ISMS Business Case Template (ISO/IEC 27001)
Drivers with evidence, four options (do nothing, SOC 2, 27001, 27001 plus 27701), 3-year costs and benefits per tier, risks, scoring, decision record
Mode d'emploi: Use it when a customer, tender, regulator or board asks for ISO/IEC 27001 and nobody has decided yet. Fill the drivers with checkable evidence first, then pull the cost lines from the budget and resource plan so both agree. The main pitfall is a case that lists benefits but hides internal effort and the real timing of benefits.
Aperçu
ISMS Business Case: [Organization name]
Business case for deciding whether, how and when to build and certify an information security management system (ISMS) under ISO/IEC 27001:2022 including Amendment 1:2024. It supports the leadership commitment expected in clause 5.1 (resources available, ISMS aligned with strategy) and gives top management a documented basis for the decision before the project starts. It compares four options (do nothing, SOC 2 only, ISO/IEC 27001, ISO/IEC 27001 plus ISO/IEC 27701:2025), with costs, benefits, risks and a recommendation. Replace every
[bracketed]value and every row marked Example. All money figures are Example values in USD: use your local currency and your own quotes.
Document control
| Field | Value |
|---|---|
| Document ID | DOC-ISMS-029 |
| Version | [0.1] |
| Status | [Draft / In review / Approved / Rejected / Superseded] |
| Owner | [@business-case-author, for example the CISO, CTO or ISMS manager] |
| Approvers/reviewers | [@ceo], [@cfo], [@coo], [@head-of-sales] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal / Confidential] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024; ISO/IEC 27701:2025 (option D) |
| Decision requested | [Approve option C and the year 1 budget / Choose between options] |
| Decision forum and date | [Board / Executive committee], YYYY-MM-DD |
| Budget reference | [DOC-ISMS-031, budget and resource plan version 1.0] |
| Next scheduled review | YYYY-MM-DD [at project closure or 12 months after approval] |
Approvals
| Role | Name | Decision | Date |
|---|---|---|---|
| Author | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| Finance | [@cfo] | [Costs and funding reviewed] | YYYY-MM-DD |
| Sponsor | [@coo] | [Recommended] | YYYY-MM-DD |
| Top management | [@ceo / Board chair] | [Approved / Rejected / Deferred] | YYYY-MM-DD |
Revision history
| Version | Date | Author | Change |
|---|---|---|---|
| 0.1 (Example) | YYYY-MM-DD | [@isms-manager] | First draft for finance review |
| 1.0 (Example) | YYYY-MM-DD | [@isms-manager] | Approved by the executive committee, option C |
| 1.1 (Example) | YYYY-MM-DD | [@isms-manager] | Benefits realisation review after Stage 2 |
Contents
- Executive summary
- Drivers and problem statement
- Current state and gap
- Options considered
- Costs
- Benefits
- Financial comparison
- Risks and dependencies
- Recommendation
- Decision record
- Size tiers
- Benefits realisation and follow-up
- Records and evidence
- References
1. Executive summary
[Organization name] is asked to decide how to answer a growing number of customer, tender and regulatory requests for evidence of information security. This business case recommends option C: build an ISMS and seek accredited certification to ISO/IEC 27001:2022 within [10] months, with a decision on the privacy extension (ISO/IEC 27701:2025) one year later.
| Item | Value |
|---|---|
| Decision requested | [Approve option C, the year 1 budget and the project sponsor] |
| Total 3-year economic cost (option C) (Example) | USD 2,061,500: USD 1,330,000 internal effort (time of existing staff) plus USD 731,500 cash spend |
| Target milestone | [Stage 2 certification audit completed by YYYY-MM-DD] |
| Strongest driver | [Four hospital tenders a year now require ISO/IEC 27001 or an equivalent] |
| Payback (Example) | During year 4 on full economic cost; late in year 3 on cash cost against cash benefits only |
| Main risk if rejected | [Exclusion from tenders and rising questionnaire workload] |
Certification is decided by the accredited certification body, not by this project. The case therefore commits to building an effective ISMS and to being ready for the audit, not to a guaranteed certificate.
