Cyber Risk Program Plan

GOV-4 Plan

Governance Control: Risk-Informed Planning and Budgeting

1. Purpose

Document [ORGANIZATION]'s prioritized cyber risk projects, programs, and budget allocations for the planning period, with explicit linkage to identified risks, compliance requirements, threat intelligence, and potential incident impacts.

2. Scope

This plan covers all funded and proposed cyber risk projects, programs, and operational activities for [CUSTOMIZE: FY2025 / the current planning period], across all business units and technology environments.

3. Plan Content

3.1 Planning Inputs

3.1.1

This program plan was developed using the following inputs:

3.1.2

Cyber Risk Strategy objectives and strategic priorities (approved [CUSTOMIZE: date])

3.1.3

Current Cyber Risk Register including [CUSTOMIZE: number] active risks rated High or above

3.1.4

Regulatory Compliance Register gap analysis findings from [CUSTOMIZE: date] review

3.1.5

Threat intelligence assessment for [CUSTOMIZE: current year] identifying [CUSTOMIZE: top threat trends]

3.1.6

Incident trend analysis covering the period [CUSTOMIZE: date range] identifying [CUSTOMIZE: key incident patterns/impacts]

3.1.7

Business impact analysis identifying [CUSTOMIZE: number] critical business processes and their associated technology dependencies

3.1.8

Prior year program performance report showing [CUSTOMIZE: completion rate and key outcomes]

3.2 Risk-Based Prioritization Methodology

3.2.1

Projects and programs are prioritized using a weighted scoring model incorporating the following criteria:

3.2.2

Risk Reduction Impact (Weight: [CUSTOMIZE: 30%]): Degree to which the initiative reduces exposure to identified High and Critical risks

3.2.3

Compliance Obligation (Weight: [CUSTOMIZE: 25%]): Whether the initiative addresses a binding regulatory requirement or examination finding

3.2.4

Threat Relevance (Weight: [CUSTOMIZE: 20%]): Alignment with current and emerging threat trends relevant to [ORGANIZATION]'s sector

3.2.5

Business Impact (Weight: [CUSTOMIZE: 15%]): Potential operational and financial impact if the risk materializes without the initiative

3.2.6

Implementation Feasibility (Weight: [CUSTOMIZE: 10%]): Resource availability, technical complexity, and organizational readiness

3.2.7

Projects scoring [CUSTOMIZE: 7.0] or above on the 10-point scale are classified as Priority 1. Projects scoring [CUSTOMIZE: 5.0-6.9] are Priority 2. Projects below [CUSTOMIZE: 5.0] are deferred unless mandated by regulatory requirements.

3.3 Funded Programs and Projects

3.3.1

The following table summarizes approved programs and projects for the current planning period:

3.3.2

[CUSTOMIZE: Insert program/project table with columns: Project Name | Priority | Risk(s) Addressed | Budget | Timeline | Owner | Status]

Program/Project Priority Risk(s) Addressed Budget Timeline Owner
[CUSTOMIZE: Project 1] P1 [CUSTOMIZE: Risk IDs] [CUSTOMIZE: $] [CUSTOMIZE: Q1-Q3] [CUSTOMIZE: Owner]
[CUSTOMIZE: Project 2] P1 [CUSTOMIZE: Risk IDs] [CUSTOMIZE: $] [CUSTOMIZE: Q1-Q4] [CUSTOMIZE: Owner]
[CUSTOMIZE: Project 3] P2 [CUSTOMIZE: Risk IDs] [CUSTOMIZE: $] [CUSTOMIZE: Q2-Q4] [CUSTOMIZE: Owner]
[CUSTOMIZE: Project 4] P2 [CUSTOMIZE: Risk IDs] [CUSTOMIZE: $] [CUSTOMIZE: Q3-Q4] [CUSTOMIZE: Owner]

3.4 Budget Summary

3.4.1

Total approved cyber risk budget for [CUSTOMIZE: FY2025]: [CUSTOMIZE: $X,XXX,XXX]

3.4.2

Budget allocation by category: Personnel [CUSTOMIZE: XX%], Technology/Tools [CUSTOMIZE: XX%], Third-Party Services [CUSTOMIZE: XX%], Training [CUSTOMIZE: XX%], Contingency [CUSTOMIZE: XX%]

3.4.3

Budget allocation by strategic priority: [CUSTOMIZE: list priorities with allocated amounts]

3.4.4

Mid-year budget reallocation decisions will be made by [CUSTOMIZE: CISO/Executive Committee] based on changes to risk posture, emerging threats, or regulatory developments. Reallocations exceeding [CUSTOMIZE: $XX,XXX / 10%] require [CUSTOMIZE: CFO/Executive Committee] approval.

3.5 Performance Measurement

3.5.1

Program performance shall be measured quarterly against the following criteria:

3.5.2

Project milestone completion rate against planned timelines

3.5.3

Budget utilization versus planned allocation

3.5.4

Measurable risk reduction achieved (KRI improvement, risk ratings reduced)

3.5.5

Compliance gap closure rate

3.5.6

Program performance reports shall be provided to [CUSTOMIZE: Executive Risk Committee] quarterly and to [CUSTOMIZE: Board Risk Committee] semi-annually.

3.6 Reprioritization Process

3.6.1

The program plan may be reprioritized during the planning period in response to significant changes in risk posture, threat landscape, regulatory requirements, or incident impacts.

3.6.2

Reprioritization authority: Minor adjustments (within existing budget and timelines) may be approved by [CUSTOMIZE: CISO]. Material changes (budget reallocation, project addition/cancellation) require [CUSTOMIZE: Executive Committee] approval.

3.6.3

All reprioritization decisions shall be documented with rationale and communicated to affected stakeholders within [CUSTOMIZE: 5 business days].

4. Compliance

4.1

Compliance with this plan is mandatory for all personnel and functions within its scope. Compliance will be monitored through periodic audits, management review, and second line of defence oversight.

4.2

Exceptions to this plan must be documented with a business justification, approved by [CUSTOMIZE: CISO/Executive Risk Committee], and reviewed at least annually.

5. Review and Revision

5.1

This plan shall be reviewed at least annually by [CUSTOMIZE: CISO/Document Owner] and updated as necessary to reflect changes in the threat landscape, regulatory requirements, organizational structure, or risk appetite.

5.2

All revisions shall be documented with version number, date, author, and description of changes.

Document Approval

Approved By

[CUSTOMIZE]

Title

[CUSTOMIZE]

Date

[CUSTOMIZE]

Document Control

Version: [CUSTOMIZE: 1.0]
Effective Date: [CUSTOMIZE]
Last Reviewed: [CUSTOMIZE]
Next Review: [CUSTOMIZE]
Classification: Internal