# ISMS Business Case: [Organization name]

> Business case for deciding whether, how and when to build and certify
> an information security management system (ISMS) under ISO/IEC
> 27001:2022 including Amendment 1:2024. It supports the leadership
> commitment expected in clause 5.1 (resources available, ISMS aligned
> with strategy) and gives top management a documented basis for the
> decision before the project starts. It compares four options (do
> nothing, SOC 2 only, ISO/IEC 27001, ISO/IEC 27001 plus ISO/IEC
> 27701:2025), with costs, benefits, risks and a recommendation. Replace
> every `[bracketed]` value and every row marked *Example*. All money
> figures are *Example* values in USD: use your local currency and your
> own quotes.

<!--
Guidance: How to use this template
- Use it before any money or staff time is committed, when a customer,
  tender, regulator, insurer or board member asks "are you ISO 27001
  certified?" and nobody has decided yet. It is the first document of
  the ISMS journey (DOC-ISMS-029).
- Fill first: section 2 (drivers, with named evidence such as lost
  deals or tender clauses), then section 4 (options), then pull the
  cost lines from `isms/isms-budget-resource-plan` so the two documents
  never disagree.
- Main pitfall: a business case that only lists benefits. Decision
  makers trust a case that shows the full economic cost (internal
  effort included), honest timing of benefits and the risks of each
  option, including the risk of doing nothing.
- Related templates: `isms/isms-budget-resource-plan`,
  `isms/isms-project-charter`, `isms/isms-implementation-roadmap`,
  `compliance/iso-27001-gap-assessment`, `compliance/soc2-readiness-assessment`,
  `compliance/nis2-security-measures`, `compliance/dora-ict-risk-management-framework`,
  `isms/pims-27701-scope-roles`.
-->

## Document control

<!-- Guidance: Treat the approved business case as controlled documented information. The decision record in section 10 is the evidence an auditor may ask for when testing leadership commitment (clause 5.1). -->

| Field | Value |
|---|---|
| Document ID | DOC-ISMS-029 |
| Version | [0.1] |
| Status | [Draft / In review / Approved / Rejected / Superseded] |
| Owner | [@business-case-author, for example the CISO, CTO or ISMS manager] |
| Approvers/reviewers | [@ceo], [@cfo], [@coo], [@head-of-sales] |
| Last updated | YYYY-MM-DD |
| Classification | [Internal / Confidential] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024; ISO/IEC 27701:2025 (option D) |
| Decision requested | [Approve option C and the year 1 budget / Choose between options] |
| Decision forum and date | [Board / Executive committee], YYYY-MM-DD |
| Budget reference | [DOC-ISMS-031, budget and resource plan version 1.0] |
| Next scheduled review | YYYY-MM-DD [at project closure or 12 months after approval] |

### Approvals

| Role | Name | Decision | Date |
|---|---|---|---|
| Author | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| Finance | [@cfo] | [Costs and funding reviewed] | YYYY-MM-DD |
| Sponsor | [@coo] | [Recommended] | YYYY-MM-DD |
| Top management | [@ceo / Board chair] | [Approved / Rejected / Deferred] | YYYY-MM-DD |

### Revision history

| Version | Date | Author | Change |
|---|---|---|---|
| 0.1 *(Example)* | YYYY-MM-DD | [@isms-manager] | First draft for finance review |
| 1.0 *(Example)* | YYYY-MM-DD | [@isms-manager] | Approved by the executive committee, option C |
| 1.1 *(Example)* | YYYY-MM-DD | [@isms-manager] | Benefits realisation review after Stage 2 |

## Contents

<!-- Guidance: Executives often read only section 1 and section 10. Make both stand alone. -->

1. Executive summary
2. Drivers and problem statement
3. Current state and gap
4. Options considered
5. Costs
6. Benefits
7. Financial comparison
8. Risks and dependencies
9. Recommendation
10. Decision record
11. Size tiers
12. Benefits realisation and follow-up
13. Records and evidence
14. References

## 1. Executive summary

<!-- Guidance: Write this last, in under 200 words. State the decision requested, the recommended option, the total cost, the target date and the single strongest reason. Avoid jargon such as "Annex A" here. -->

[Organization name] is asked to decide how to answer a growing number of
customer, tender and regulatory requests for evidence of information
security. This business case recommends **option C: build an ISMS and
seek accredited certification to ISO/IEC 27001:2022** within
[10] months, with a decision on the privacy extension (ISO/IEC
27701:2025) one year later.

