Building a Security Program on a $0 Budget
You don't have money. You have about 90 hours and the CTO's attention. Here's how to spend both.
@18xBan · GRC Series · Chapter 10
0$ , 90 hours, 56 safeguards. Month one.
Monday, 10:00 AM: The number is 0.
You walk into Dan's office with a one-page sheet. 4 quotes: a SIEM, a GRC platform, an external penetration test, device management. Nothing extravagant. The total is about $60,000 a year.
Dan reads it, and says what CTOs at 240-person companies say:
"Not until Gotham signs. And if Gotham signs, the money goes to the engineering hires we promised. Assume zero."
Then the part that matters: "You've got your time. What can you do with that?"
It's a fair question and a fair answer is: a lot, actually. Not everything. The trick is knowing which things, in which order, and being able to say out loud what you are not doing.
4 quotes in, 0$ out, one useful question back.
The unpopular truth: "$0 budget" isn't the absence of a budget. It's a budget of your hours, and unpriced hours get spent on whoever shouts loudest. Price them, or the month disappears into tickets.
The real budget
Write it down before you plan anything.
| Line | Hours |
|---|---|
| Working hours in month one | 150 |
| Access requests, tickets, questionnaire answers, onboarding | 45 |
| Meetings you can't skip | 15 |
| Left for building the programme | 90 |
90 hours. That's the budget. Every choice below is priced against it.
This isn't just planning hygiene; the frameworks care. ISO 27001 Clause 7.1 asks the organisation to determine and provide the resources needed for the ISMS. NIST CSF 2.0 GV.RR-03 asks for resources to be allocated in proportion to the risk strategy and roles. Neither says "Buy tools." Both say "decide, and be honest about what the decision costs."
Which means the output of a zero-budget month isn't only the controls you fixed. It's also a written record that leadership chose zero, knowing what that leaves undone.
The only budget you actually control.
The backlog: CIS IG1
You need a list that someone else already prioritised, because arguing about priorities burns hours you don't have.
CIS Controls v8.1 is free, and it's built for exactly this situation. 18 Controls, 153 Safeguards, split into 3 Implementation Groups. Implementation Group 1 is 56 Safeguards across 15 Controls, and CIS calls it essential cyber hygiene: the foundational set every enterprise should apply against the most common attacks, aimed at organisations with limited IT and security expertise. CIS's Community Defense Model v2.0 reports that IG1 alone defends against a large majority of the attack techniques behind the top 5 attack types.
https://www.cisecurity.org/controls/v8-1
That's your backlog. Not "everything in ISO 27001." 56 specific actions, already ordered by someone with better data than you have.
Because Wayne is Canadian and PIPEDA applies, there's a second free list worth cross-checking against: the Canadian Centre for Cyber Security's Baseline Cyber Security Controls for Small and Medium Organizations (ITSM.10.089, V1.2), which applies an explicit 80/20 rule and covers thirteen control areas for organisations under 500 employees. It's short, it's plain, and a Canadian customer recognises the name.
https://www.cyber.gc.ca/en/guidance/baseline-cyber-security-controls-small-and-medium-organizations
Step I : Score yourself, in a day
Before touching anything, find out where you stand. CIS publishes a free self-assessment tool (CSAT), and a spreadsheet works just as well. Eight hours, one column per safeguard.
Wayne's opening score, against the 56 IG1 safeguards:
| Status | Count | Examples |
|---|---|---|
| Fully implemented | 17 | Antivirus on laptops, TLS on the product, automatic OS updates |
| Partial | 12 | MFA at 54%, asset inventory that misses three AWS accounts |
| Not implemented | 27 | Restore testing, log review, account inventory, security training |
Score honestly. A generous score is a lie you'll have to defend in a meeting where it costs you more than the truth would have.
Field by field: the self-assessment
| Column | What goes in it |
|---|---|
| Safeguard # | The CIS identifier, e.g. 6.3 |
| Title | The safeguard's own words, not yours |
| Asset type / security function | From CIS: devices, users, data; identify, protect, detect, respond |
| Status | Implemented, partial, or not implemented. No fourth option |
| Owner | A person, from the ownership list |
| Evidence | Where the proof lives. Blank means "partial" at best |
| Effort | Your hours estimate. This is what makes the list a plan |
| Notes | Why partial, and what would close it |
The two columns most people skip are Evidence and Effort. Without evidence, the score is an opinion. Without effort, the list is a wish.
