ISMS Business Case Template (ISO/IEC 27001)

Drivers with evidence, four options (do nothing, SOC 2, 27001, 27001 plus 27701), 3-year costs and benefits per tier, risks, scoring, decision record

ISMS और ISO/IEC 27001पूर्णISO/IEC 27001:2022 + Amd 1:2024 clauses 5.1 and 7.1 (cited only); ISO/IEC 27701:2025business caseअपडेट किया गया 1 नव॰ 2026

एडिटर में खोलें.md डाउनलोड करें

उपयोग कैसे करें: Use it when a customer, tender, regulator or board asks for ISO/IEC 27001 and nobody has decided yet. Fill the drivers with checkable evidence first, then pull the cost lines from the budget and resource plan so both agree. The main pitfall is a case that lists benefits but hides internal effort and the real timing of benefits.

प्रीव्यू

ISMS Business Case: [Organization name]

Business case for deciding whether, how and when to build and certify an information security management system (ISMS) under ISO/IEC 27001:2022 including Amendment 1:2024. It supports the leadership commitment expected in clause 5.1 (resources available, ISMS aligned with strategy) and gives top management a documented basis for the decision before the project starts. It compares four options (do nothing, SOC 2 only, ISO/IEC 27001, ISO/IEC 27001 plus ISO/IEC 27701:2025), with costs, benefits, risks and a recommendation. Replace every [bracketed] value and every row marked Example. All money figures are Example values in USD: use your local currency and your own quotes.

Document control

Field	Value
Document ID	DOC-ISMS-029
Version	[0.1]
Status	[Draft / In review / Approved / Rejected / Superseded]
Owner	[@business-case-author, for example the CISO, CTO or ISMS manager]
Approvers/reviewers	[@ceo], [@cfo], [@coo], [@head-of-sales]
Last updated	YYYY-MM-DD
Classification	[Internal / Confidential]
Standard and edition	ISO/IEC 27001:2022 + Amd 1:2024; ISO/IEC 27701:2025 (option D)
Decision requested	[Approve option C and the year 1 budget / Choose between options]
Decision forum and date	[Board / Executive committee], YYYY-MM-DD
Budget reference	[DOC-ISMS-031, budget and resource plan version 1.0]
Next scheduled review	YYYY-MM-DD [at project closure or 12 months after approval]

Approvals

Role	Name	Decision	Date
Author	[@isms-manager]	[Prepared]	YYYY-MM-DD
Finance	[@cfo]	[Costs and funding reviewed]	YYYY-MM-DD
Sponsor	[@coo]	[Recommended]	YYYY-MM-DD
Top management	[@ceo / Board chair]	[Approved / Rejected / Deferred]	YYYY-MM-DD

Revision history

Version	Date	Author	Change
0.1 (Example)	YYYY-MM-DD	[@isms-manager]	First draft for finance review
1.0 (Example)	YYYY-MM-DD	[@isms-manager]	Approved by the executive committee, option C
1.1 (Example)	YYYY-MM-DD	[@isms-manager]	Benefits realisation review after Stage 2

Executive summary
Drivers and problem statement
Current state and gap
Options considered
Costs
Benefits
Financial comparison
Risks and dependencies
Recommendation
Decision record
Size tiers
Benefits realisation and follow-up
Records and evidence
References

1. Executive summary

[Organization name] is asked to decide how to answer a growing number of customer, tender and regulatory requests for evidence of information security. This business case recommends option C: build an ISMS and seek accredited certification to ISO/IEC 27001:2022 within [10] months, with a decision on the privacy extension (ISO/IEC 27701:2025) one year later.

Item	Value
Decision requested	[Approve option C, the year 1 budget and the project sponsor]
Total 3-year economic cost (option C) (Example)	USD 2,061,500: USD 1,330,000 internal effort (time of existing staff) plus USD 731,500 cash spend
Target milestone	[Stage 2 certification audit completed by YYYY-MM-DD]
Strongest driver	[Four hospital tenders a year now require ISO/IEC 27001 or an equivalent]
Payback (Example)	During year 4 on full economic cost; late in year 3 on cash cost against cash benefits only
Main risk if rejected	[Exclusion from tenders and rising questionnaire workload]

Certification is decided by the accredited certification body, not by this project. The case therefore commits to building an effective ISMS and to being ready for the audit, not to a guaranteed certificate.

