Resource allocation
The question is whether security receives the resources it was promised.
What the published 2016 guidance says
The question is whether security receives the resources it was promised. The construct compares the allocation for internal staff, contractors, hardware, software and services with what was actually used in the budget period, as a ratio against the allocation. The evidence is the resource monitoring record. It is collected yearly. The security manager owns and collects it, and the board is the client. The data comes from the budget, the expenditure record and the usage reports, and the result is shown as a radar chart with one axis per resource category.
What it means in practice
Use this when the board asks whether security is funded against plan. The measure compares allocated with used resources by category. The radar chart is the point: it shows which category is over or under, not only whether the total is on budget.
Status of this record. For B.2, this page states the published 2016 guidance, not the DIS text. The DIS is at stage 40.60 and is not public. Check the published edition before you rely on the row.
What good looks like
Collect the budget and the actual spend by category. Show allocated and used on the same axis. Record the period and the owner. Review the categories when the budget structure changes.
Evidence an assessor asks for
- GovernanceSecurity budget and actual expenditure by category
- ResourcesResource usage reports
- GovernanceThe radar diagram presented to the board
The question an assessor will ask
An assessor will ask for security budget and actual expenditure by category. The test for B.2 is whether that record can be produced for a live sample, not whether the guidance is described in a procedure.
Common gaps
- Security spend not separable from general IT spend
- Allocated resources reported with no record of what was used
Before the next review
Before the next review, test this against one live record: security spend not separable from general IT spend.
What to check when the revision publishes
When DIS 27004 is published, compare the B.2 Resource allocation record with this page. Ask whether the information need, the formula, the target, the frequency or the owner changes. Update the measure register and the kit, not the requirement, because the clause 9.1 duty stays as it is.