| Item | Value |
|---|---|
| Decision requested | [Approve option C, the year 1 budget and the project sponsor] |
| Total 3-year economic cost (option C) *(Example)* | USD 2,061,500: USD 1,330,000 internal effort (time of existing staff) plus USD 731,500 cash spend |
| Target milestone | [Stage 2 certification audit completed by YYYY-MM-DD] |
| Strongest driver | [Four hospital tenders a year now require ISO/IEC 27001 or an equivalent] |
| Payback *(Example)* | During year 4 on full economic cost; late in year 3 on cash cost against cash benefits only |
| Main risk if rejected | [Exclusion from tenders and rising questionnaire workload] |

Certification is decided by the accredited certification body, not by
this project. The case therefore commits to building an effective ISMS
and to being ready for the audit, not to a guaranteed certificate.

## 2. Drivers and problem statement

<!-- Guidance: List drivers with evidence an outsider could check: tender clauses, lost-deal notes, contract schedules, regulator letters, insurer questionnaires. A driver without evidence is an opinion. Weight each driver so the recommendation can be tested. -->

### 2.1 Problem statement

[Describe in three to five sentences what is happening today. Example:
Our sales team answers about 150 security questionnaires a year, each
taking two to three days of engineering time. Two prospects in the
last year ended talks because we could not show an independent
certificate. Our cyber insurer asked for evidence of a managed security
programme at renewal. We have no single owner of information security
risk.]

### 2.2 Drivers

| ID | Driver | Evidence | Weight (1 to 5) | Option most affected |
|---|---|---|---|---|
| DRV-001 *(Example)* | Customer demand: enterprise and public-sector buyers ask for ISO/IEC 27001 certificates | [CRM notes, 6 lost or stalled deals, tender clause references] | 5 | C, D |
| DRV-002 *(Example)* | Tenders: public procurement and hospital framework agreements score certified suppliers higher or require certification | [Tender documents, scoring sheets] | 5 | C, D |
| DRV-003 *(Example)* | Regulation: customers in scope of NIS2 (Directive (EU) 2022/2555) or DORA (Regulation (EU) 2022/2554) push supply chain security duties to suppliers | [Customer contract schedules, supplier questionnaires] | 4 | B, C, D |
| DRV-004 *(Example)* | Privacy: customers ask for evidence of personal data protection as processor (GDPR Article 28 style clauses) | [Data processing agreements, privacy questionnaires] | 3 | D |
| DRV-005 *(Example)* | Risk reduction: ransomware, credential theft and supplier compromise are the top scenarios in our last incident review | [Incident log, gap assessment] | 4 | B, C, D |
| DRV-006 *(Example)* | Insurance: insurer asks for evidence of a security management programme and may adjust premium or cover | [Insurer renewal questionnaire] | 2 | C, D |
| DRV-007 *(Example)* | Efficiency: one certified framework reduces repeated questionnaires and customer audits | [Questionnaire log, hours spent] | 3 | B, C, D |

Laws are named here only as examples of where pressure comes from.
Determine which laws, regulations and contracts actually apply to you in
the legal register (`compliance/legal-register`), and take legal advice
where needed. This is a documentation format, not legal advice.

### 2.3 Why now

[State the trigger and the cost of delay. Example: the next hospital
framework tender opens in Q4 next year and requires a valid certificate
at bid submission. A 10-month project started this quarter is the
latest start that meets that date with a margin of two months.]

## 3. Current state and gap

<!-- Guidance: Summarise the gap assessment in a few lines; do not paste it. Decision makers need the size of the gap, not the control-by-control detail. -->

Summarise the result of the gap assessment
(`compliance/iso-27001-gap-assessment`, DOC-ISMS-098) and any recent
audit, penetration test or incident review.

| Area | Current state *(Example)* | Gap size |
|---|---|---|
| Clauses 4 to 10 (management system) | No defined scope, no risk method, no internal audit or management review | Large |
| Organizational controls (A.5) | Some policies exist, not approved or reviewed; supplier security informal | Medium |
| People controls (A.6) | Onboarding includes a confidentiality clause; no awareness programme | Medium |
| Physical controls (A.7) | Office access badges; no clear desk rule; colocation provider certified | Small |
| Technological controls (A.8) | Strong cloud engineering practice, MFA on main systems, logging partial, backups untested | Medium |
| Records | Few records kept in a form an auditor can sample | Large |

Overall readiness *(Example)*: about 35% of the expected management
system and control evidence exists today.

