All releases
Executive Intelligence · Operating Plan

The Operating Plan — decide what to fund, defend it to your CFO

Turn your risk register into a funded, defensible budget: programs ranked by expected loss reduced per dollar, a funding line drawn by the budget you actually have, and every no recorded as a signed decision. Board slide, CEO one-pager, CFO variance letter, and the signed accepted-risk register — generated from the plan of record.

See the Operating Plan

Every security budget conversation eventually arrives at the same question: why this number? Today we’re shipping the thing that answers it.

The Operating Plan is live in Executive Intelligence for Business plans and above. Your risk register already prices every scenario in dollars — the Operating Plan spends against it: programs ranked by expected loss reduced per dollar, a funding line drawn by the budget you actually have, and every “no” recorded as a signed decision instead of discovered as a gap.

The budget control set to $1.1M of a $1.9M ask, funding 6 of 9 programs — residual exposure $214K from a $1.1M baseline, $926K of risk reduced, with allocate-by modes for risk reduced per dollar, priority order, and audit-led.

The funding line

Security budgets die as lists — everything sounds necessary, nothing is ranked, and whatever didn’t fit just quietly doesn’t happen. The line ends that. Programs order themselves by the loss each dollar buys down, your budget decides where the money stops, and everything below the line stays on the table with a reason. The argument stops being “do we really need all this?” and becomes “is this the right number?”

The funding decision table: nine programs ranked by loss reduced per dollar, six funded above a dashed funding line at $1.1M with $48K unspent headroom called out, and three below it marked skipped with the reason each one did not fit.

What changes for you

  • Your ask becomes an investment case. Programs proposed from your own maturity gaps and open findings, priced as labeled starting estimates, ranked by what each dollar buys down. The first defensible draft takes about an hour, not six weeks.
  • Cuts get priced before they get made. Finance’s counter runs against the same exposure data, so a 10% cut arrives with its cost in expected loss attached. Either the cut shrinks, or the business chooses it with eyes open — you never absorb it silently.
  • Unfunded risk stops being quietly yours. Accepting a scenario goes through the risk register’s own decision path — rationale required, chain-attested, sealed when the plan is promoted to plan of record. When “who decided this?” gets asked, the answer is on the record.
Risk scenario coverage: each register scenario with its expected annual loss, how much of it the plan addresses, the residual, and the decision — three scenarios accepted on the record and a platform-proposed scenario awaiting its accept-risk decision.

The packet

Board slide, CEO one-pager, CFO variance letter, and the signed accepted-risk register — four artifacts generated from one plan of record, every figure traceable back to it. Nothing gets assembled the night before.

The full walk-through is on the Operating Plan page. Already on Business or above? It’s in your tenant now: Reporting → Forecasting → Operating plan.

Decide what to fund. Defend it to your CFO.