2. Drivers and problem statement
2.1 Problem statement
[Describe in three to five sentences what is happening today. Example: Our sales team answers about 150 security questionnaires a year, each taking two to three days of engineering time. Two prospects in the last year ended talks because we could not show an independent certificate. Our cyber insurer asked for evidence of a managed security programme at renewal. We have no single owner of information security risk.]
2.2 Drivers
| ID | Driver | Evidence | Weight (1 to 5) | Option most affected |
|---|---|---|---|---|
| DRV-001 (Example) | Customer demand: enterprise and public-sector buyers ask for ISO/IEC 27001 certificates | [CRM notes, 6 lost or stalled deals, tender clause references] | 5 | C, D |
| DRV-002 (Example) | Tenders: public procurement and hospital framework agreements score certified suppliers higher or require certification | [Tender documents, scoring sheets] | 5 | C, D |
| DRV-003 (Example) | Regulation: customers in scope of NIS2 (Directive (EU) 2022/2555) or DORA (Regulation (EU) 2022/2554) push supply chain security duties to suppliers | [Customer contract schedules, supplier questionnaires] | 4 | B, C, D |
| DRV-004 (Example) | Privacy: customers ask for evidence of personal data protection as processor (GDPR Article 28 style clauses) | [Data processing agreements, privacy questionnaires] | 3 | D |
| DRV-005 (Example) | Risk reduction: ransomware, credential theft and supplier compromise are the top scenarios in our last incident review | [Incident log, gap assessment] | 4 | B, C, D |
| DRV-006 (Example) | Insurance: insurer asks for evidence of a security management programme and may adjust premium or cover | [Insurer renewal questionnaire] | 2 | C, D |
| DRV-007 (Example) | Efficiency: one certified framework reduces repeated questionnaires and customer audits | [Questionnaire log, hours spent] | 3 | B, C, D |
Laws are named here only as examples of where pressure comes from.
Determine which laws, regulations and contracts actually apply to you in
the legal register (compliance/legal-register), and take legal advice
where needed. This is a documentation format, not legal advice.
2.3 Why now
[State the trigger and the cost of delay. Example: the next hospital framework tender opens in Q4 next year and requires a valid certificate at bid submission. A 10-month project started this quarter is the latest start that meets that date with a margin of two months.]
3. Current state and gap
Summarise the result of the gap assessment
(compliance/iso-27001-gap-assessment, DOC-ISMS-098) and any recent
audit, penetration test or incident review.
| Area | Current state (Example) | Gap size |
|---|---|---|
| Clauses 4 to 10 (management system) | No defined scope, no risk method, no internal audit or management review | Large |
| Organizational controls (A.5) | Some policies exist, not approved or reviewed; supplier security informal | Medium |
| People controls (A.6) | Onboarding includes a confidentiality clause; no awareness programme | Medium |
| Physical controls (A.7) | Office access badges; no clear desk rule; colocation provider certified | Small |
| Technological controls (A.8) | Strong cloud engineering practice, MFA on main systems, logging partial, backups untested | Medium |
| Records | Few records kept in a form an auditor can sample | Large |
Overall readiness (Example): about 35% of the expected management system and control evidence exists today.
4. Options considered
| Option | What it delivers | What it does not deliver |
|---|---|---|
| A. Do nothing | Continue answering questionnaires case by case; fix issues as they arise | No independent assurance; no systematic risk management; tender exclusion continues |
| B. SOC 2 only | An independent service auditor's report on controls against the AICPA Trust Services Criteria (cited by name only), typically Type I then Type II | No certificate; recognition strongest in North America; scope set by the service description, not by a management system |
| C. ISO/IEC 27001 | A risk-based ISMS covering clauses 4 to 10 and the Annex A controls selected in the Statement of Applicability, audited by an accredited certification body (accredited by a signatory of the Global ACI MRA, formerly IAF MLA) on a three-year cycle | No dedicated privacy management system; personal data handled through general controls only |
| D. ISO/IEC 27001 plus ISO/IEC 27701 | Option C plus a privacy information management system (PIMS) under ISO/IEC 27701:2025, which can be certified alongside the ISMS | Higher effort; requires mature records of processing and privacy roles |
Notes on the options:
- ISO/IEC 27701:2025 is a stand-alone management system standard and can be certified without ISO/IEC 27001. Combining it with an ISMS reuses the same management system processes, which is why option D is modelled as an add-on to option C.
