When budget, staff, time or infrastructure are missing, information security quietly erodes — often long before a concrete incident occurs.
Lack of resources (G 0.27) affects the entire IT operation: from server capacity through personnel to the funding of security measures. In normal operations, bottlenecks can be temporarily compensated. Under pressure — for example in an emergency — they become a critical risk.
What’s behind it?
Lack of resources acts as an amplifier for nearly every other threat. When an organisation’s foundation — staff, budget, infrastructure, time — does not match the requirements, even the best security concepts run empty.
Affected resources
- Human resources — Too few administrators, missing backup arrangements, unfilled security roles. Critical tasks such as patch management, log analysis or emergency drills fall by the wayside.
- Technical resources — Undersized servers, insufficient network bandwidth, missing redundancy. New applications are placed on infrastructure that was dimensioned for the original load.
- Financial resources — No budget for spare parts, licence renewals or external specialists. In an insolvency, even basic maintenance contracts can no longer be served.
- Time resources — Over-tight project plans that leave no time for security testing. Security measures are “deferred” — and then never implemented.
Impact
Lack of resources rarely causes a single, dramatic incident. Its impact unfolds gradually: patches are applied late, monitoring alerts are not processed in time, emergency plans are not tested. When a concrete incident then occurs — a ransomware attack, a hardware failure, a compliance audit — the capacity to respond adequately is missing.
Practical examples
Overloaded administrators. In a company, a single administrator is responsible for network, servers and security. Log files are checked only every few weeks. An attacker exploits a known vulnerability that has been unpatched for months. The breach is only noticed when customer data appears on the darknet — weeks after the initial access.
Network overload through new applications. An organisation introduces a video conferencing solution whose bandwidth requirement was not considered in the network planning. During peak hours, the entire network collapses because the infrastructure cannot scale. Business-critical applications such as ERP and email are unreachable for hours.
No budget for spare parts. A company in financial difficulties cannot purchase hard drives for an ageing storage system. When a disk in the RAID array fails, there is no replacement. A second disk failure within a few days leads to total loss of the array.
Relevant controls
The following ISO 27001 controls mitigate this threat. (You’ll find the complete list of 56 mapped controls below in the section ‘ISO 27001 Controls Covering This Threat’.)
Prevention:
- A.5.2 — Information security roles and responsibilities: Clear assignment of security roles ensures that human resources are adequately planned.
- A.8.6 — Capacity management: Systematic monitoring and forecasting of resource demand prevents technical bottlenecks.
- A.5.29 — Information security during disruption: Continuity planning takes into account resource demand in emergency situations.
- A.5.1 — Policies for information security: Top management commits to providing the necessary resources.
Detection:
- A.8.15 — Logging: Central logging makes visible when maintenance and security tasks are not completed on time.
- A.5.35 — Independent review of information security: Audits uncover whether assigned resources meet the requirements.
Response:
- A.5.24 — Information security incident management planning and preparation: Incident response plans must realistically estimate resource demand in an emergency.
- A.5.26 — Response to information security incidents: Defined escalation paths when internal resources are not sufficient (external service providers, CERT).
BSI IT-Grundschutz
G 0.27 is linked by the BSI IT-Grundschutz catalogue to the following modules:
- ISMS.1 (Security management) — Requirements for providing resources for the ISMS.
- ORP.1 (Organisation) — Organisational framework and staffing.
- DER.4 (Emergency management) — Resource planning for emergency and crisis situations.
- OPS.1.1.1 (General IT operations) — Basic requirements for IT operations staffing.
Sources
- BSI: The State of IT Security in Germany — Annual report with findings on organisational weaknesses
- BSI IT-Grundschutz: Elementary Threats, G 0.27 — Original description of the elementary threat
- ISO/IEC 27002:2022 Section 8.6 — Implementation guidance on capacity management