2. Drivers and problem statement

2.1 Problem statement

[Describe in three to five sentences what is happening today. Example: Our sales team answers about 150 security questionnaires a year, each taking two to three days of engineering time. Two prospects in the last year ended talks because we could not show an independent certificate. Our cyber insurer asked for evidence of a managed security programme at renewal. We have no single owner of information security risk.]

2.2 Drivers

ID	Driver	Evidence	Weight (1 to 5)	Option most affected
DRV-001 (Example)	Customer demand: enterprise and public-sector buyers ask for ISO/IEC 27001 certificates	[CRM notes, 6 lost or stalled deals, tender clause references]	5	C, D
DRV-002 (Example)	Tenders: public procurement and hospital framework agreements score certified suppliers higher or require certification	[Tender documents, scoring sheets]	5	C, D
DRV-003 (Example)	Regulation: customers in scope of NIS2 (Directive (EU) 2022/2555) or DORA (Regulation (EU) 2022/2554) push supply chain security duties to suppliers	[Customer contract schedules, supplier questionnaires]	4	B, C, D
DRV-004 (Example)	Privacy: customers ask for evidence of personal data protection as processor (GDPR Article 28 style clauses)	[Data processing agreements, privacy questionnaires]	3	D
DRV-005 (Example)	Risk reduction: ransomware, credential theft and supplier compromise are the top scenarios in our last incident review	[Incident log, gap assessment]	4	B, C, D
DRV-006 (Example)	Insurance: insurer asks for evidence of a security management programme and may adjust premium or cover	[Insurer renewal questionnaire]	2	C, D
DRV-007 (Example)	Efficiency: one certified framework reduces repeated questionnaires and customer audits	[Questionnaire log, hours spent]	3	B, C, D

Laws are named here only as examples of where pressure comes from. Determine which laws, regulations and contracts actually apply to you in the legal register (compliance/legal-register), and take legal advice where needed. This is a documentation format, not legal advice.

2.3 Why now

[State the trigger and the cost of delay. Example: the next hospital framework tender opens in Q4 next year and requires a valid certificate at bid submission. A 10-month project started this quarter is the latest start that meets that date with a margin of two months.]

3. Current state and gap

Summarise the result of the gap assessment (compliance/iso-27001-gap-assessment, DOC-ISMS-098) and any recent audit, penetration test or incident review.

Area	Current state (Example)	Gap size
Clauses 4 to 10 (management system)	No defined scope, no risk method, no internal audit or management review	Large
Organizational controls (A.5)	Some policies exist, not approved or reviewed; supplier security informal	Medium
People controls (A.6)	Onboarding includes a confidentiality clause; no awareness programme	Medium
Physical controls (A.7)	Office access badges; no clear desk rule; colocation provider certified	Small
Technological controls (A.8)	Strong cloud engineering practice, MFA on main systems, logging partial, backups untested	Medium
Records	Few records kept in a form an auditor can sample	Large

Overall readiness (Example): about 35% of the expected management system and control evidence exists today.

4. Options considered

Option	What it delivers	What it does not deliver
A. Do nothing	Continue answering questionnaires case by case; fix issues as they arise	No independent assurance; no systematic risk management; tender exclusion continues
B. SOC 2 only	An independent service auditor's report on controls against the AICPA Trust Services Criteria (cited by name only), typically Type I then Type II	No certificate; recognition strongest in North America; scope set by the service description, not by a management system
C. ISO/IEC 27001	A risk-based ISMS covering clauses 4 to 10 and the Annex A controls selected in the Statement of Applicability, audited by an accredited certification body (accredited by a signatory of the Global ACI MRA, formerly IAF MLA) on a three-year cycle	No dedicated privacy management system; personal data handled through general controls only
D. ISO/IEC 27001 plus ISO/IEC 27701	Option C plus a privacy information management system (PIMS) under ISO/IEC 27701:2025, which can be certified alongside the ISMS	Higher effort; requires mature records of processing and privacy roles

Notes on the options:

ISO/IEC 27701:2025 is a stand-alone management system standard and can be certified without ISO/IEC 27001. Combining it with an ISMS reuses the same management system processes, which is why option D is modelled as an add-on to option C.
Many organisations later add SOC 2 to an ISO/IEC 27001 programme, or the reverse. A crosswalk (isms/control-framework-crosswalk) shows how much evidence can be reused.
Options B, C and D all require real controls and real records. None of them is a documentation exercise.

