IT and security budget planning checklist

For many chief executive officers (CEOs), managing directors and board members of mid-size UK businesses, the question of how much to invest in cybersecurity and broader technology resilience is more pressing than ever. According to the UK Government’s Cyber Security Breaches Survey 2025/2026, 65% of medium-sized businesses identified a cyber breach or attack in the previous 12 months.

Conduct a comprehensive risk assessment

• Identify high-impact business processes and systems.
• Map out the most significant vulnerabilities, including threats driven by artificial intelligence (AI).
• Review internal dependencies and third-party services for potential risk gaps.

Business continuity and disaster recovery (BCDR) plans

• Confirm that disaster recovery objectives and timeframes are up to date.
• Ensure staff roles and responsibilities are clearly defined.
• Assess backup and failover solutions for relevance and effectiveness.

Revisit cyber insurance options

• Compare policy terms for coverage, cost and available add-ons.
• Check the insurer’s requirements for data protection, risk assessments and employee training.
• Determine whether your chosen policy scales with business growth and changes in the threat landscape.
• Ask whether your insurer requires controls such as MFA, endpoint detection, tested backups or Cyber Essentials as a condition of cover.

Scrutinise supplier contracts and security postures

• Require proof of vendors’ own security measures and continuity plans.
• Check for flexibility or break clauses in multi-year contracts.
• Evaluate how any price increases align with service improvements.

Incorporate AI threat mitigation into security strategy

• Identify areas where AI-based attacks could have the greatest impact.
• Evaluate whether you need new AI-driven tools to monitor activity and detect anomalies.
• Ensure staff awareness training is updated to reflect AI-enhanced social engineering risks.
• Check that every AI tool in use has cybersecurity controls in place; only 24% of businesses using or considering AI report having them (Cyber Security Breaches Survey 2025/2026).

Budget for training and a security-aware culture

• Allocate funds for ongoing employee cyber awareness programmes.
• Conduct regular simulated drills and phishing tests.
• Review staff feedback to continuously refine training content.

Factor in rising costs and inflationary pressures

• Forecast potential increases in vendor fees, licensing and essential services.
• Explore renegotiation or alternative suppliers if costs become prohibitive.
• Build in a contingency for economic or supplier-driven price rises.

Align cyber expenditure with overall business strategy

• Check that budget allocations support key business goals and risk tolerance.
• Ensure funds are not overspent on tools that do not match your current threat landscape or future plans.
• Evaluate each proposed project’s return on investment (ROI) and its impact on shareholder trust.

Assess supply chain and third-party security

• Identify critical partners and demand transparent security documentation.
• Clarify the scope and limits of data sharing between you and your suppliers.
• Plan how quickly partners can respond to an incident to minimise disruption.
• Check whether key IT suppliers could fall under the proposed Cyber Security and Resilience Bill, and what that means for their contracts and costs.

Verify resilience and scope for growth

• Confirm that IT systems can scale if your organisation expands.
• Confirm that any new technology investments remain flexible and upgradable.
• Discuss whether additional staff or outsourced expertise might be needed.

Plan for 2026 priorities

• Budget for replacing or isolating remaining Windows 10 devices; paid extended security updates double in price each year.
• Fund AI governance: an acceptable use policy, approved tools and controls on data shared with AI services.
• Allow for the 2026 Cyber Essentials requirements: MFA on every cloud service and critical updates within 14 days.
• Budget for automated TLS certificate management as maximum lifetimes fall to 100 days in March 2027.
• Set aside time for a post-quantum cryptography inventory and supplier review, in line with NCSC milestones.

Establish clear governance and ongoing review

• Agree on key performance indicators (KPIs) to monitor budget performance and outcomes.
• Set regular board-level check-ins to reassess changes in threats and budget allocation.
• Document any adjustments made throughout the year for clarity and accountability.