There is no universal percentage of revenue that every business should spend on cybersecurity, and no guaranteed return formula. A sound investment plan starts with the business functions that cannot fail, identifies the cyber risks that could disrupt them, funds a prioritized set of safeguards, and verifies that the organization can respond and recover.
How much should a business spend on cybersecurity?
There is no defensible one-size-fits-all budget figure in the available CISA guidance. The appropriate amount depends on your company’s size, sector, regulatory duties, existing controls, critical operations, and risk appetite. Treat a budget percentage found elsewhere as a comparison point—not as proof that your organization is adequately protected.
As an Amazon Associate I earn from qualifying purchases.
Build the investment case around the consequences of disruption to your own business: which services, systems, data, and suppliers are essential, and what would happen if they became unavailable or untrustworthy? CISA’s Shields Up: Guidance for Corporate Leaders and CEOs notes, “In nearly every organization, security improvements are weighed against cost and operational risks to the business.” The statement is CISA’s organizational guidance, not a quotation attributed to an individual.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Do not use CISA’s historical figure of $2.4 billion as a company-level estimate: CISA reported that total cybercrime costs to small businesses reached that amount in 2021. It is an aggregate for that year, not a current annual spending target, an estimate of your expected losses, or an ROI calculation.
#1 Best Overall
How should leaders prioritize cybersecurity spending?
Start with important business functions and the systems, people, data, and third parties they depend on. Then compare possible investments by their relevance to those functions, their ability to reduce consequential risk, deployment time, operating cost, compatibility with current systems, and whether your team can implement and test them effectively.
- Map critical functions. Identify the operations whose disruption would have the greatest business impact, and the technology and information each relies on.
- Identify material gaps. Review how those systems are protected, monitored, recovered, and governed. Include dependencies on vendors and remote access where relevant.
- Choose safeguards against the highest-impact gaps. Consider coverage and compatibility as well as purchase cost; a product alone does not provide secure configuration, ownership, training, or testing.
- Assign owners and evidence. Give each investment a responsible person and a way to show that it is working, such as a successful restore test or documented response exercise.
- Revisit priorities. Reassess as business operations, technology, obligations, and risks change.
CISA’s voluntary Cross-Sector Cybersecurity Performance Goals (CPGs) are intended to help small and midsize organizations focus limited resources on a smaller set of high-impact actions, particularly where expertise or capabilities are constrained. They are a prioritization aid, not a budget prescription or complete compliance checklist. CISA says the CPGs are being updated to align with NIST Cybersecurity Framework 2.0; check the current CISA materials before relying on a particular mapping or version.
Rank #2
What cybersecurity investments should a small business make first?
The right order depends on the gaps in your own environment. CISA guidance points business leaders toward several practical areas to assess and strengthen:
Require multifactor authentication
Use multifactor authentication (MFA) wherever possible, prioritizing administrator accounts, remote access, and workers who handle sensitive data. CISA advises choosing the strongest option available and aiming for phishing-resistant MFA. Physical security keys are one possible method, but confirm that the identity provider, specific accounts, and devices support the key you choose. A key is one part of account protection, not a complete security program.
Back up critical information and prove it can be restored
CISA’s guidance for managed service providers and small and midsize businesses recommends automatic, continuous backups of critical data and system configurations, stored in an easily retrievable location air-gapped from the organizational network. Leaders should ask for evidence that restores have been tested and that recovery arrangements support critical business functions. CISA’s cited guidance does not establish a universal recovery time or recovery point target; those should be set according to the organization’s operational needs.
Make logging useful for detection and response
Logging and monitoring policies should cover what is recorded, who can access it, how logs are securely stored, and how long they are retained in line with policy and compliance needs. Logs are most useful when the organization has a defined process for reviewing alerts and acting on them. CISA lists Logging Made Easy as a no-cost resource; paid monitoring services are one possible implementation route, not a universal requirement.
Plan for incidents and continuity
Assign a crisis-response team and clarify responsibilities across technology, communications, legal, and business continuity. CISA recommends that incident response planning involve security and IT teams, senior business leaders, and board members. Leadership should take part in a tabletop exercise, and continuity plans for critical functions should be tested.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchHow can leaders justify cybersecurity spending to the board?
Translate proposed spending into business decisions rather than a list of tools or fear-based threat claims. Explain which critical function is at risk, the plausible consequence of disruption, the gap the investment addresses, and how the organization will verify the change. CISA’s corporate leadership guidance advises senior management to include CISOs in decisions about company risk and to signal that security investment is a priority.
Best Value
A concise board proposal can include:
- Business function and dependency: what operation the investment is intended to protect.
- Risk and current gap: what could fail and what existing arrangements do not yet address.
- Options and trade-offs: expected implementation and operating costs, coverage, compatibility, deployment time, and any need for external expertise.
- Outcome and verification: the evidence leaders will review, such as MFA coverage, restore-test results, logging policy adoption, or participation in an incident exercise.
- Ownership and review: who is accountable and when the organization will revisit the decision.
A proposal should distinguish what an investment can reduce from what it cannot guarantee. For example, purchasing a backup service does not by itself demonstrate recovery readiness; a restore test provides evidence that the process works under the conditions tested.
Which controls offer the best return?
The sources do not establish a ranked list of controls by financial return or a guaranteed ROI formula. A practical comparison asks which option most directly reduces risk to critical business functions, what it costs to implement and operate, how quickly it can be deployed, how it fits existing systems, and whether outcomes can be tested. Recovery capability and the organization’s internal expertise also matter.
For small and midsize businesses, CISA’s live SMB resource hub includes material on phishing, passwords, MFA, software updates, logging, backups, and encryption. It also lists no-cost cyber hygiene services, including vulnerability and web application scanning, and a no-cost tool for assessing and hardening some SaaS configurations. Check the current eligibility rules and service scope on CISA’s small business cyber guidance before relying on a particular service.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
