. Check 2 of 5What an auditor asks for

    Ask for

    Meeting notes or minutes from budget planning meetings: These should show discussions and decisions about cyber security funding.

    Look at

    Records of who attended and the decisions made about budget allocations.

    Good evidence

    Includes specific actions to address risks discussed in the meetings.

  3. Check 3 of 5What an auditor asks for

    Ask for

    Procurement records for cyber security purchases: Request receipts or contracts related to tools and services bought. Check if the purchases align with budget plans and provide good value.

    Good evidence

    Confirms that spending matches planned budget items and priorities.

  4. Check 4 of 5What an auditor asks for

    Ask for

    Periodic budget review reports: Choose reports that track how well the budget is being utilised throughout the year.

    Look at

    How funds have been spent and any adjustments made.

    Good evidence

    Includes justified reallocations and tracks unspent funds or overruns effectively.

  5. Check 5 of 5What an auditor asks for

    Ask for

    Documentation on security risks identified and mitigations planned: This should tie back to budget allocations.

    Look at

    Specific risks addressed by budget decisions.

    Good evidence

    Details clear links between risks assessed, priorities set, and funds allocated to mitigate those risks.

Mappings

Closest match in ASD Essentials for enterprise IT: IT.GOV-04.1, Assign sufficient skilled personnel to run security controls and define role responsibilities, which partially overlaps with this control.

ASD Essentials

ASD Essentials for enterprise IT: 1 mapping

Mappings show how controls relate across frameworks. They do not imply full equivalence or certification.