Strategic Planning, Finance, and Vendor Management
Domain 5 (Strategic Planning, Finance, and Vendor Management) tests business fluency: aligning security strategy to business strategy, defending spend in financial terms, and managing third-party risk through the whole contract lifecycle. Answers must sound like an executive, not a technician.
Strategy alignment
- Derive the security strategy from business direction: merger and acquisition activity, cloud migration, new markets, and new products all create obligations. Use SWOT and a capability maturity target to shape a multi-year roadmap.
- Translate security into business outcomes: revenue protection, faster deal closures through completed security questionnaires, and reduced regulatory exposure.
Finance for the CISO
- Distinguish CAPEX (capitalized platforms) from OPEX (subscriptions, staff); compare options on total cost of ownership over three to five years including run costs and headcount.
- Justify spend with ALE reduction, then use NPV to compare multi-year alternatives, and state the do-nothing option explicitly.
- A business case contains: problem, options with costs, risk reduction, recommendation, and the decision owner. Chargeback and showback models allocate cost to business units and change consumption behavior.
Vendor management lifecycle
- Tier vendors by data sensitivity and operational criticality; tier drives due diligence depth.
- Due diligence: SOC 2 Type II, ISO/IEC 27001 certificate, penetration test summary, financial stability, breach history, and subprocessor list.
- Contract clauses that matter: right to audit, breach notification timelines, data ownership and return or destruction, subprocessor approval (fourth parties), SLA with remedies, and termination assistance with an exit plan.
- Monitor continuously with annual reassessment and refreshed attestations; track concentration risk where one provider supports many critical services.
Worked example
A SaaS HR platform holding employee personal data is procured through a weighted RFP: security 30, functionality 25, cost 20, support 15, roadmap 10. The lowest-priced bid scores well on cost but fails mandatory requirements: no SOC 2 Type II, no right to audit, no subprocessor list, and data stored outside the approved region. Mandatory requirements are applied before scoring, so the bid is excluded. The selected vendor's contract is amended with breach notification within 72 hours, regional data residency, audit rights, and a data export and deletion clause for exit.
Traps that cost marks
- Selecting the cheapest bid, or scoring price before eliminating failed mandatory requirements.
- Treating a vendor certificate as transfer of risk; accountability stays with your organization.
- Omitting right to audit, exit assistance, or fourth-party disclosure.
- No named internal owner for vendor risk, or no reassessment date.
- Presenting security spend as a cost center with no risk-reduction figure attached.