Run spend keeps core identity operations working, grow spend adds capacity or coverage, and transform spend funds experimentation or redesign. For identity teams, the key distinction is whether a cost preserves current assurance, expands control coverage, or changes how the programme operates. Misclassifying these items leads to underfunded governance.
How run spend protects identity operations
Run spend is the money that keeps the identity programme steady: directory services, authentication flows, access reviews, joiner-mover-leaver processing, logging, renewal cycles, and day-to-day support. It is usually the least visible part of the budget, but it is the part that prevents controls from degrading. For identity teams, run spend preserves current assurance rather than adding new capability.
That distinction matters because identity control failure is often gradual. If run funding is squeezed, teams may delay reviews, defer cleanup, or let operational debt accumulate until the programme still “exists” but no longer performs at the standard the business assumes. Well-structured budgets make that maintenance cost explicit instead of treating it as overhead.
What grow spend actually buys
Grow spend expands the current identity capability without changing the operating model. That can mean onboarding more applications, extending coverage to more user populations, improving integrations, adding stronger authentication, or scaling reporting and governance to a larger estate. The point is reach and capacity, not reinvention.
In practice, grow spend should answer a simple question: what additional control coverage, throughput, or service quality will the team gain? A security budget template and cost model is useful here because it separates run costs from change costs and forces line items to be tied to a clear purpose. That helps identity leaders justify why an item is expansionary rather than merely a recurring operational need.
When transform spend is justified
Transform spend funds redesign. It pays for experimentation, platform replacement, operating model change, automation shifts, or major re-architecture of how identity work gets done. Unlike grow spend, transform spend should not be judged only by immediate coverage. It is about changing the programme’s structure so future operations are cheaper, faster, or more resilient.
That makes transform spend the hardest category to defend if the outcome is vague. It needs a clear thesis: what will become materially different, what current friction will disappear, and what evidence will show the new model is better? The strongest cases are usually tied to measurable simplification, improved governance, or reduced manual effort rather than abstract innovation.
Risk and Threat Considerations
Misclassifying spend is not just an accounting issue. If costs that belong in run or grow are pushed into transform, core identity services can become underfunded, review cycles slip, and control coverage erodes. If transform is labelled as run, the programme can stagnate and keep paying for manual work that should have been redesigned away.
Failure mechanism: Budget labels shape funding approvals, staffing, and delivery priorities, so the wrong classification hides the real cost of maintaining assurance or delays needed expansion and redesign.
Impact: Identity teams can end up with brittle operations, incomplete coverage, slower remediation, and governance debt that only becomes visible after an access incident, audit finding, or major platform change.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RR-01 — Roles, Responsibilities, and Authorities | Run/grow/transform spend affects ownership of identity funding decisions. |
| GV.PO-01 — Policy | Budget classification needs policy so recurring and change spend are separated consistently. | |
| Recommendation — Assign clear budget ownership for identity run, grow, and transform decisions. Define a budgeting policy that separates operational, expansion, and transformation spend. | ||
| NIST SP 800-53 Rev 5 | PM-3 — Information System Planning | Identity funding choices are part of planning how the programme evolves over time. |
| Recommendation — Plan identity programme funding as lifecycle work, not only annual maintenance. | ||
| CIS Controls v8 | CIS-4 — Secure Configuration of Enterprise Assets and Software | Transform spend often funds control redesign and standardisation that reduce recurring effort. |
| Recommendation — Use transformation funding to remove manual configuration drift and standardise identity controls. | ||
| ISO/IEC 27001:2022 | A.5.4 — Management responsibilities | Budget labels affect who owns identity assurance, change, and operating cost decisions. |
| Recommendation — Assign explicit accountability for identity budget allocation and change approval. | ||
Practitioner Guidance
What to prioritise: Classify each line item by the outcome it preserves or changes. If the spend keeps existing identity controls operating, treat it as run. If it increases coverage or scale, treat it as grow. If it changes the operating model, treat it as transform.
What to verify: Ask whether the item reduces current operational risk, expands control reach, or replaces the way the function works. If a request contains both recurring support and redesign elements, split it so the funding decision is not distorted by mixed intent.
Common mistake: Teams often call manual backlogs “transformation” because they are painful, when they are really a sign that run funding is too low. That mislabelling can delay the basic maintenance work needed to keep assurance intact.
Practitioner takeaway: The useful test is not whether a cost feels strategic, but whether it preserves today’s assurance, broadens today’s coverage, or changes tomorrow’s operating model.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 30, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org