- Many organisations later add SOC 2 to an ISO/IEC 27001 programme, or
the reverse. A crosswalk (
isms/control-framework-crosswalk) shows how much evidence can be reused. - Options B, C and D all require real controls and real records. None of them is a documentation exercise.
5. Costs
5.1 Cost basis
Cost lines and assumptions come from the budget and resource plan
(isms/isms-budget-resource-plan, DOC-ISMS-031). The worked example is
Quillmere Health Systems (medium tier, 320 staff), using a loaded cost
of USD 140,000 per full-time equivalent (FTE) per year (Example).
5.2 3-year cost per option (Quillmere Health Systems, Example)
| Cost element | A. Do nothing | B. SOC 2 only | C. ISO/IEC 27001 | D. 27001 plus 27701 |
|---|---|---|---|---|
| Internal effort (existing staff time at loaded cost, not new cash) | 0 | 1,120,000 | 1,330,000 | 1,540,000 |
| External services, tools, audits, remediation | 0 | 750,000 | 665,000 | 765,000 |
| Contingency (10% of external project lines) | 0 | 75,000 | 66,500 | 66,500 |
| 3-year total | 0 | 1,945,000 | 2,061,500 | 2,371,500 |
| of which cash (excluding internal effort) | 0 | 825,000 | 731,500 | 831,500 |
How the figures are built (Example):
- Option B: internal effort 3.0, 2.5 and 2.5 FTE (USD 420,000, 350,000 and 350,000); external USD 750,000 (service auditor fees 180,000, readiness consultant 70,000, tooling 90,000, penetration tests 135,000, training 45,000, remediation 230,000); contingency USD 75,000.
- Option C: taken line by line from DOC-ISMS-031, medium tier: internal 3.5, 3.0 and 3.0 FTE (USD 490,000, 420,000 and 420,000); external lines USD 665,000 (consultant 90,000, GRC tooling 90,000, training and staff certification 55,000, penetration tests 135,000, certification body fees 65,000, remediation 230,000); contingency USD 66,500.
- Option D: option C plus a privacy add-on in years 2 and 3 of USD 310,000: internal effort 1.0 and 0.5 FTE (USD 210,000), consultant USD 40,000, certification body extension fees USD 30,000, training USD 10,000, remediation USD 20,000. The add-on carries no extra contingency in this example.
Replace the split above with your own figures. The rule to keep is that every total in this section equals the matching total in the budget and resource plan.
Internal effort is the time of people already on the payroll, valued at loaded cost. It is an opportunity cost (work they do not do elsewhere), not new spending, unless you hire or backfill; a new hire moves into the cash lines. Finance approves the cash budget; line managers approve the time. Show both, and never present the economic total as the cash request.
