Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

How do we…

How do we turn a budget request into a decision the board can make?

5 decision pointsThe pack behind this answer: Board Cybersecurity Reporting

Add to board memo

The short answer

Recommendation
Write the request as a decision the board can take, not as a need. Tie it to a named risk in business terms, give at least two real options with their costs, recommend one, and state what stays true if the board defers.
Reasoning
"We need more investment in security" gives the board nothing to decide. An ask with no options is only a request to approve, and an ask with no cost cannot be weighed against other uses of the money. Stating the risk in business terms (the service, the harm, a cost range with its basis and a likelihood word) lets directors weigh it against other business risks. Stating the risk of not deciding turns a deferral into a visible choice, recorded as such, not a quiet default. A director should be able to decide from the ask alone.
Considerations
  • The six parts of an ask are the structure the CISO Times board reporting pack recommends: the decision, why now, the options, the recommendation, the risk of not deciding, and who has agreed. Your board's own paper format may add fields.
  • The board decides appetite, priority, money above management's authority, and risk acceptance above tolerance. Choosing a product, a supplier or a project plan is management's decision, through its own budget route.
  • If the risk is past its tolerance limit, or you do not know where it stands, the options must show the board's three choices: fund or order treatment, accept the risk explicitly and record why, or change the appetite.
  • If you cannot yet name the service, the harm and a cost range, the request is not ready. Put the risk through your risk register first.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
  • Loop back
StartYou need money the board has to approveDecisionIs this a decision for the board rather than management?OutcomeTake it through management's own budget routeDecisionCan you state the risk as service, harm, cost and likelihood?OutcomeNot ready: work out the risk before you askDecisionIs the risk past its tolerance limit?StepOffer the board's three choices among the optionsStepWrite the decision in one sentence, starting with a verbStepSay why this meeting, not the nextStepGive at least two real options, one may be to do nothingStepRecommend one option, with the reason in a sentenceStepState the risk of not decidingStepHave the sponsor, finance and legal see it firstDecisionCould a director decide from the ask alone?StepPut it in the Ask part, with items to note listed apartDecisionDid the board take the decision at the meeting?OutcomeMinute the decision and follow its actions until closedOutcomeMinute the deferral, and report the risk it leaves

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 18 steps.

  1. Start

    You need money the board has to approve

    'We need more investment in security' gives the board nothing to decide. A board acts by deciding. An ask with no options is only a request to approve, and an ask with no cost cannot be weighed against other uses of the money.

    In the pack

  2. Decision

    Is this a decision for the board rather than management?

    The board decides appetite, priority, money above management's authority, and risk acceptance above tolerance. Choosing a product, a supplier or a project plan is management's decision. Where the top approver sits depends on how you are governed: the board, or a risk committee it has delegated to; the management board in a two-tier structure; executive management where there is no board.

    In the pack

  3. Outcome

    Take it through management's own budget route

    Asking the board to choose a product or approve a project plan is a common failure. Let management decide within its authority. The board sees the result through programme delivery against the plan it approved.

    In the pack

  4. Decision

    Can you state the risk as service, harm, cost and likelihood?

    Name the service a director recognises, the harm to customers, operations or legal position, a cost range with its basis, and a likelihood word: Unlikely, Possible, Likely or Almost certain. Agree the per-day cost figures with finance. A risk that cannot be written this way is not yet understood well enough to put in front of the board.

    In the pack

  5. Outcome

    Not ready: work out the risk before you ask

    Put the risk through your risk register first, with its owner. 'Ransomware' or 'third-party risk' in general names a threat, not a risk to your services. Come back when you can name the service, the harm and a cost range.

    In the pack

  6. Decision

    Is the risk past its tolerance limit?

    Tolerance is the point at which the board said it must act, not just be told. Past it, the board must choose, and the ask carries that choice. If you do not know where the risk stands, treat it as past tolerance until the register says otherwise.

    In the pack

  7. Step

    Offer the board's three choices among the options

    When a risk is outside tolerance, the board must decide between funding or ordering treatment, accepting the risk explicitly and recording why, or changing the appetite. Build the options so each of these is visible.

