TBM for Cybersecurity & Enterprise Risk Management
Quick Links
The Rising Importance of Risk-Informed Technology Management
Organizations today operate within an expanding landscape of risk—cyberattacks, regulatory shifts, financial uncertainty, and operational disruptions are becoming more frequent and costly. In 2023 alone, the global average cost of a data breach reached $4.45 million, according to IBM’s Cost of a Data Breach Report 2023. Cyber-risk, once considered a specialized IT issue, is now central to enterprise strategy.
Yet addressing these risks often comes with tradeoffs. Risk mitigation can increase the total cost of ownership (TCO) for IT services and reduce the speed or convenience of digital experiences. At the same time, many organizations lack mature, enterprise-wide risk management frameworks to assess, prioritize, and communicate these tradeoffs.
A 2023 study by North Carolina State University found that 34% of organizations have no enterprise-wide risk management process, 32% have a partial process, and only 34% have a complete, formal ERM process in place (NCSU 2023 Risk Oversight Report).
Technology Business Management (TBM) brings financial and operational clarity to cybersecurity and enterprise risk strategies, empowering better decisions about where and how to invest in protection, compliance, and resilience.
Cybersecurity Through a TBM Lens
Cybersecurity is not only a technical function—it’s a financial and strategic one. TBM provides a structured, data-driven way to model the costs of cybersecurity initiatives, measure the value of risk mitigation, and align security investments with business priorities.
According to the World Economic Forum’s Global Cybersecurity Outlook 2022, 55% of organizations have been affected by a third-party cyber incident in the past two years (WEF Global Cybersecurity Outlook 2022). These events often create ripple effects across the enterprise, reinforcing the need for proactive, risk-aware investment strategies.
When integrated with cybersecurity standards such as the NIST Cybersecurity Framework (CSF), TBM helps organizations:
- Model the cost of achieving different cyber-risk profiles (e.g., high, medium, low)
- Allocate cybersecurity spend across applications, services, and departments
- Justify new investments and track return on investment (ROI) over time
- Improve communication with executives and boards
- Benchmark cybersecurity spending against industry norms
Through the TBM Taxonomy, organizations can assign risk attributes to services and associate those attributes with costs, enabling clearer visibility into the financial impact of different security strategies.
TBM and NIST Integration
The TBM Council has partnered with the National Institute of Standards and Technology (NIST) to align the TBM Taxonomy with the NIST Cybersecurity Framework. This integration enables organizations to:
- Tag services and applications with a cybersecurity risk profile
- Cost-model the controls needed to reduce risk in line with business objectives
- Budget for improvements across the five CSF functions: Identify, Protect, Detect, Respond, and Recover
- Build shared accountability by linking cost transparency with risk transparency
With this integration, technology, finance, and cybersecurity leaders can collaborate around a unified view of risk-adjusted value.
To learn more, download the TBM Taxonomy & NIST white paper.
Enterprise Risk Management with TBM
Beyond cybersecurity, TBM provides capabilities that support Enterprise Risk Management (ERM) across the organization. Whether following COSO ERM, ISO 31000, or another framework, TBM enhances risk identification, assessment, response, and monitoring by illuminating the cost and performance of risk-related technology services.
The NCSU 2023 Risk Oversight Report found that while 62% of organizations formally consider IT-related risks, only 53% consider financial reporting and investment risks, and 60% consider legal, regulatory, and compliance risks—revealing inconsistency in enterprise-level risk modeling and mitigation.
With TBM, organizations can:
- Evaluate the cost of compliance with regulatory or contractual requirements
- Align financial impact assessments with mitigation costs
- Benchmark ERM spending across business units or industry peers
- Identify and distribute shared costs of risk-reduction investments
- Generate risk-related KPIs tied to technology and financial data
- Track the ROI of risk mitigation and resilience-building efforts
TBM also enables the creation of dedicated services, such as “Compliance” or “Cybersecurity Protection,” with full TCO, enabling ERM leaders to better plan and budget for risk-based programs.
Use Cases and Capabilities
TBM Capability | Purpose |
Risk-Based Cost Modeling | Associate risk profiles with services to evaluate mitigation strategies and their costs |
Budget Allocation Support | Justify risk-based investment through clear, cross-functional modeling |
Shared Cost Distribution | Allocate costs of shared risk controls (e.g., zero-trust, encryption) across beneficiaries |
Performance & ROI Tracking | Measure the impact of risk reduction and compliance initiatives |
Risk-Informed Planning | Support forward-looking decisions with cost and performance forecasts |
Monitoring & Metrics | Generate outputs that support continuous risk monitoring under COSO or NIST |
TBM as a Foundation for Risk-Informed Governance
By uniting financial transparency with risk management, TBM enables a more proactive and informed approach to technology governance. Whether your organization is implementing a cybersecurity program, maturing its ERM function, or preparing for new compliance obligations, TBM offers the visibility, structure, and flexibility to support smarter investment.
For guidance on how TBM and FinOps combine to support smarter, risk-informed financial governance, explore TBM & FinOps: A Guide or visit our FinOps page for more information.
Looking to go deeper? Download the TBM Taxonomy and NIST whitepaper to explore this topic further, or download the related data tables to begin managing your risks today.
While you’re here, join the TBM Council to connect with peers and stay updated on all things TBM. Explore our communities to see how others are tackling similar challenges, or check out our Knowledge Base for frameworks, case studies, and how-to guidance. Learn more about the TBM Framework and how it supports smarter decision-making across IT and Finance. You can also attend an upcoming event, pursue training or certification, or see how our partners are contributing to this area of TBM practice.
Join the TBM community: where innovators and leaders converge
The TBM Council is your gateway to a treasure trove of knowledge: think cutting-edge research papers, insightful case studies, and vibrant community forums where you can exchange ideas, tackle challenges, and celebrate successes with fellow practitioners.
We’re calling on organizations and forward-thinking individuals to dive into the TBM community. Participate in our events, engage in our discussions, and tap into a vast reservoir of knowledge. This isn’t just about networking; it’s about contributing to and benefiting from the collective wisdom in navigating the dynamic world of cloud computing.