What's actually free, and what it costs
| Free thing | What it replaces | Real cost |
|---|---|---|
| CIS Controls v8.1 + CSAT | A consultant's gap assessment | 8 hours to score, 2 hours a month to keep current |
| CCCS Baseline Controls (ITSM.10.089) | A Canadian-specific checklist | 2 hours to read and cross-check |
| NIST CSF 2.0 and its Quick Start Guides | The language you report in | 3 hours to build one page of profile |
| SANS policy templates | A policy pack purchase | Covered last month: the thirteen documents |
| CIS Benchmarks | Hardening guides per platform | Free to read; days of work to apply |
| Microsoft Security Compliance Toolkit | Paid baseline tooling for Windows | 6 hours to pilot on a test OU |
| Prowler or ScoutSuite (open source) | A cloud security posture product | 3 hours to run; the findings take weeks |
| Cloud provider features you already pay for | A detection product | Hours, not dollars: turn on what's in the bill |
| Your existing identity provider's MFA | An MFA product | The rollout, not the licence |
The last two rows are where most of Wayne's month goes, and they're the least exciting.
The unpopular truth: free tools are free to acquire, not free to run. A tool nobody reads costs more than no tool, because it creates a claim you can't back up. Before installing anything, name the person who will look at it every week.
Installing it is free. Reading it every week is the price.
What not to do in month one
Saying no in writing is half of this job.
Don't buy a GRC platform. Thirteen documents and one spreadsheet don't need software. You'd spend the month configuring it.
Don't book a penetration test. You already know about the public bucket, the admin accounts and the MFA gap. Paying someone to rediscover them is expensive validation.
Don't start certification. You'd fail Stage 1 on internal audit alone, and the audit fee doesn't come back.
Don't deploy a SIEM. Wayne isn't reading the logs it already has. A dashboard doesn't create a reader.
Don't run security awareness training in week one. Train people on rules that exist. The rules got written last month; the training lands better in month two.
The month-one plan: 90 hours
Week 1 : Find out what's true (16 hours)
You can't protect what you can't list, and CIS IG1 starts with inventory for exactly that reason.
# Every AWS account: who has credentials, who has MFA, what's stale
aws iam generate-credential-report --profile wayne-prod
aws iam get-credential-report --profile wayne-prod \
--query 'Content' --output text | base64 --decode > cred-report-prod.csv
# Public access posture on the buckets
aws s3api get-public-access-block --bucket wayne-staging-data --profile wayne-staging
user,mfa_active,password_last_used,access_key_1_active,access_key_1_last_used_date
<root_account>,false,2024-08-02,true,2023-11-14
svc-deploy,false,N/A,true,2024-11-01
priya,true,2024-11-01,false,N/A
dan,false,2024-06-19,true,2024-02-27
Sample output (illustrative). Wayne Industries is fictional.
That first line is the week's finding: the root account has no MFA and has an access key that was last used a year ago. It's free to fix and it takes fifteen minutes.
Search-ADAccount -AccountInactive -TimeSpan 90.00:00:00 -UsersOnly |
Where-Object { $_.Enabled } |
Select-Object SamAccountName, LastLogonDate | Sort-Object LastLogonDate
SamAccountName LastLogonDate
-------------- -------------
ctr.hsato 2024-08-23
j.whitfield 2024-09-02
temp.audit01 2024-09-11
...
18 accounts returned
Sample output (illustrative). Wayne Industries is fictional.
18 enabled accounts unused for 90 days. 12 get disabled after a two-line email to their managers. 6 are people on parental or medical leave, so they stay, documented.
Week 2 : Identity (26 hours)
The highest-value free work Wayne has. MFA everywhere it can be turned on, root accounts locked down, admin accounts cut to what's justified, contractor accounts given expiry dates.
Coverage moves from 54% to 71% overall, and to 100% for admin accounts and remote access. Not perfect. Measurable, and moving.
The root account with no MFA, found in week one, fixed in fifteen minutes.
Week 3 : logs and recovery (24 hours)
Forward the domain controller's security events, extend retention, and then do the thing Wayne has never done: restore a backup.
