When local officials review the annual budget, they routinely make decisions involving millions of taxpayer dollars. They debate staffing levels, infrastructure projects, pension obligations, public safety priorities, and capital improvements. These decisions often involve weighing competing priorities and determining how much risk the organization is willing to accept. Then they arrive at the cybersecurity budget.
Too often, what they see is a single line item buried somewhere within Information Technology.
Cybersecurity: $1,500,000
What exactly does that mean?
Is the organization investing in prevention or merely reacting to incidents? Are critical systems adequately protected? Are emergency response capabilities sufficient? Is the municipality able to recover quickly from a ransomware attack? Most importantly, how can elected officials determine whether the proposed expenditures align with the organization’s cyber risk tolerance? The honest answer is that they often cannot.
This creates a significant governance challenge. Local officials have a fiduciary duty to protect public assets, ensure continuity of services, and maintain public trust. In today’s digital environment, that responsibility includes cybersecurity. As the Local Government Officials Guide to Cybersecurity notes, cybersecurity is no longer simply an IT issue—it is a strategic, enterprise-level risk that requires leadership engagement.
Yet many governing bodies are expected to approve cybersecurity budgets without a meaningful way to understand how those expenditures reduce organizational risk.
The result is predictable. Some organizations underinvest because decision-makers cannot see the connection between spending and risk reduction. Others overspend in areas that may not represent their greatest vulnerabilities. Still others make decisions reactively, increasing funding only after experiencing a major incident. There is a better approach.
Using NIST CSF 2.0 as a Budget Framework
The National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 provides a practical structure that helps local governments translate cybersecurity spending into governance language. Its six core functions are not technical product categories; they are high-level objectives for cyber resilience. Rather than debating specific technologies, cybersecurity activities can be organized around six conceptually straightforward objectives:
- Govern
- Identify
- Protect
- Detect
- Respond
- Recover
These functions provide a common language that bridges the gap between technical professionals and governing bodies.
Most elected officials do not need to understand the differences between endpoint detection platforms, security information and event management tools, or intrusion prevention systems. However, they do understand questions such as:
- Are we effectively detecting cyberattacks?
- Can we respond quickly enough to minimize damage?
- Do we have the ability to recover critical services after a disruption?
- Are we investing appropriately in governance and risk management?
Those are governance discussions.
Connecting Spending to Risk
Imagine that, alongside the proposed budget, the governing body received a cybersecurity assessment aligned with the NIST Cybersecurity Framework. The assessment might indicate that the organization demonstrates relatively strong capabilities in Protect and Recover, moderate maturity in Govern and Identify, but significant gaps in Detect and Respond. Suddenly, the conversation changes.
Instead of asking, “Why do you need another cybersecurity tool?” officials can ask:
“Our assessment shows that our ability to detect malicious activity is weak. How does this proposed investment improve that capability?”
The discussion shifts from technology purchases to risk management. Current expenditures, proposed expenditures, and assessment results can all be aligned under the six NIST functions. Decision-makers gain visibility into where resources are being allocated and whether those investments address areas of greatest concern. This allows governing bodies to exercise one of their most important responsibilities: setting organizational risk appetite.
Defining Risk Appetite
No organization can eliminate cyber risk entirely. Just as local governments accept certain financial, operational, and legal risks in pursuit of their mission, they must also determine what level of cyber risk they are willing to tolerate.
That determination belongs to leadership. Technical staff can explain vulnerabilities and recommend mitigation strategies. Auditors and assessors can provide independent evaluations of current capabilities. However, elected officials ultimately decide whether the residual risk is acceptable based on community priorities, available resources, and competing obligations.
The challenge is that these decisions require understandable information. A single cybersecurity line item does not provide that information. A budget structured around the six NIST objectives does.
From Technical Details to Governance Discussions
Consider two different budget presentations. The first includes line items for firewalls, endpoint detection software, log management platforms, and threat intelligence subscriptions. Typically in a single line item, like the one above. The second shows:
| NIST Function | Risk Rating | Current Spending | Proposed Spending |
| Govern | Moderate | $75,000 | $100,000 |
| Identify | Moderate | $125,000 | $150,000 |
| Protect | Low | $500,000 | $525,000 |
| Detect | High | $150,000 | $325,000 |
| Respond | High | $100,000 | $250,000 |
| Recover | Moderate | $200,000 | $225,000 |
Which presentation is more useful to a city council member, county supervisor, or special district board? The answer is obvious. The second presentation enables leaders to understand where risks exist, how resources are being allocated, and whether proposed expenditures align with the organization’s stated risk tolerance. It elevates cybersecurity from an operational discussion to a strategic one.
Building Better Governance
The NIST Cybersecurity Framework was never intended to be just a technical resource. It provides a structure for understanding and managing cybersecurity risk across the enterprise. By aligning cybersecurity expenditures with the six NIST CSF 2.0 functions, local governments can transform budget discussions into meaningful governance conversations.
Officials gain the ability to:
- See how cybersecurity investments address material risks.
- Understand the relationship between spending and organizational resilience.
- Prioritize funding based on independent assessments.
- Establish and communicate risk appetite.
- Exercise effective oversight without becoming technical experts.
In short, they gain the information necessary to fulfill their fiduciary responsibilities. Cybersecurity should never be a black box. Local government leaders deserve clear, actionable information that helps them govern wisely, steward public resources responsibly, and strengthen the resilience of the communities they serve. If cybersecurity is truly an enterprise risk, as we increasingly recognize it to be, then our budgets should reflect that reality.
Perhaps it is time to stop asking, “How much are we spending on cybersecurity?” And instead begin asking, “What risks are we reducing, and are we investing where it matters most?”
Help is on the Way
The Local Government Cybersecurity Alliance (LGCA) is currently developing a whitepaper that explores this concept in greater depth, providing practical guidance for local governments seeking to align cybersecurity budgets with the NIST Cybersecurity Framework 2.0. The goal is to equip elected officials, executives, finance officers, and cybersecurity leaders with a common language for discussing cyber risk, prioritizing investments, and making informed, risk-based decisions. By connecting assessment results to budget allocations, local governments can move beyond viewing cybersecurity as a technical expense and begin managing it as the enterprise risk it truly is. We believe this approach has the potential to transform cybersecurity budgeting from an opaque line item into a transparent governance tool that strengthens resilience, accountability, and public trust.