5. Costs

5.1 Cost basis

Cost lines and assumptions come from the budget and resource plan (isms/isms-budget-resource-plan, DOC-ISMS-031). The worked example is Quillmere Health Systems (medium tier, 320 staff), using a loaded cost of USD 140,000 per full-time equivalent (FTE) per year (Example).

5.2 3-year cost per option (Quillmere Health Systems, Example)

Cost element	B. SOC 2 only	C. ISO/IEC 27001	D. 27001 plus 27701
Internal effort (existing staff time at loaded cost, not new cash)	1,120,000	1,330,000	1,540,000
External services, tools, audits, remediation	750,000	665,000	765,000
Contingency (10% of external project lines)	75,000	66,500	66,500
3-year total	1,945,000	2,061,500	2,371,500
of which cash (excluding internal effort)	825,000	731,500	831,500

How the figures are built (Example):

Option B: internal effort 3.0, 2.5 and 2.5 FTE (USD 420,000, 350,000 and 350,000); external USD 750,000 (service auditor fees 180,000, readiness consultant 70,000, tooling 90,000, penetration tests 135,000, training 45,000, remediation 230,000); contingency USD 75,000.
Option C: taken line by line from DOC-ISMS-031, medium tier: internal 3.5, 3.0 and 3.0 FTE (USD 490,000, 420,000 and 420,000); external lines USD 665,000 (consultant 90,000, GRC tooling 90,000, training and staff certification 55,000, penetration tests 135,000, certification body fees 65,000, remediation 230,000); contingency USD 66,500.
Option D: option C plus a privacy add-on in years 2 and 3 of USD 310,000: internal effort 1.0 and 0.5 FTE (USD 210,000), consultant USD 40,000, certification body extension fees USD 30,000, training USD 10,000, remediation USD 20,000. The add-on carries no extra contingency in this example.

Replace the split above with your own figures. The rule to keep is that every total in this section equals the matching total in the budget and resource plan.

Internal effort is the time of people already on the payroll, valued at loaded cost. It is an opportunity cost (work they do not do elsewhere), not new spending, unless you hire or backfill; a new hire moves into the cash lines. Finance approves the cash budget; line managers approve the time. Show both, and never present the economic total as the cash request.

5.3 Cost of option A (do nothing)

Doing nothing has no project cost but it is not free. Record the expected cost of the status quo, for example:

Status quo cost	Basis (Example)	Annual value (Example)
Questionnaire workload	150 questionnaires x 18 hours x USD 85	229,500
Lost or excluded opportunities	4 tenders a year not bid	Not quantified in cash; see section 6
Expected loss from security incidents	Annualised loss estimate from the risk register	Higher than options B to D

6. Benefits

6.1 Benefit lines for option C (Quillmere Health Systems, Example)

ID	Benefit	Assumption (Example)	Owner	Year 1	Year 2	Year 3
BEN-001 (Example)	Tender revenue enabled (gross margin)	4 tenders a year, average annual contract value USD 250,000, 40% win rate, 60% margin, so USD 240,000 margin added per year of wins; contracts won in year 2 continue in year 3	[@head-of-sales]	0	240,000	480,000
BEN-002 (Example)	Questionnaire effort saved	150 questionnaires x 12 hours saved x USD 85 from year 2, when the certificate and the answer library (`isms/security-questionnaire-answer-library`) exist	[@sales-engineering-lead]	0	153,000	153,000
BEN-003 (Example)	Insurance premium effect	5% of a USD 300,000 premium from year 2, to be confirmed with the broker	[@cfo]	0	15,000	15,000
BEN-004 (Example)	Expected loss reduction	Annualised loss estimate falls by USD 300,000 once key controls operate; half in year 1	[@isms-manager]	150,000	300,000	300,000
	Total quantified benefits			150,000	708,000	948,000

3-year quantified benefits (Example): USD 1,806,000.

6.2 Benefits not quantified

Clear ownership of information security risk and a regular report to top management.
Fewer customer audits on site, because customers accept the certificate and the Statement of Applicability instead.
A management system that can absorb new requirements (privacy, AI under compliance/iso-42001-statement-of-applicability, sector regulation) without starting again.
Better evidence when responding to regulators and customers after an incident.

