Has your organization established a documented process for allocating resources and investments based on your defined risk tolerance and response strategies?

This question assesses whether the organization has a formal methodology for determining how financial, personnel, and technological resources are allocated to address identified security risks. Effective resource allocation ensures that higher-risk areas receive appropriate investment while maintaining alignment with the organization's risk appetite and business objectives. Evidence could include a resource allocation framework document, budget planning documents that reference risk priorities, meeting minutes from risk committee discussions about resource investments, or a risk-based investment matrix showing how funding decisions correlate to risk levels.