CSL CSL Security Budgeting & Program Management

Question 1

Which method is most effective for justifying cybersecurity budget increases to a CFO or board?

Accepted Answer

Quantifying risk in financial terms using frameworks like FAIR

Answer

Listing technical threats and CVE counts

Answer

Citing industry benchmark spending percentages only

Answer

Presenting the number of security incidents blocked

Question 2

A CISO is building the annual security budget. Which category typically represents the largest portion of a mature security program's budget?

Accepted Answer

Technology and tooling

Answer

Security awareness training

Answer

Security certifications for staff

Answer

Penetration testing

Question 3

What is a key benefit of using a security maturity model when presenting the security program to the board?

Accepted Answer

It provides a structured roadmap showing current state, target state, and progress

Answer

It eliminates the need for annual security audits

Answer

It replaces the need for penetration testing

Answer

It automatically allocates budget across security domains

Question 4

Which approach best helps a CISO prioritize security investments when budget is constrained?

Accepted Answer

Align spending to the highest-probability, highest-impact risks identified in the risk register

Answer

Invest equally across all security domains

Answer

Follow peer organization benchmarks regardless of your specific risk profile

Answer

Purchase the newest available security technologies

Question 5

What does a cybersecurity program charter formally establish?

Accepted Answer

The authority, scope, objectives, and governance structure of the security program

Answer

A list of approved security vendors

Answer

The technical architecture of security tools

Answer

Employee security training requirements

Question 6

How should a CISO handle a situation where the security budget is cut significantly mid-year?

Accepted Answer

Re-prioritize based on risk, document trade-offs, and present accepted risk to leadership

Answer

Continue all programs and absorb costs through deficit spending

Answer

Immediately outsource all security functions to reduce costs

Answer

Eliminate security awareness training first as lowest-impact