While it would be wonderful to have unlimited funds to build an unbreachable security plan , few organizations find themselves in that unenviable position. The rest of us who live in the real world are left with building strong cyber security plans that allows us to extend protections against attacks to the organization, enables timely detection of a potential threats or an actual breach, and provides the organization with the tools to tackle them effectively when they occur. In 2020 the University of Texas commissioned an information security program sustainability study of the 15 member UT institutions. The goal of the study was to improve institution leadership’s ability to understand and mitigate the information security risk associated with various levels of investment. The talk will focus on the approach taken to conduct the study and findings/recommendations of the assessment.