## 4. Options considered

<!-- Guidance: Always include "do nothing" as a real option with its own costs and risks. Describe each option so a reader understands what is delivered, not only what it costs. Compare like with like: the same 3-year horizon and the same scope. -->

| Option | What it delivers | What it does not deliver |
|---|---|---|
| A. Do nothing | Continue answering questionnaires case by case; fix issues as they arise | No independent assurance; no systematic risk management; tender exclusion continues |
| B. SOC 2 only | An independent service auditor's report on controls against the AICPA Trust Services Criteria (cited by name only), typically Type I then Type II | No certificate; recognition strongest in North America; scope set by the service description, not by a management system |
| C. ISO/IEC 27001 | A risk-based ISMS covering clauses 4 to 10 and the Annex A controls selected in the Statement of Applicability, audited by an accredited certification body (accredited by a signatory of the Global ACI MRA, formerly IAF MLA) on a three-year cycle | No dedicated privacy management system; personal data handled through general controls only |
| D. ISO/IEC 27001 plus ISO/IEC 27701 | Option C plus a privacy information management system (PIMS) under ISO/IEC 27701:2025, which can be certified alongside the ISMS | Higher effort; requires mature records of processing and privacy roles |

Notes on the options:

- ISO/IEC 27701:2025 is a stand-alone management system standard and
  can be certified without ISO/IEC 27001. Combining it with an ISMS
  reuses the same management system processes, which is why option D is
  modelled as an add-on to option C.
- Many organisations later add SOC 2 to an ISO/IEC 27001 programme, or
  the reverse. A crosswalk (`isms/control-framework-crosswalk`) shows
  how much evidence can be reused.
- Options B, C and D all require real controls and real records. None of
  them is a documentation exercise.

## 5. Costs

<!-- Guidance: Show the full economic cost (internal effort plus external spend) and the cash cost separately. Finance will ask for both. Pull the figures from the budget and resource plan; if you change one, change both. -->

### 5.1 Cost basis

Cost lines and assumptions come from the budget and resource plan
(`isms/isms-budget-resource-plan`, DOC-ISMS-031). The worked example is
Quillmere Health Systems (medium tier, 320 staff), using a loaded cost
of USD 140,000 per full-time equivalent (FTE) per year *(Example)*.

### 5.2 3-year cost per option (Quillmere Health Systems, *Example*)

| Cost element | A. Do nothing | B. SOC 2 only | C. ISO/IEC 27001 | D. 27001 plus 27701 |
|---|---|---|---|---|
| Internal effort (existing staff time at loaded cost, not new cash) | 0 | 1,120,000 | 1,330,000 | 1,540,000 |
| External services, tools, audits, remediation | 0 | 750,000 | 665,000 | 765,000 |
| Contingency (10% of external project lines) | 0 | 75,000 | 66,500 | 66,500 |
| **3-year total** | **0** | **1,945,000** | **2,061,500** | **2,371,500** |
| of which cash (excluding internal effort) | 0 | 825,000 | 731,500 | 831,500 |

How the figures are built *(Example)*:

- **Option B**: internal effort 3.0, 2.5 and 2.5 FTE (USD 420,000,
  350,000 and 350,000); external USD 750,000 (service auditor fees
  180,000, readiness consultant 70,000, tooling 90,000, penetration
  tests 135,000, training 45,000, remediation 230,000); contingency
  USD 75,000.
- **Option C**: taken line by line from DOC-ISMS-031, medium tier:
  internal 3.5, 3.0 and 3.0 FTE (USD 490,000, 420,000 and 420,000);
  external lines USD 665,000 (consultant 90,000, GRC tooling 90,000,
  training and staff certification 55,000, penetration tests 135,000,
  certification body fees 65,000, remediation 230,000); contingency USD
  66,500.
- **Option D**: option C plus a privacy add-on in years 2 and 3 of USD
  310,000: internal effort 1.0 and 0.5 FTE (USD 210,000), consultant
  USD 40,000, certification body extension fees USD 30,000, training
  USD 10,000, remediation USD 20,000. The add-on carries no extra
  contingency in this example.

> Replace the split above with your own figures. The rule to keep is
> that every total in this section equals the matching total in the
> budget and resource plan.

Internal effort is the time of people already on the payroll, valued at
loaded cost. It is an opportunity cost (work they do not do elsewhere),
not new spending, unless you hire or backfill; a new hire moves into
the cash lines. Finance approves the cash budget; line managers approve
the time. Show both, and never present the economic total as the cash
request.