5.3 Cost of option A (do nothing)
Doing nothing has no project cost but it is not free. Record the expected cost of the status quo, for example:
| Status quo cost | Basis (Example) | Annual value (Example) |
|---|---|---|
| Questionnaire workload | 150 questionnaires x 18 hours x USD 85 | 229,500 |
| Lost or excluded opportunities | 4 tenders a year not bid | Not quantified in cash; see section 6 |
| Expected loss from security incidents | Annualised loss estimate from the risk register | Higher than options B to D |
6. Benefits
6.1 Benefit lines for option C (Quillmere Health Systems, Example)
| ID | Benefit | Assumption (Example) | Owner | Year 1 | Year 2 | Year 3 |
|---|---|---|---|---|---|---|
| BEN-001 (Example) | Tender revenue enabled (gross margin) | 4 tenders a year, average annual contract value USD 250,000, 40% win rate, 60% margin, so USD 240,000 margin added per year of wins; contracts won in year 2 continue in year 3 | [@head-of-sales] | 0 | 240,000 | 480,000 |
| BEN-002 (Example) | Questionnaire effort saved | 150 questionnaires x 12 hours saved x USD 85 from year 2, when the certificate and the answer library (isms/security-questionnaire-answer-library) exist | [@sales-engineering-lead] | 0 | 153,000 | 153,000 |
| BEN-003 (Example) | Insurance premium effect | 5% of a USD 300,000 premium from year 2, to be confirmed with the broker | [@cfo] | 0 | 15,000 | 15,000 |
| BEN-004 (Example) | Expected loss reduction | Annualised loss estimate falls by USD 300,000 once key controls operate; half in year 1 | [@isms-manager] | 150,000 | 300,000 | 300,000 |
| Total quantified benefits | 150,000 | 708,000 | 948,000 |
3-year quantified benefits (Example): USD 1,806,000.
6.2 Benefits not quantified
- Clear ownership of information security risk and a regular report to top management.
- Fewer customer audits on site, because customers accept the certificate and the Statement of Applicability instead.
- A management system that can absorb new requirements (privacy,
AI under
compliance/iso-42001-statement-of-applicability, sector regulation) without starting again. - Better evidence when responding to regulators and customers after an incident.
7. Financial comparison
7.1 Option C cash flow (Quillmere Health Systems, Example)
| Year | Cost | Benefit | Net | Cumulative net |
|---|---|---|---|---|
| Year 1 | 869,500 | 150,000 | -719,500 | -719,500 |
| Year 2 | 596,000 | 708,000 | 112,000 | -607,500 |
| Year 3 | 596,000 | 948,000 | 352,000 | -255,500 |
| Year 4 (recertification year) | 607,000 | 948,000 | 341,000 | 85,500 |
Cost here is full economic cost (internal effort plus cash). Year 4 replaces the surveillance fee (USD 15,000) with a recertification fee (USD 25,000), plus 10% contingency on the difference, so it is USD 11,000 higher than year 3. Year 4 benefits are held at the year 3 level, which is conservative. Payback on full economic cost falls during year 4.
Strict cash view (Example): BEN-002 is internal time freed and BEN-004 is a risk-adjusted expected value, so neither is cash. Comparing cash cost (379,500, 176,000, 176,000) with cash benefits only (BEN-001 and BEN-003: 0, 255,000, 495,000) gives a cumulative cash position of -379,500, -300,500 and +18,500, so cash payback falls late in year 3.
7.2 Option scoring
Score each option against the weighted drivers in section 2.2 (0 = does not address, 1 = partly, 2 = fully). Multiply by weight.
| Driver (weight) | A | B | C | D |
|---|---|---|---|---|
| DRV-001 Customer demand (5) | 0 | 1 | 2 | 2 |
| DRV-002 Tenders (5) | 0 | 1 | 2 | 2 |
| DRV-003 Regulation pressure (4) | 0 | 1 | 2 | 2 |
| DRV-004 Privacy (3) | 0 | 1 | 1 | 2 |
| DRV-005 Risk reduction (4) | 0 | 2 | 2 | 2 |
| DRV-006 Insurance (2) | 0 | 1 | 2 | 2 |
| DRV-007 Efficiency (3) | 0 | 1 | 2 | 2 |
| Weighted score (max 52) | 0 | 30 | 49 | 52 |
Option D scores highest but costs USD 310,000 more and depends on a mature records of processing activity. Option C delivers 49 of 52 points now and keeps option D open for year 2.
