Halfway through the year, the security budget is cut by a significant amount, and not all planned initiatives can continue. What should the security manager do?
Select an answer to reveal the explanation.
Short Explanation
When the money shrinks, you protect what protects the business most. Re-rank by risk, fund the top, and tell management plainly what risk they're now carrying because of the cut. The trap is the 'fair' across-the-board cut, which can starve every project, including the critical ones.
Full Explanation
A budget reduction changes what the program can deliver, and the security manager's responsibility is to ensure the remaining resources address the greatest risks while management understands the consequences. Reprioritizing initiatives by the risk they address, continuing funding for the highest-risk items, and reporting the residual risk created by deferred or cancelled work allows senior management and risk owners to accept that risk knowingly or to restore funding. An equal percentage cut across all initiatives appears fair but can leave every project underfunded, including critical ones, and may result in none achieving its objective. Dropping the initiatives furthest from completion uses progress and sunk cost as the criterion rather than risk; an early-stage initiative may address the most significant exposure. Keeping the most visible initiatives to preserve executive support optimizes for perception, which may leave serious but less visible risks unaddressed and ultimately damages credibility if those risks materialize. Exam caveat: committed contractual obligations or regulatory deadlines can constrain which initiatives may be stopped, and they should be factored into the prioritization. Operational check: present a revised plan showing each initiative's risk rating, funding decision and resulting residual risk, and record management's acceptance of the deferred risks.