CISO在预算谈判中赢得董事会支持的指南.pdf

1、Winning Over the Board During Budget ConversationsChris Wheeler,CISO,ResilienceSANS Cybersecurity Leadership Summit 2026Agenda201Speaker Intro02The Current State of Security Budgets03Budgeting amid Flat Growth04Building Defensible Budgets05Anticipating and Funding Emerging Risks06Speaking the Boards

2、 Language07Q&ASpeaker IntroductionChrisWheeler3Chief Information Security Officer,ResilienceTRENDSecurity budget growth is lagging behind IT and operational spending.4The Current State of Security BudgetsPERCEPTIONBoards view cybersecurity as a cost center,not an operational driver.IMPLICATIONCISOs

3、are under pressure to do more with less.*5Your Situation May Differ11.9%2024%IT Spend 110.9%2025%IT Spend 150%Headcount cost as%of budget 1,339%Flat Growth 2025 177.8%Compliance/Reg as Budget Justification 230-40%Software cost as%of budget 1,3Budgeting Amid Flat Growth6What Is Your Security Objectiv

4、e?7Are We Secure To All Possible Threats?8Are We Resilient To Material Losses?910Having the Right ObjectivesOBJECTIVEWin the World SeriesGOALIn one year with a quarter budgetSTRATEGYBuy undervalued assetsTACTICSMaximize walks11The New Material Objective For SecurityOBJECTIVEResilient to material los

5、sGOALKeep losses(and costs)within business toleranceSTRATEGYMaximize returns on security initiativesTACTICSImplement a Quantified Cyber Action Plan11Building Defensible BudgetsUNDERSTANDING YOUR RISKWhat does the Loss Exceedance Curve tell you?13UNDERSTANDING YOUR RISKExamples of Risk Projection pre

6、dictions14UNDERSTANDING YOUR RISKRisk Mitigation:Lowering the Probability of LossImplementing the Cyber Action Plan(CAP)can lower the size and likelihood of predicted losses.1516UNDERSTANDING YOUR RISKSignificant Loss:$250,000 or moreSignificant Loss is a pote