The costs that arrive after the purchase order

Six costs that arrive later

Each is ordinary, none is hidden deliberately, and together they are frequently a third of the first-year figure.

Configuration. Deployment is not configuration and the vendor timeline describes deployment.

Integration. Connecting the new thing to identity, to logging and to whatever your machines speak. The last one is where the surprises live.

Data migration. Moving covered information into the governed environment, which means first finding all of it.

Training. Not the administrators: the fifty people whose day changes.

The workaround budget. Every control that makes a job slower produces a workaround unless something else is provided, and providing it costs money nobody put in the plan.

Evidence production. Somebody assembling, monthly, what the assessor will want annually.

The discovery nobody scopes

Before covered information can be moved into a boundary, it has to be located, and it is on laptops, on a file server nobody administers, in an email archive, on a shared drive from a project that ended in 2019, and on the machine.

Discovery is a project of its own and it is routinely folded into a line item called migration. It is the single most common reason these programmes run late.

Things that turn out not to be in the plan

A machine that cannot be segmented without a new switch. A controller whose vendor requires an on-site visit to change anything. A software licence tied to a machine's network address. An operator terminal that loses its calibration when it is restarted.

None of these is exotic and every one of them has stopped a programme for a fortnight. The inventory recommended in the reference section finds them at the start, when they are a scheduling problem rather than an emergency.

Your own people, priced honestly

Most plans record internal time at zero because it is not invoiced. Price it at what those people cost and the comparison between options changes, sometimes reversing.

It also makes visible the option that is genuinely cheapest and is rarely modelled: doing less, by drawing a smaller boundary.

Keep a contingency and say what it is for

Somewhere between a fifth and a quarter, held explicitly against the discovery finding more than expected and against remediation on the floor.

A contingency described as contingency gets cut in the first review. One described as "covered information discovery and shop-floor remediation" survives, because the person cutting it has to say which of those they think will not happen.

Year two arrives quietly

Licences renew, the assessment cycle continues, and the person doing the evidence has a full-time job elsewhere in the business. Nothing announces this and the first sign is usually that the evidence folder stops being updated in the spring.

Put the recurring work in somebody's objectives with a named deliverable, or it will not happen and the gap will be found by an assessor rather than by you.

Four numbers, monthly

Spend against plan. Controls with current evidence, as a proportion. Open remediation items. And hours of internal time consumed.

The last one is the early warning: when it rises without the others moving, something is being done manually that was supposed to be automatic.

The cost of a moving boundary

Every addition to the boundary after the plan is written costs more than it would have at the start: documentation to revise, controls to extend, and evidence to backfill.

Which is an argument for spending longer on the boundary and for saying no to convenient late additions.

Two adjacent costs worth checking

Cyber insurance premiums and terms may depend on what you have in place, in either direction, and customer contracts may carry security obligations separate from the certification requirement.

Both are outside this programme and both interact with it. Have somebody read them at the start.

Add a third and check the plan again

If your plan has no discovery phase, no configuration line, no training line and no contingency, it is short by roughly a third. That is not a criticism of the plan; it is what every first version of one looks like.

The workaround budget, spent in advance

Ask the people whose day will change what would make the new arrangement unworkable, before deploying rather than after. The answers are specific, they are cheap to address at that point, and they are expensive to address once a workaround has become habit.

Budget for the assessment being failed

Not likely with proper preparation and not impossible. A remediation cycle and a re-visit is a real cost with a real probability, and a plan with no allowance for it treats a possible outcome as impossible.

At the end of the discovery phase, redo it

The first budget is written before anybody knows where the covered information is. Once the discovery is done, that figure can be replaced with one based on findings rather than on assumptions.

Replacing it openly, with the reasons, preserves credibility. Quietly overspending against the first one does not.

Elsewhere in buying and budgeting

• What compliance actually costs, itemisedWhat compliance actually costs, itemised. What it costs, who decides, and what usually goes wrong.
• Reading a proposal that quotes a certificateReading a proposal that quotes a certificate. What it costs, who decides, and what usually goes wrong.
• What to build and what to buyWhat to build and what to buy. What it costs, who decides, and what usually goes wrong.
• Making the budget case to somebody who resents itMaking the budget case to somebody who resents it. What it costs, who decides, and what usually goes wrong.
• Doing this with almost no moneyDoing this with almost no money. What it costs, who decides, and what usually goes wrong.
• Who owns compliance, and why it cannot be nobodyWho owns compliance, and why it cannot be nobody. What it costs, who decides, and what usually goes wrong.
• Running it as a project rather than as a documentRunning it as a project rather than as a document. What it costs, who decides, and what usually goes wrong.
• Reporting to a board that wants one numberReporting to a board that wants one number. What it costs, who decides, and what usually goes wrong.
• When the date slips, which it willWhen the date slips, which it will. What it costs, who decides, and what usually goes wrong.
• Staying compliant after the assessmentStaying compliant after the assessment. What it costs, who decides, and what usually goes wrong.
• Working to two standards at onceWorking to two standards at once. What it costs, who decides, and what usually goes wrong.
• Training that changes what people doTraining that changes what people do. What it costs, who decides, and what usually goes wrong.
• How a control looks from the machineHow a control looks from the machine. What it costs, who decides, and what usually goes wrong.
• Contractors, temps and the visiting engineerContractors, temps and the visiting engineer. What it costs, who decides, and what usually goes wrong.
• Hiring for a role most suppliers have never filledHiring for a role most suppliers have never filled. What it costs, who decides, and what usually goes wrong.
• Giving people a way to say a control is unworkableGiving people a way to say a control is unworkable. What it costs, who decides, and what usually goes wrong.
• What staff are told about monitoringWhat staff are told about monitoring. What it costs, who decides, and what usually goes wrong.
• What counts as an incidentWhat counts as an incident. What it costs, who decides, and what usually goes wrong.
• Reporting obligations and their clocksReporting obligations and their clocks. What it costs, who decides, and what usually goes wrong.
• Being able to answer afterwardsBeing able to answer afterwards. What it costs, who decides, and what usually goes wrong.
• The first hour, and who decidesThe first hour, and who decides. What it costs, who decides, and what usually goes wrong.
• Telling a customer something happenedTelling a customer something happened. What it costs, who decides, and what usually goes wrong.
• What changes afterwards, and what shouldWhat changes afterwards, and what should. What it costs, who decides, and what usually goes wrong.
• The other frameworks you have also metThe other frameworks you have also met. What it costs, who decides, and what usually goes wrong.
• Export control, named and not advised onExport control, named and not advised on. What it costs, who decides, and what usually goes wrong.
• Your own suppliers, and what to ask themYour own suppliers, and what to ask them. What it costs, who decides, and what usually goes wrong.
• Suppliers outside the United StatesSuppliers outside the United States. What it costs, who decides, and what usually goes wrong.
• Where the data physically sitsWhere the data physically sits. What it costs, who decides, and what usually goes wrong.
• What is changing, and how to tellWhat is changing, and how to tell. What it costs, who decides, and what usually goes wrong.