7. Financial comparison

7.1 Option C cash flow (Quillmere Health Systems, Example)

Year	Cost	Benefit	Net	Cumulative net
Year 1	869,500	150,000	-719,500	-719,500
Year 2	596,000	708,000	112,000	-607,500
Year 3	596,000	948,000	352,000	-255,500
Year 4 (recertification year)	607,000	948,000	341,000	85,500

Cost here is full economic cost (internal effort plus cash). Year 4 replaces the surveillance fee (USD 15,000) with a recertification fee (USD 25,000), plus 10% contingency on the difference, so it is USD 11,000 higher than year 3. Year 4 benefits are held at the year 3 level, which is conservative. Payback on full economic cost falls during year 4.

Strict cash view (Example): BEN-002 is internal time freed and BEN-004 is a risk-adjusted expected value, so neither is cash. Comparing cash cost (379,500, 176,000, 176,000) with cash benefits only (BEN-001 and BEN-003: 0, 255,000, 495,000) gives a cumulative cash position of -379,500, -300,500 and +18,500, so cash payback falls late in year 3.

7.2 Option scoring

Score each option against the weighted drivers in section 2.2 (0 = does not address, 1 = partly, 2 = fully). Multiply by weight.

Driver (weight)	B	C	D
DRV-001 Customer demand (5)	1	2	2
DRV-002 Tenders (5)	1	2	2
DRV-003 Regulation pressure (4)	1	2	2
DRV-004 Privacy (3)	1	1	2
DRV-005 Risk reduction (4)	2	2	2
DRV-006 Insurance (2)	1	2	2
DRV-007 Efficiency (3)	1	2	2
Weighted score (max 52)	30	49	52

Option D scores highest but costs USD 310,000 more and depends on a mature records of processing activity. Option C delivers 49 of 52 points now and keeps option D open for year 2.

8. Risks and dependencies

ID	Risk	Option	Likelihood	Impact	Score	Response
BCR-001 (Example)	Key staff not released from delivery work, project slips	C, D	4	3	12	Named allocations approved with the budget; sponsor reviews monthly
BCR-002 (Example)	Scope drawn too narrow, certificate not accepted by customers	C, D	3	4	12	Validate the scope statement with two key customers before Stage 1
BCR-003 (Example)	Remediation (for example logging or backup testing) costs more than planned	B, C, D	3	3	9	10% contingency; phase capital spend
BCR-004 (Example)	Tender deadline missed because Stage 2 is late	C, D	2	5	10	Plan a two-month margin; book the certification body early
BCR-005 (Example)	Exclusion from tenders continues and grows	A	5	4	20	Only addressed by options B to D
BCR-006 (Example)	Report not recognised by buyers outside North America	B	3	3	9	Combine with option C later

Dependencies: [executive sponsor named; budget released by YYYY-MM-DD; certification body selected (isms/certification-body-selection); gap assessment complete].

9. Recommendation

Recommend option C with these conditions:

Appoint [@coo] as sponsor and [@isms-manager] as full-time ISMS manager before the project starts.
Approve the year 1 cash budget of USD 379,500 (Example), released in the tranches set in isms/isms-budget-resource-plan, and the named staff time of 3.5 FTE (USD 490,000 at loaded cost), for a year 1 economic cost of USD 869,500.
Approve the project charter (isms/isms-project-charter, DOC-ISMS-009) and the roadmap (isms/isms-implementation-roadmap, DOC-ISMS-030) within four weeks.
Revisit option D (ISO/IEC 27701:2025) at the first management review after certification, using the privacy demand recorded in DRV-004.

10. Decision record

Field	Value
Decision ID	[DEC-ISMS-001]
Forum	[Executive committee / Board]
Date	YYYY-MM-DD
Option chosen	[C. ISO/IEC 27001]
Budget approved	[USD amount, years covered, tranche conditions]
Conditions	[Sponsor named, ISMS manager appointed, charter approved within 4 weeks]
Options rejected and reason	[A: tender exclusion; B: weaker recognition with key buyers; D: deferred to year 2]
Minutes reference	[Minutes number and item]
Communicated to	[Staff announcement date, sales team briefing]
Signed	[@ceo]

