The 18% Cut: Choosing What Not to Fund
The CISO of a mid-size property insurer is told to cut the security budget 18%, from $4.2M to $3.44M, after an underwriting loss. Four commitments compete: EDR renewal ($600k per year) due in 60 days, a PCI DSS assessment ($250k), and phishing-resistant MFA ($900k) promised in a customer contract with a nine-month deadline. A business unit wants to keep a claims system on an unsupported OS because migrating costs $1.1M; the system holds 400,000 policyholder records. The regulator arrives in seven months, and two of nine analysts have resigned. The CFO says to "just prioritize."
1. How should the CISO structure the budget decision rather than applying an across-the-board cut?
Read the worked answer
Build an obligation register before cutting anything. List every commitment with its driver: contract (MFA with penalty/termination exposure), regulation (PCI, regulator exam), and risk reduction (EDR). Classify each as non-discretionary, contractually committed, or discretionary.
Then force the tradeoff into business terms. For each item, state cost of funding, cost of not funding, and who bears it. EDR lapsing removes detection across the estate; PCI failure risks acquirer fines and card processing; the MFA commitment has a named customer and a date.
Account for capacity, not just dollars. With two analysts gone, funding five projects means delivering none well. Sequence work against the regulator timeline and the MFA deadline.
Present options, not a single memo. Option A funds obligations and defers the claims migration with compensating controls; Option B cuts EDR and accepts detection risk; Option C requests a partial restoration tied to the contract penalty. An across-the-board cut hides these choices, which is exactly why the CFO's instruction should be answered with a decision framework and named risk owners.
2. The business unit requests continued operation of the unsupported claims system. What should the CISO require before agreeing?
Read the worked answer
The request is a risk acceptance, not a technical decision, so treat it as one.
- Confirm authority. A claims manager generally cannot accept risk for 400,000 policyholder records. Route acceptance to the business owner with authority for that data, with CISO recommendation to the CRO or CEO if residual risk exceeds appetite.
- Require compensating controls. Network segmentation, restricted administrative access, virtual patching or vendor extended support, enhanced logging, and a tested restore path. Price these into the $1.1M comparison so the migration is judged fairly.
- Set a hard sunset. A dated migration commitment with milestones, not an open-ended exception. Review at 90 days.
- Document residual risk. State what remains after controls and what event would trigger immediate shutdown.
The CISO should not simply refuse, which pushes the system into shadow operation, nor silently accept, which transfers the loss to people who never agreed to it.
3. How should the CISO communicate the outcome to the board?
Read the worked answer
One page, in business language, structured as a decision request.
- Position: the 18% cut removes $760k; obligations consume $1.75M of the remaining budget, leaving a shortfall against the MFA commitment.
- Exposure: three named risks with likelihood, impact, and the obligation each violates. Avoid fear language; use ranges and cite the regulator timeline.
- Options: fund as proposed and accept documented risk; restore $400k to meet the MFA contract; or defer the claims migration and redirect $300k.
- Recommendation: one option with reasoning and what the board is implicitly accepting.
- Accountability: name the executive owner for each accepted risk and the review date.
The board's job is to choose among risks, not to approve a list of tools. The CISO's credibility comes from showing the arithmetic and refusing to pretend the cut has no consequence.