8. Risks and dependencies
| ID | Risk | Option | Likelihood | Impact | Score | Response |
|---|---|---|---|---|---|---|
| BCR-001 (Example) | Key staff not released from delivery work, project slips | C, D | 4 | 3 | 12 | Named allocations approved with the budget; sponsor reviews monthly |
| BCR-002 (Example) | Scope drawn too narrow, certificate not accepted by customers | C, D | 3 | 4 | 12 | Validate the scope statement with two key customers before Stage 1 |
| BCR-003 (Example) | Remediation (for example logging or backup testing) costs more than planned | B, C, D | 3 | 3 | 9 | 10% contingency; phase capital spend |
| BCR-004 (Example) | Tender deadline missed because Stage 2 is late | C, D | 2 | 5 | 10 | Plan a two-month margin; book the certification body early |
| BCR-005 (Example) | Exclusion from tenders continues and grows | A | 5 | 4 | 20 | Only addressed by options B to D |
| BCR-006 (Example) | Report not recognised by buyers outside North America | B | 3 | 3 | 9 | Combine with option C later |
Dependencies: [executive sponsor named; budget released by
YYYY-MM-DD; certification body selected
(isms/certification-body-selection); gap assessment complete].
9. Recommendation
Recommend option C with these conditions:
- Appoint [@coo] as sponsor and [@isms-manager] as full-time ISMS manager before the project starts.
- Approve the year 1 cash budget of USD 379,500 (Example), released
in the tranches set in
isms/isms-budget-resource-plan, and the named staff time of 3.5 FTE (USD 490,000 at loaded cost), for a year 1 economic cost of USD 869,500. - Approve the project charter (
isms/isms-project-charter, DOC-ISMS-009) and the roadmap (isms/isms-implementation-roadmap, DOC-ISMS-030) within four weeks. - Revisit option D (ISO/IEC 27701:2025) at the first management review after certification, using the privacy demand recorded in DRV-004.
10. Decision record
| Field | Value |
|---|---|
| Decision ID | [DEC-ISMS-001] |
| Forum | [Executive committee / Board] |
| Date | YYYY-MM-DD |
| Option chosen | [C. ISO/IEC 27001] |
| Budget approved | [USD amount, years covered, tranche conditions] |
| Conditions | [Sponsor named, ISMS manager appointed, charter approved within 4 weeks] |
| Options rejected and reason | [A: tender exclusion; B: weaker recognition with key buyers; D: deferred to year 2] |
| Minutes reference | [Minutes number and item] |
| Communicated to | [Staff announcement date, sales team briefing] |
| Signed | [@ceo] |
11. Size tiers
| Item | Small: Quillmere Analytics Ltd | Medium: Quillmere Health Systems | Large: Quillmere Group |
|---|---|---|---|
| Profile | B2B SaaS analytics, 46 staff (38 employees, 8 contractors), one office plus remote, one public cloud in two regions | Clinical scheduling software and managed service, 320 staff, two offices and one colocation suite | Manufacturing and services, 2,400 staff, 6 sites in 4 countries, OT and IT, already ISO 9001 and ISO 22301 certified |
| Main driver (Example) | Enterprise customers' procurement and questionnaires | Hospital tenders and processor obligations | Group customers, regulation pressure on OT and supply chain, integration with existing certificates |
| Typical options compared | B or C; many start-ups pick C for global recognition or B for US buyers | C, then D the year after | C as part of the integrated management system |
| Target (Example) | Certification in 6 months | ISO/IEC 27001 in 10 months, ISO/IEC 27701 the year after | Group certification in 15 months, phased by site |
| 3-year economic cost, option C (Example) | USD 537,600 = internal effort 300,000 (0.8, 0.6, 0.6 FTE) + cash 237,600 | USD 2,061,500 = internal effort 1,330,000 + cash 731,500 | USD 7,086,000 = internal effort 4,050,000 + cash 3,036,000 |
| Decision forum | Founders and CEO | Executive committee | Group board with site management input |
| Business case depth | 4 to 6 pages, costs and two options | Full template | Full template plus a site-by-site annex and integration savings |
Integration note for the large tier: an organisation already certified
to ISO 9001 and ISO 22301 reuses document control, internal audit,
management review and corrective action. Show those savings explicitly
(see compliance/iso-map and isms/integrated-management-27013).
