Transform spend funds experiments, pilots and change initiatives that are intended to improve the future state of the organisation. For identity teams, it is the budget for testing new governance models, automation approaches or platform changes without assuming immediate operational dependency.
What Transform Spend Means for Identity Teams
Transform spend is the budget set aside for experiments, pilots, and planned change that improve the future state of the organisation. In identity work, it funds controlled testing of governance models, automation, and platform changes before they become day-to-day dependencies.
Why Transform Spend Exists
Transform spend is distinct from run spend because it is meant to create change, not merely sustain existing services. That difference matters in identity programmes, where teams often need time and budget to validate whether a new approval flow, lifecycle model, or access control pattern actually reduces friction or risk before scaling it.
It also creates a practical boundary for decision-making. A pilot can tolerate some uncertainty, but only if the organisation treats the work as a learning investment with explicit outcomes, such as confirming feasibility, measuring operational load, or proving that a control change can be adopted safely.
Where Transform Spend Shows Up in Identity Programs
Common identity examples include proof-of-concept work for governance automation, staged rollouts of authentication changes, access review redesigns, or testing a new platform integration. The point is to buy evidence, not just technology.
For that reason, transform spend is often used to explore NIST Cybersecurity Framework 2.0 style improvement work, where an organisation is trying to move a control capability forward without assuming the final operating model is already known. It may also support identity control design choices that later align with NIST SP 800-53 Rev 5 Security and Privacy Controls when a team is validating a better control implementation before production adoption.
How to Judge Whether Spend Is Truly Transformational
Transform spend should have a clear hypothesis, a bounded scope, and a defined exit condition. If a pilot never graduates into a decision, it stops being transformational and starts behaving like hidden run cost.
In identity and access work, that question is especially important because experiments can drift into permanent partial implementations, shadow workflows, or duplicated administration. Teams should be able to explain what the test is proving, what success looks like, and what operational change follows if the pilot works.
That discipline is also relevant when a programme is testing non-human or automated access patterns, where a new model can change who or what is allowed to act. If the future state depends on stronger governance or more precise enforcement, a budget line for change should be paired with a clear security design, not just a feature trial.
What Good Transform Spend Delivers
Well-used transform spend shortens the path from idea to durable improvement. It should reduce uncertainty about feasibility, reveal hidden costs, and make the next operating model easier to defend to security, operations, and finance stakeholders.
It should also leave behind something reusable, such as a decision record, a prototype, a tested control pattern, or a migration approach that can be scaled. When transform spend works, it changes the organisation's future run state instead of just producing activity.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | GV.RM-01 — Risk Management Strategy | Transform spend supports funded improvement work tied to risk treatment and future-state control decisions. |
| Recommendation — Use transform budget to fund improvements that reduce identity and access risk in the target operating model. | ||
| NIST SP 800-53 Rev 5 | PM-11 — Mission and Business Process Definitions | Transform spend is used to test changes before they alter operational processes and control ownership. |
| Recommendation — Define the future-state process the pilot is validating before expanding spend into production change. | ||
| ISO/IEC 27001:2022 | A.5.4 — Management responsibilities | Change funding needs clear ownership so experimental work is accountable and governed as it matures. |
| Recommendation — Assign accountable owners for each funded experiment and require a decision path for graduation or stop. | ||
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 8, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org