A good cybersecurity budget funds the controls that stop the most common attacks first, then the obligations that insurers, auditors and customers will check, then the governance that keeps the program working. This checklist walks through what to fund first for 2027, what is now commonly required, and how to justify the spend to your board.
Budgets set in the fourth quarter decide what actually happens next year. Use the checklist below with your IT lead, your finance team and whoever owns security risk.
How should you approach the 2027 security budget?
Start from risk, not from a product list. Before allocating money, answer four questions:
- What data and systems would hurt most to lose, or to have exposed?
- What do our cyber insurer, our customers and our regulators require us to have?
- What did our last risk assessment, penetration test or audit find, and what is still open?
- Who owns security decisions, and do they have the time and authority to make them?
If you cannot answer these, the first line item is a risk assessment. It turns a list of worries into a prioritized, costed roadmap.
What should you fund first?
- Identity and MFA. Enforce multi-factor authentication on email, remote access, cloud admin portals and privileged accounts. Remove stale accounts and excess admin rights. See Identity and Access Management for SMBs.
- Endpoint detection and response with 24/7 monitoring. A tool that alerts at 2 a.m. on Saturday only helps if someone is watching. Budget for the monitoring, not just the license.
- Backups you have tested. Keep copies offline or immutable, protect backup credentials separately and restore from them on a schedule. Backup and disaster recovery are different line items.
- Patching and vulnerability management. Fund scanning and the people time to fix what it finds, prioritized by real risk. Our guide to risk-based vulnerability management explains how.
- Email security. Phishing and business email compromise remain common entry points. Budget for filtering, authentication (SPF, DKIM, DMARC) and payment-verification procedures.
- Incident response readiness. A written plan, a tabletop exercise and outside help arranged in advance. An incident response retainer means you are not negotiating terms during a crisis.
- Security awareness training. Short, regular training plus phishing simulations, with attention to AI-assisted social engineering and deepfake payment fraud.
- Security leadership. Someone has to own the roadmap, report to leadership and hold IT providers to a standard. For many SMBs that is a fractional or virtual CISO; see what a fractional CISO costs.
What do insurers and auditors now require?
Requirements vary by insurer, framework and contract, so treat this as a checklist to verify against your own documents, not a definitive list.
| Requirement | Who commonly asks | Evidence to budget for |
|---|---|---|
| MFA on email, remote access and privileged accounts | Cyber insurers, NYDFS Part 500, SOC 2 auditors, enterprise customers | Policy settings, coverage reports, exception list |
| Endpoint detection and response | Cyber insurers, enterprise customers | Deployment coverage, monitoring arrangement |
| Offline or immutable backups, tested restores | Cyber insurers, auditors | Backup architecture, restore test records |
| Asset inventory | NYDFS Part 500, CIS Controls, SOC 2 auditors | Maintained inventory and written procedure |
| Patching and vulnerability management | Insurers, auditors, customers | Scan reports, remediation timelines, exceptions |
| Incident response plan and testing | Insurers, regulators, auditors | Current plan, tabletop records, retainer |
| Security awareness training | Insurers, auditors | Completion records, phishing simulation results |
| Third-party risk management | Regulators, auditors, customers | Vendor inventory, assessments, contract clauses |
| Governance and leadership oversight | Regulators, auditors, boards | Named owner, policies, board reporting |
Two shifts are worth noting. The NIST Cybersecurity Framework 2.0 added a Govern function, which puts strategy, roles, policy, oversight and supply chain risk alongside the technical work. And under the amended NYDFS cybersecurity regulation, the expanded MFA and asset inventory requirements took effect on November 1, 2025 for covered entities; see our NYDFS Part 500 compliance page. If you are pursuing SOC 2 to win larger customers, plan the audit and the readiness work together; our SOC 2 readiness service and cyber insurance requirements guide go deeper.
How do you justify security spend to the board?
- Lead with risks, not tools. "Ransomware could stop billing for two weeks" lands better than "we need a new EDR platform."
- Connect spend to obligations the business already has. Insurance eligibility, customer contracts, regulatory requirements and audits are not optional.
- Show what each item reduces. Map line items to the risks they lower and the gaps from your last assessment.
- Use a recognized framework. Reporting against NIST CSF 2.0 or the CIS Controls gives directors a consistent yardstick year over year.
- Show revenue impact. Passing security questionnaires and SOC 2 audits can shorten sales cycles with larger customers.
- Report a few metrics consistently. MFA coverage, EDR coverage, time to patch critical vulnerabilities, backup restore success and training completion.
- Be honest about residual risk. State what the budget does not cover and who accepted that risk.
Cybersecurity budget planning checklist
- Risk assessment completed or scheduled, with a prioritized roadmap
- MFA enforced on email, remote access, admin portals and privileged accounts
- EDR deployed on all endpoints and servers, with 24/7 monitoring
- Backups offline or immutable, with restore tests on a schedule
- Vulnerability scanning and patching resourced, with target timelines
- Email security and payment-verification procedures in place
- Incident response plan updated, tabletop exercise scheduled, retainer in place
- Security awareness training and phishing simulations budgeted
- Vendor and SaaS inventory reviewed for third-party risk
- Unsupported systems (for example Windows 10) replaced or documented
- Insurance renewal requirements reviewed against current controls
- Named security owner and a reporting cadence to leadership
Common budgeting mistakes
- Buying tools without funding the people or service to run them.
- Cutting incident response readiness because "nothing happened last year."
- Treating compliance as the whole program.
- Leaving security leadership unassigned, so nobody owns the roadmap.
- Rebuilding the budget from scratch each year instead of tracking progress against the roadmap.
Frequently Asked Questions
What should we fund first in a cybersecurity budget?
Fund the controls that stop the most common attacks and that insurers check: MFA everywhere, endpoint detection and response with 24/7 monitoring, tested backups, patching and vulnerability management, and email security. Then fund incident response readiness and governance.
How much should a business spend on cybersecurity?
There is no reliable universal percentage. Size the budget to your risks, your regulatory and contractual obligations, and the gaps found in a risk assessment, then compare it with the cost of a realistic incident.
What security controls do cyber insurers commonly require?
Underwriters commonly ask about multi-factor authentication, endpoint detection and response, backups kept offline or immutable, patching practices, security awareness training and an incident response plan. Check your own application and policy for the exact requirements.
How do I justify cybersecurity spend to the board?
Tie each line item to a specific business risk, show what it reduces, and connect it to obligations the business already has: insurance requirements, customer contracts, regulations and audits. Report progress with a few consistent metrics.
Build a budget you can defend
A Defensible vCISO can build your security roadmap, prioritize the budget against real risk and present it to your board. Explore our vCISO services or talk to an expert.