The first restore test takes an afternoon. A production database snapshot comes back into a staging instance in 3 hours 47 minutes, with the last 14 minutes of data missing because of how the job is scheduled. That's not a failure, that's a measurement. Wayne's first real recovery numbers instead of an assumption.
3 hours 47 minutes, and 14 minutes of data gone. Now it's a number, not a hope.
Week 4 : Write it down and report it (24 hours)
The vendor list, a first pass at a real risk register, the IG1 rescore, and one page for Maya.
90 hours, 4 weeks, 1 page.
Where the score lands
| Status | Start of month | End of month |
|---|---|---|
| Fully implemented | 17 | 29 |
| Partial | 12 | 14 |
| Not implemented | 27 | 13 |
Twelve safeguards closed with zero dollars. The thirteen that remain aren't all expensive several are simply next month's hours but four of them genuinely need money, and that's now a documented, costed list rather than a feeling.
12 safeguards closed, 0$ spent.
Evidence #10
The IG1 self-assessment, scored twice, with owners and evidence links.
The month-one plan with hours, and the explicit "not doing" list: no platform, no pen test, no certification, no SIEM.
The costed list of what 0$ leaves undone, and Dan's written acceptance of it.
The first restore test record: what was restored, how long it took, what was lost, who witnessed it.
One page to Maya: score, what changed, what's still open, what it would cost.
Evidence #10: a measured baseline, a plan priced in hours, and a leadership decision on file about what the budget doesn't cover.
Dan signs the resource gap without much argument, which is normal. Leaders rarely refuse to acknowledge a gap in writing. They refuse to fund it, which is a different thing, and an acknowledged gap has a way of getting funded the next time a customer asks a hard question.
"Here's what 0$ buys. Here's what it doesn't." Signed.
The unpopular truth: the cheapest wins are configuration changes on things you already own, and they're unglamorous enough that nobody puts them in a budget request. If you can't do those, a purchase won't save you, it'll just move the backlog somewhere with a licence fee.
What an auditor accepts vs rejects
| Accepted | Rejected |
|---|---|
| A scored baseline with dates and owners | "We follow CIS" with no assessment |
| A plan with hours, and what was dropped | A roadmap with no resourcing |
| Evidence of a restore, with timings | "Backups run nightly" |
| A documented, accepted resource gap | Silence about what isn't covered |
| A rescore showing movement | A one-off assessment nobody repeated |
| Configuration exports from real systems | Screenshots of a vendor dashboard |
What you actually do on Monday
Write your hours budget. Working hours, minus the work that lands on you anyway.
Score IG1 honestly. One day, one spreadsheet, evidence column included.
Pull the free truth first: credential reports, inactive accounts, public access settings.
Fix the fifteen-minute items the same day. Root MFA, unused access keys, public buckets.
Write the "not doing" list and get it acknowledged by whoever said zero.
Do one restore test. It's the single most convincing hour in the month.
Rescore at month end and send one page up. Movement is the message.
Framework mapping
What the frameworks ask for when the budget is zero.
Maturity ladder
| Stage | 20 people | 200 people | 2,000 people |
|---|---|---|---|
| Backlog | IG1 in a spreadsheet | IG1 scored, IG2 planned | Full control catalogue in a platform |
| Budget | Hours only | Hours plus a small tool budget | Headcount, tooling and audit lines |
| Tooling | Whatever the cloud bill already includes | Open source plus one or two paid tools | Integrated stack with owners per tool |
| Reporting | One page to the founder | Monthly score to the exec team | KRIs and dashboards to a committee |
| Proving it | Screenshots and exports, filed | Evidence folders per control | Automated evidence collection |
At 20 people, a $0 programme is normal and defensible. At 2,000, "$0" means someone has decided to accept risk without saying so.
Where Wayne sits: 29 of 56 IG1 safeguards implemented, one restore test on record, and a costed list of what money would buy next. That's a real programme. It isn't a finished one.
Cheatsheet
0$, on one page.
The takeaway
Price your hours before anyone prices your tools, then spend them against a list someone else already prioritised. Most of month one is configuration on systems you already pay for. A documented, accepted resource gap is a control in itself, and the fastest route to a budget later. One restore test will convince more people than any dashboard you could buy.
⚠️ This content is for educational purposes only. Wayne Industries is a fictional company. Nothing here is legal, audit, or compliance advice, validate against your own auditor and jurisdiction.