11. Size tiers

Item	Small: Quillmere Analytics Ltd	Medium: Quillmere Health Systems	Large: Quillmere Group
Profile	B2B SaaS analytics, 46 staff (38 employees, 8 contractors), one office plus remote, one public cloud in two regions	Clinical scheduling software and managed service, 320 staff, two offices and one colocation suite	Manufacturing and services, 2,400 staff, 6 sites in 4 countries, OT and IT, already ISO 9001 and ISO 22301 certified
Main driver (Example)	Enterprise customers' procurement and questionnaires	Hospital tenders and processor obligations	Group customers, regulation pressure on OT and supply chain, integration with existing certificates
Typical options compared	B or C; many start-ups pick C for global recognition or B for US buyers	C, then D the year after	C as part of the integrated management system
Target (Example)	Certification in 6 months	ISO/IEC 27001 in 10 months, ISO/IEC 27701 the year after	Group certification in 15 months, phased by site
3-year economic cost, option C (Example)	USD 537,600 = internal effort 300,000 (0.8, 0.6, 0.6 FTE) + cash 237,600	USD 2,061,500 = internal effort 1,330,000 + cash 731,500	USD 7,086,000 = internal effort 4,050,000 + cash 3,036,000
Decision forum	Founders and CEO	Executive committee	Group board with site management input
Business case depth	4 to 6 pages, costs and two options	Full template	Full template plus a site-by-site annex and integration savings

Integration note for the large tier: an organisation already certified to ISO 9001 and ISO 22301 reuses document control, internal audit, management review and corrective action. Show those savings explicitly (see compliance/iso-map and isms/integrated-management-27013).

12. Benefits realisation and follow-up

Measure	Baseline (Example)	Target (Example)	Check at	Owner
Tenders bid that require ISO/IEC 27001	0 a year	4 a year	First management review after certification	[@head-of-sales]
Average hours per security questionnaire	18	6	6 months after certification	[@sales-engineering-lead]
Customer on-site security audits	5 a year	2 a year	Year 2	[@isms-manager]
Project spend against approved budget	Plan	Within 10%	Each steering committee	[@cfo]
Stage 2 audit completed	Not started	By target date	Project closure	[@sponsor]

Report realisation to management review (compliance/management-review) and record improvements in the continual improvement register (isms/continual-improvement-register).

13. Records and evidence

Record	Proves	Owner	Location	Retention (Example)
Approved business case (this document)	Basis for the decision	[@isms-manager]	[Document management system]	Life of the ISMS plus 3 years
Decision minutes (section 10)	Top management commitment and resources (clause 5.1)	[@company-secretary]	[Board portal]	As per corporate records policy
Approved budget (DOC-ISMS-031)	Resources provided (clause 7.1)	[@cfo]	[Finance system]	7 years or as finance rules require
Benefits realisation reports	Follow-up and improvement	[@isms-manager]	[ISMS records library]	3 years

Map these records in the control evidence matrix (isms/control-evidence-matrix) and the documented information register (isms/isms-documented-information-register).

14. References

Reference	Edition	Use
ISO/IEC 27001:2022, information security management systems requirements	2022, with Amd 1:2024 (published 2024-02-23)	Clauses 5.1 and 7.1 (leadership and resources), certification basis. https://www.iso.org/standard/82875.html and https://www.iso.org/standard/88435.html
ISO/IEC 27002:2022, information security controls	2022	Control guidance used in remediation estimates. https://www.iso.org/standard/75652.html
ISO/IEC 27701:2025, privacy information management systems	2025	Option D. https://www.iso.org/standard/85819.html
ISO/IEC 27006-1:2024, requirements for ISMS certification bodies	2024	Audit time set by the certification body. https://www.iso.org/standard/82908.html
AICPA Trust Services Criteria	2017, revised points of focus 2022 (cited by name only)	Option B
Directive (EU) 2022/2555 (NIS2)	Adopted 2022-12-14	Example regulatory driver
Regulation (EU) 2022/2554 (DORA)	Adopted 2022-12-14, applies from 2025-01-17	Example regulatory driver

Related templates: isms/isms-budget-resource-plan, isms/isms-project-charter, isms/isms-implementation-roadmap, compliance/iso-27001-gap-assessment, compliance/soc2-readiness-assessment, isms/pims-27701-scope-roles, isms/certification-body-selection.

Standard and licence note

Structure aligned with ISO/IEC 27001:2022 including Amd 1:2024 (clauses 5.1 and 7.1) and common business case practice. The text, options, figures and examples are original; no ISO/IEC text is reproduced and the AICPA Trust Services Criteria are cited by name only. You need the official standards for the requirements themselves: https://www.iso.org/standard/82875.html. Check the current edition of every standard and law before use. All figures are Example values, not benchmarks, and certification decisions belong to the accredited certification body. This is a documentation format, not legal or financial advice. Template licence: MIT.