GOV-4

Risk-Informed Planning and Budgeting

Strategy

Control Statement

The organization considers cyber risk compliance requirements, identified risks, current and emerging threats, and potential incident related impacts on operations and services, as inputs to planning and prioritizing cyber risk projects, programs and budgets.

Description

Effective cyber risk management requires that investment decisions are informed by a comprehensive understanding of the risk landscape. This control ensures that project prioritization, program development, and budget allocation are driven by actual risk data rather than ad hoc decision-making. By systematically incorporating compliance requirements, risk assessment results, threat intelligence, and incident impact analysis into planning processes, the organization can direct finite resources toward the highest-priority risk reduction activities.

Key Implementation Activities

  • 1 Integrate outputs from risk assessments, threat intelligence, and compliance gap analyses into the annual cybersecurity planning and budgeting process
  • 2 Develop a risk-based prioritization methodology for cyber risk projects and programs that considers likelihood, impact, and velocity of identified risks
  • 3 Quantify potential operational and financial impacts of cyber incidents to support business case development for risk reduction investments
  • 4 Establish a process to reprioritize projects and reallocate budgets in response to significant changes in the threat landscape or risk posture
  • 5 Report to executive leadership on how cyber risk investments map to risk reduction outcomes and compliance obligations

Evidence Examples

  • Annual cyber risk program plan showing prioritized initiatives with risk-based justifications
  • Budget documentation linking funding allocations to identified risks, compliance requirements, or threat mitigation
  • Risk-based prioritization criteria and scoring methodology documentation
  • Evidence of mid-cycle reprioritization decisions driven by emerging threats or incident impacts
  • Executive reporting showing cyber risk investment alignment with risk reduction objectives

Maturity Levels

Level 1 Initial

Budget and project decisions are driven by vendor proposals, audit findings, or executive requests rather than a systematic analysis of risk. Limited connection between risk assessments and resource allocation.

Level 2 Managed

A defined process exists to incorporate risk assessment results, compliance requirements, and threat intelligence into planning. Budgets are justified with risk-based rationale and reviewed by leadership.

Level 3 Optimized

Cyber risk investments are continuously optimized using quantitative risk analysis, real-time threat intelligence, and measurable risk reduction outcomes. Dynamic reallocation mechanisms respond to changes in the threat landscape.

Evidence Requirements View all evidence

Type Evidence Item Frequency Level
Document Annual Cyber Risk Program Plan with risk-based project prioritization Annually Required
Document Risk-based prioritization methodology and scoring criteria Reviewed annually Required
Document Budget documentation linking allocations to identified risks and compliance requirements Annually Required
Record Risk assessment outputs used as planning inputs (risk register extracts, threat intelligence summaries) Per planning cycle Required
Record Mid-cycle reprioritization decisions with documented rationale As occurred Expected
Record Executive reports showing investment-to-risk-reduction alignment Quarterly Expected

Framework Mappings

NIST CSF 2.0

GV.OC-04 GV.RM-04 ID.RA-06

ISO 27001:2022

5.1 6.1.1 6.2 7.1

COBIT 2019

APO02.04 APO05.01 APO06.01 BAI01.01

FFIEC CAT

Governance - Budgeting and Staffing