### 5.3 Cost of option A (do nothing)

Doing nothing has no project cost but it is not free. Record the
expected cost of the status quo, for example:

| Status quo cost | Basis *(Example)* | Annual value *(Example)* |
|---|---|---|
| Questionnaire workload | 150 questionnaires x 18 hours x USD 85 | 229,500 |
| Lost or excluded opportunities | 4 tenders a year not bid | Not quantified in cash; see section 6 |
| Expected loss from security incidents | Annualised loss estimate from the risk register | Higher than options B to D |

## 6. Benefits

<!-- Guidance: Separate cash benefits from risk reduction and from strategic benefits. State when each benefit starts: most revenue benefits only begin after the certificate is issued. Mark every assumption and name who owns it (sales, finance, broker). -->

### 6.1 Benefit lines for option C (Quillmere Health Systems, *Example*)

| ID | Benefit | Assumption *(Example)* | Owner | Year 1 | Year 2 | Year 3 |
|---|---|---|---|---|---|---|
| BEN-001 *(Example)* | Tender revenue enabled (gross margin) | 4 tenders a year, average annual contract value USD 250,000, 40% win rate, 60% margin, so USD 240,000 margin added per year of wins; contracts won in year 2 continue in year 3 | [@head-of-sales] | 0 | 240,000 | 480,000 |
| BEN-002 *(Example)* | Questionnaire effort saved | 150 questionnaires x 12 hours saved x USD 85 from year 2, when the certificate and the answer library (`isms/security-questionnaire-answer-library`) exist | [@sales-engineering-lead] | 0 | 153,000 | 153,000 |
| BEN-003 *(Example)* | Insurance premium effect | 5% of a USD 300,000 premium from year 2, to be confirmed with the broker | [@cfo] | 0 | 15,000 | 15,000 |
| BEN-004 *(Example)* | Expected loss reduction | Annualised loss estimate falls by USD 300,000 once key controls operate; half in year 1 | [@isms-manager] | 150,000 | 300,000 | 300,000 |
| | **Total quantified benefits** | | | **150,000** | **708,000** | **948,000** |

3-year quantified benefits *(Example)*: USD 1,806,000.

### 6.2 Benefits not quantified

- Clear ownership of information security risk and a regular report to
  top management.
- Fewer customer audits on site, because customers accept the
  certificate and the Statement of Applicability instead.
- A management system that can absorb new requirements (privacy,
  AI under `compliance/iso-42001-statement-of-applicability`, sector
  regulation) without starting again.
- Better evidence when responding to regulators and customers after an
  incident.

## 7. Financial comparison

<!-- Guidance: Show cumulative net benefit per year and the payback point. If your finance team uses discounted cash flow, add a net present value row with the discount rate they set; do not invent one. -->

### 7.1 Option C cash flow (Quillmere Health Systems, *Example*)

| Year | Cost | Benefit | Net | Cumulative net |
|---|---|---|---|---|
| Year 1 | 869,500 | 150,000 | -719,500 | -719,500 |
| Year 2 | 596,000 | 708,000 | 112,000 | -607,500 |
| Year 3 | 596,000 | 948,000 | 352,000 | -255,500 |
| Year 4 (recertification year) | 607,000 | 948,000 | 341,000 | 85,500 |

Cost here is full economic cost (internal effort plus cash). Year 4
replaces the surveillance fee (USD 15,000) with a recertification fee
(USD 25,000), plus 10% contingency on the difference, so it is USD 11,000
higher than year 3. Year 4 benefits are held at the year 3 level, which
is conservative. Payback on full economic cost falls during year 4.

Strict cash view *(Example)*: BEN-002 is internal time freed and BEN-004
is a risk-adjusted expected value, so neither is cash. Comparing cash
cost (379,500, 176,000, 176,000) with cash benefits only (BEN-001 and
BEN-003: 0, 255,000, 495,000) gives a cumulative cash position of
-379,500, -300,500 and +18,500, so cash payback falls late in year 3.

### 7.2 Option scoring

Score each option against the weighted drivers in section 2.2 (0 = does
not address, 1 = partly, 2 = fully). Multiply by weight.

| Driver (weight) | A | B | C | D |
|---|---|---|---|---|
| DRV-001 Customer demand (5) | 0 | 1 | 2 | 2 |
| DRV-002 Tenders (5) | 0 | 1 | 2 | 2 |
| DRV-003 Regulation pressure (4) | 0 | 1 | 2 | 2 |
| DRV-004 Privacy (3) | 0 | 1 | 1 | 2 |
| DRV-005 Risk reduction (4) | 0 | 2 | 2 | 2 |
| DRV-006 Insurance (2) | 0 | 1 | 2 | 2 |
| DRV-007 Efficiency (3) | 0 | 1 | 2 | 2 |
| **Weighted score (max 52)** | **0** | **30** | **49** | **52** |

Option D scores highest but costs USD 310,000 more and depends on a
mature records of processing activity. Option C delivers 49 of 52
points now and keeps option D open for year 2.