    In the pack

  8. Step

    Write the decision in one sentence, starting with a verb

    Use a verb the board can do: decide, approve, accept, set, choose. For example: 'Approve €180,000 to rebuild the ordering platform's recovery so it can be restored within 24 hours?'

    In the pack

  9. Step

    Say why this meeting, not the next

    Name the risk it addresses, in business terms, and what makes this the moment: a peak season, a contract date, a risk that has moved. Without a reason for now, deferral looks free.

    In the pack

  10. Step

    Give at least two real options, one may be to do nothing

    For each option, state what it achieves, what it costs once and per year, and when it takes effect. A partial option can help, as in the pack's example: fund the most urgent part now and the rest in the next budget. 'Do not approve; accept the risk' is a real option and belongs on the list.

    In the pack

  11. Step

    Recommend one option, with the reason in a sentence

    Link the reason to the risk and to appetite. For example: it brings the ransomware risk back within appetite this year, at a fraction of one week's lost orders. A recommendation with no reason is easy to defer.

    In the pack

  12. Step

    State the risk of not deciding

    Say what stays true if the board defers: which risk stays where, for how long, and whether that is inside appetite. This turns a deferral into a visible choice that is recorded as such, not a quiet default.

    In the pack

  13. Step

    Have the sponsor, finance and legal see it first

    Before the meeting, the executive sponsor reviews the ask, finance checks the costs, and legal sees it where the law is involved. Say in the ask who has agreed it. Prepare for 'what would you do with more money?' with a short, costed list ranked by risk reduced.

    In the pack

  14. Decision

    Could a director decide from the ask alone?

    Check for all six parts: the decision, why now, the options, the recommendation, the risk of not deciding, and who has agreed. Remove anything technical. If a part is missing or you are unsure, fix it before the papers go.

    In the pack

  15. Step

    Put it in the Ask part, with items to note listed apart

    The Ask is the last of the report's four parts, after the board has seen the position, the trend and the exposure. Things the board is only asked to note go in a separate short list after the decisions, so its time goes on what it must decide.

    In the pack

  16. Decision

    Did the board take the decision at the meeting?

    The board may approve an option, choose another, or defer. Each outcome is a decision and belongs in the minutes.

    In the pack

  17. Outcome

    Minute the decision and follow its actions until closed

    Record the decision and each action with an owner and a date in the board's action log. Report on them at each meeting until they close. Show delivery against the approved plan, and the risk as it moves back within appetite.

    In the pack

  18. Outcome

    Minute the deferral, and report the risk it leaves

    A deferral is a choice, and the minutes should show it with the risk of not deciding. The risk stays where it is in the Position and Exposure of the next report. If it is still outside appetite after two reports, expect the board to ask why, and bring a fresh ask or a recommendation to accept it formally.

    In the pack

    See also

Practical checklist

  1. Confirm the decision belongs to the board and not to management.
  2. State the risk as service, harm, a cost range with its basis agreed with finance, and a likelihood word, and check where it stands against appetite and tolerance.
  3. Write the decision in one sentence, starting with a verb the board can do, and say why this meeting and not the next.
  4. Give at least two real options, one of which may be to do nothing. For each, state what it achieves, its cost once and per year, and when it takes effect.
  5. Recommend one option, with the reason in a sentence linked to the risk and to appetite.
  6. State what stays true if the board defers, for how long, and whether that is inside appetite.
  7. Have the executive sponsor review it, finance check the costs, and legal see it where the law is involved.
  8. Put it in the Ask part, with items to note listed separately, and minute the decision or the deferral.

Evidence to have ready

  • The ask as presented, with its six parts.
  • The risk register entry for the risk it addresses, and the cost basis agreed with finance.
  • The minute recording the decision or the deferral, with the risk of not deciding.
  • The action log, following each agreed action with its owner and date until it is closed.

Assumptions

  • The request is for money above what management can approve on its own, or needs the board to change priority or accept a risk.
  • You have a risk register and, ideally, a risk appetite the board has approved.
  • The six parts of an ask are the structure recommended in the CISO Times board reporting pack. Your board's own paper format may add fields.

Not covered here