12. Benefits realisation and follow-up
| Measure | Baseline (Example) | Target (Example) | Check at | Owner |
|---|---|---|---|---|
| Tenders bid that require ISO/IEC 27001 | 0 a year | 4 a year | First management review after certification | [@head-of-sales] |
| Average hours per security questionnaire | 18 | 6 | 6 months after certification | [@sales-engineering-lead] |
| Customer on-site security audits | 5 a year | 2 a year | Year 2 | [@isms-manager] |
| Project spend against approved budget | Plan | Within 10% | Each steering committee | [@cfo] |
| Stage 2 audit completed | Not started | By target date | Project closure | [@sponsor] |
Report realisation to management review (compliance/management-review)
and record improvements in the continual improvement register
(isms/continual-improvement-register).
13. Records and evidence
| Record | Proves | Owner | Location | Retention (Example) |
|---|---|---|---|---|
| Approved business case (this document) | Basis for the decision | [@isms-manager] | [Document management system] | Life of the ISMS plus 3 years |
| Decision minutes (section 10) | Top management commitment and resources (clause 5.1) | [@company-secretary] | [Board portal] | As per corporate records policy |
| Approved budget (DOC-ISMS-031) | Resources provided (clause 7.1) | [@cfo] | [Finance system] | 7 years or as finance rules require |
| Benefits realisation reports | Follow-up and improvement | [@isms-manager] | [ISMS records library] | 3 years |
Map these records in the control evidence matrix
(isms/control-evidence-matrix) and the documented information register
(isms/isms-documented-information-register).
14. References
| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022, information security management systems requirements | 2022, with Amd 1:2024 (published 2024-02-23) | Clauses 5.1 and 7.1 (leadership and resources), certification basis. https://www.iso.org/standard/82875.html and https://www.iso.org/standard/88435.html |
| ISO/IEC 27002:2022, information security controls | 2022 | Control guidance used in remediation estimates. https://www.iso.org/standard/75652.html |
| ISO/IEC 27701:2025, privacy information management systems | 2025 | Option D. https://www.iso.org/standard/85819.html |
| ISO/IEC 27006-1:2024, requirements for ISMS certification bodies | 2024 | Audit time set by the certification body. https://www.iso.org/standard/82908.html |
| AICPA Trust Services Criteria | 2017, revised points of focus 2022 (cited by name only) | Option B |
| Directive (EU) 2022/2555 (NIS2) | Adopted 2022-12-14 | Example regulatory driver |
| Regulation (EU) 2022/2554 (DORA) | Adopted 2022-12-14, applies from 2025-01-17 | Example regulatory driver |
Related templates: isms/isms-budget-resource-plan,
isms/isms-project-charter, isms/isms-implementation-roadmap,
compliance/iso-27001-gap-assessment, compliance/soc2-readiness-assessment,
isms/pims-27701-scope-roles, isms/certification-body-selection.
Standard and licence note
Structure aligned with ISO/IEC 27001:2022 including Amd 1:2024 (clauses 5.1 and 7.1) and common business case practice. The text, options, figures and examples are original; no ISO/IEC text is reproduced and the AICPA Trust Services Criteria are cited by name only. You need the official standards for the requirements themselves: https://www.iso.org/standard/82875.html. Check the current edition of every standard and law before use. All figures are Example values, not benchmarks, and certification decisions belong to the accredited certification body. This is a documentation format, not legal or financial advice. Template licence: MIT.
Modèles associés
ICT Readiness for Business Continuity Plan Template (ISO/IEC 27001 A.5.30)
ICT continuity requirements from the BIA, RTO and RPO per service, measured capability and gaps, strategies, recovery order, test programme, size tiers
SMSI & ISO/IEC 27001Access Control Policy Template (ISO/IEC 27001 A.5.15)
Access principles, role catalogue, joiner mover leaver SLAs, MFA and NIST SP 800-63B-4 password rules, privileged and service accounts, reviews, metrics
SMSI & ISO/IEC 27001Annex A Organizational Controls Guide Template (ISO/IEC 27001 A.5)
A.5.1 to A.5.37 in own words: intent, typical implementation, tier notes, evidence auditors sample, pitfalls, linked templates, self-check, study record