The Budget Conversation Your Board Actually Needs to Have

This grounds the entire conversation in a real number instead of a feeling. As covered earlier in this series, a realistic planning range for organizations under 50 employees is roughly $15,000 to $200,000, consistent with insurance claims data showing an average of about $142,000 per incident for organizations under $50 million in revenue. Much of that is driven by fixed costs like forensics and legal work that do not shrink with organization size.

A strong answer references that range specifically. A weak answer either has no number at all, or reaches for the $4.99 million global average that has little to do with an organization this size.

This question surfaces the shelfware problem from the previous post directly. A strong answer can name what was purchased, confirm it is actually configured and in use, and identify who is responsible for maintaining it. A weak answer is a list of line items with no visibility into whether any of them are actually working.

Research on this pattern is not encouraging: a 2015 Osterman Research study found that roughly 28 percent of security software spending went underused or unused. A board that has never asked this question has no way of knowing whether that statistic applies to its own budget.

Total security spending is a much less useful question than marginal spending. Doubling a budget that is already misallocated does not fix the misallocation. A strong answer can explain what specifically the next $1,000 or $5,000 would fund and why that is the current priority, following a sequence like the one covered in Post 2 of this series: identity and password controls first, then backups, then endpoint protection and training, then an independent review.

A weak answer treats the budget as a single lump sum with no internal logic to how it is spent, which is exactly the condition that produces the waste covered in the previous post.

As the previous post covered, security controls decay without maintenance. A strong answer treats security as a standing budget category, reviewed and funded every year, the same way insurance or facilities maintenance is. A weak answer describes a big push from a year or two ago with no ongoing commitment since.

This question also has a practical planning benefit. An organization that budgets for security annually, even a modest amount, avoids the far more expensive pattern of large, infrequent, reactive spending after something has already gone wrong.

This closes the loop on the entire series. A strong answer names a specific person who understands the reasoning behind the budget, not just the total, and can walk through the previous four questions without notice. A weak answer is that the number was approved because it looked similar to last year's, or because it fit inside a larger department budget with no individual scrutiny.

This is a governance responsibility as much as a financial one, the same principle covered in earlier leadership posts on this blog. A board does not need to become technical to exercise it. It needs to make sure someone who is accountable can answer these five questions, and that the board actually asks them.