From: Eleanor Vance, CFO — Southants Solutions
To: You
Re: This year's resilience budget
Last year's near-miss with a stolen laptop rattled the board more than they'll admit. Nothing sensitive actually got out, but it made clear we've been treating every dataset, every provider, and every recovery plan the same way — which is to say, barely thought through at all.
You have £150,000 for the year. Not a penny more without board sign-off, and they won't sign off mid-year. That money has to cover three things: protecting our data assets, the resilience of our cloud setup, and our ability to keep operating if something goes seriously wrong.
How you split that £150,000 now decides what happens to you in about three months, when the first quarter's events land on your desk. I won't tell you what's coming. Figure out where the real risk sits, and spend accordingly.
This runs across a full year in four stages. Choices you make early change what you can afford — and what happens to you — later. There's no reset button on a live incident.
Eight assets, one budget line each. Costs are real money out of your £150,000. Effectiveness isn't shown as a number on purpose — judge each option the way a security lead would, based on what it actually does for that specific kind of data. You'll find out exactly how well you judged it once the quarter runs.
Comms wants to publish two of these on the intranet by lunchtime. Sort all six before the clock runs out — anything left unsorted when it hits zero gets published as-is, unreviewed.
Infrastructure wants a decision on hosting strategy before renewal next week. Whatever's left of your £150,000 has to cover this and business continuity later this year.
Last decision of the year. Whatever's left is what you'll have if something takes the whole network down — and after this, the board isn't approving anything else until April.
09:04. Something has started spreading through the network.