Situation
CIS ran on a long budget cycle. Requests went in about three quarters ahead of the year they funded, and the approved increase was almost always smaller than the ask, so plans were reworked every year. Mid-year, Finance asked for unspent budget back, and each Senior Director handled those requests separately with no shared target, so CIS returned more than required. Central procurement and hiring were slow, and vendor terms were negotiated by individual managers. CIS had a vision but no mission statement.
Objective
Fund security at a level benchmarked to Nike’s industry and revenue, give CIS control of its own budget, buying and delivery, and give the organization a mission that put risk decisions with the people who own the risk.
Approach
Four strategies on a three-year horizon. I owned Cloud, Application Security, Network, and Threat Intelligence and Analytics. Each opened with current state, then a multi-year maturation roadmap, reviewed quarterly. Each review cycle meant engaging the CIS leaders who owned the area, working gaps and priorities with non-CIS functions such as Enterprise Data & Analytics and Networking, supporting vendor RFP and RFQ work, and building next year’s budget and staffing requests with justifications. The owning CIS leadership signed off each strategy before it went to the CISO.
The budget benchmark. I gathered two pieces of published, vetted third-party research: the share of revenue companies in our industry spend on technology, and the share of the technology budget that goes to information security, about 10%. I applied them to ten years of Nike revenue plus a current-year projection, and compared the result with CIS’s actual spend and forward request. One slide: a line for what CIS spend should be, industry-benchmarked and revenue-adjusted, against bars for actual budget, with sources, values, method and calculations documented on it. Because budgets are board-approved, the benchmark turned an IT budget line into a governance and fiduciary question for the board.
BizOps for CIS. With the other strategists, I built CIS its own BizOps function:
- A dedicated CIS finance lead to track spending and hiring, handle requests to free up budget, and shift budget within the year so teams had funding when they needed it.
- A CIS procurement specialist who took on vendor contracting for all of CIS, landing discounts we had been missing and closing contracts fast.
- The Quick Wins process, my design. A strategist and the CIS team wrote a request to unstick a delayed item or seize a new opportunity, capped at the ceiling the CISO could approve directly. If a project or hire slipped, the money could be committed before it was reclaimed, which held through mid-year give-backs and Nike-wide spending holds.
- Contractor talent through two suppliers so specialists were in place while roles were filled.
- A CIS Program Manager to track delivery against the strategies.
The CIS mission. I authored it, with review from two senior CIS individual contributors.
In review I moved the identify and communicate items ahead of detect and respond, putting knowing and communicating risk first. The mission made CIS a partner to the Tech VPs. CIS informs the tech owners of their risks, reports risk to leadership and the executive risk committee, and provides consultants to the risk owners, who make the decisions. It also staked out CIS’s protect, detect and respond charter, with its own budget to build and run detection and response tooling. CIS does not own and operate critical infrastructure such as firewalls by default; it builds and operates only when the executive level decides, with the funding to match. The model leaned on the existing GRC team and the AppSec team we built up on my RelayHealth model of specialist consultants embedded in the tech orgs.
Two more mandates. I joined the global CIS recruiting and interview team, and I was Nike CIS’s liaison to AWS, where I got AWS to sponsor a Nike tech day on the ML and big-data analytics from its Sqrrl acquisition.
Net results
- Largest CIS security-budget increase in Nike’s history. The CISO used the benchmark slide to defend his ask to leadership and the board. The CFO challenged the methodology, reviewed it, and signed off that it was accurate. The increase landed slightly above the benchmark line, to close the historical gap.
- Authored the CIS mission. The CISO adopted it without changes, and it became the basis for aligning every CIS strategy. With the CISO’s blessing I have presented it at conferences, generalized and not Nike-branded.
- Built the BizOps function for CIS. CIS ran its own budget, procurement, hiring and delivery tracking, and funding stayed on the priorities the strategies committed to.
- Two senior offers. I was offered the role of Nike’s first Distinguished Engineer / Architect, a Senior Director equivalent in the CTO’s org, and declined. Later I was offered the Senior Director role of Converse Group CISO, with a path to VP; it required relocating to Boston, and I declined.
Takeaway: a budget ask becomes a governance lever when board-approved, industry-benchmarked numbers show the board what it is accepting.
Scope and technologies
Strategy domains: Cloud, AppSec, Network, Threat Intelligence and Analytics. Embedded AppSec consultant model, from RelayHealth. GRC. SOC, detection and response tooling.