A security budget request is easy to approve and hard to question. It arrives full of tool names and acronyms, and the number is usually higher than last year.

This worksheet gives the CFO and the person submitting the request a shared page to work from. It turns the request into five plain questions about the business.

It goes with Episode 6 of The Rook, Before You Approve the 2027 Security Budget.

Download

  • Worksheet (PDF): the blank worksheet. The budget owner fills it out and the CFO reviews it.
  • Sample (PDF): a completed example for a fictional manufacturer, so you can see what a finished one looks like.

The five questions

  1. What are we protecting, and what would losing it cost? The systems and data the business can’t run without, and a rough cost of a week without them.
  2. What do we own, and is it still working for us? Every tool you have or want to add, whether it’s actually set up, and what happens to the ones being replaced.
  3. What is required from outside, and what is a business call? Which items an insurer, a customer contract or a regulator requires, and which ones you are choosing for your own reasons.
  4. What becomes more likely if we cut this? The risk each cut creates, so a cut is a decision and not a gap.
  5. Who is accountable for the outcome? One named person for each result, with a backup.

How to use it

  1. The budget owner fills it out before the budget meeting.
  2. The CFO reads it and asks the questions in the margin.
  3. Anything that can’t be filled in is a gap in the request, not a blank to ignore. If it can’t be completed, the budget isn’t ready.
  4. File the signed page with the budget. It is your record of what was cut, what risk that created, and who accepted it.

About the sample

The sample company, Harborline Components, is fictional. Its numbers are built for teaching and do not describe any client or real business. The worksheet’s one outside figure, an average ransomware recovery cost from the Sophos State of Ransomware 2026 survey, is context and not a forecast for your company.

Listen to the episode

Watch on YouTube ยท Listen on Buzzsprout

Want a second set of eyes on your budget?

If your 2027 request is on your desk and you’d like an independent review of it, that is the work I do. Book a call or write to [email protected].

David Shaw is a vCISO and GRC consultant at Corvus Cybersecurity. This worksheet is a planning aid and not legal, insurance or financial advice.