## 8. Risks and dependencies

<!-- Guidance: Name the risks of the recommended option and of the alternatives. Use the library's 5 x 5 scale (likelihood x impact, score 1 to 25) so the figures can move into the project risk log in the charter. -->

| ID | Risk | Option | Likelihood | Impact | Score | Response |
|---|---|---|---|---|---|---|
| BCR-001 *(Example)* | Key staff not released from delivery work, project slips | C, D | 4 | 3 | 12 | Named allocations approved with the budget; sponsor reviews monthly |
| BCR-002 *(Example)* | Scope drawn too narrow, certificate not accepted by customers | C, D | 3 | 4 | 12 | Validate the scope statement with two key customers before Stage 1 |
| BCR-003 *(Example)* | Remediation (for example logging or backup testing) costs more than planned | B, C, D | 3 | 3 | 9 | 10% contingency; phase capital spend |
| BCR-004 *(Example)* | Tender deadline missed because Stage 2 is late | C, D | 2 | 5 | 10 | Plan a two-month margin; book the certification body early |
| BCR-005 *(Example)* | Exclusion from tenders continues and grows | A | 5 | 4 | 20 | Only addressed by options B to D |
| BCR-006 *(Example)* | Report not recognised by buyers outside North America | B | 3 | 3 | 9 | Combine with option C later |

Dependencies: [executive sponsor named; budget released by
YYYY-MM-DD; certification body selected
(`isms/certification-body-selection`); gap assessment complete].

## 9. Recommendation

<!-- Guidance: One clear recommendation with the conditions attached. If you recommend a phased approach, say what triggers each phase. -->

Recommend **option C** with these conditions:

1. Appoint [@coo] as sponsor and [@isms-manager] as full-time ISMS
   manager before the project starts.
2. Approve the year 1 cash budget of USD 379,500 *(Example)*, released
   in the tranches set in `isms/isms-budget-resource-plan`, and the
   named staff time of 3.5 FTE (USD 490,000 at loaded cost), for a year
   1 economic cost of USD 869,500.
3. Approve the project charter (`isms/isms-project-charter`,
   DOC-ISMS-009) and the roadmap (`isms/isms-implementation-roadmap`,
   DOC-ISMS-030) within four weeks.
4. Revisit option D (ISO/IEC 27701:2025) at the first management review
   after certification, using the privacy demand recorded in DRV-004.

## 10. Decision record

<!-- Guidance: Record the decision exactly as taken, with the conditions. This record, and the minutes it refers to, are what an auditor uses to test that top management committed resources to the ISMS. -->

| Field | Value |
|---|---|
| Decision ID | [DEC-ISMS-001] |
| Forum | [Executive committee / Board] |
| Date | YYYY-MM-DD |
| Option chosen | [C. ISO/IEC 27001] |
| Budget approved | [USD amount, years covered, tranche conditions] |
| Conditions | [Sponsor named, ISMS manager appointed, charter approved within 4 weeks] |
| Options rejected and reason | [A: tender exclusion; B: weaker recognition with key buyers; D: deferred to year 2] |
| Minutes reference | [Minutes number and item] |
| Communicated to | [Staff announcement date, sales team briefing] |
| Signed | [@ceo] |

## 11. Size tiers

<!-- Guidance: The size of the organisation changes the cost, the drivers and the options that make sense. Use the library's working tiers; they are not official definitions. -->

| Item | Small: Quillmere Analytics Ltd | Medium: Quillmere Health Systems | Large: Quillmere Group |
|---|---|---|---|
| Profile | B2B SaaS analytics, 46 staff (38 employees, 8 contractors), one office plus remote, one public cloud in two regions | Clinical scheduling software and managed service, 320 staff, two offices and one colocation suite | Manufacturing and services, 2,400 staff, 6 sites in 4 countries, OT and IT, already ISO 9001 and ISO 22301 certified |
| Main driver *(Example)* | Enterprise customers' procurement and questionnaires | Hospital tenders and processor obligations | Group customers, regulation pressure on OT and supply chain, integration with existing certificates |
| Typical options compared | B or C; many start-ups pick C for global recognition or B for US buyers | C, then D the year after | C as part of the integrated management system |
| Target *(Example)* | Certification in 6 months | ISO/IEC 27001 in 10 months, ISO/IEC 27701 the year after | Group certification in 15 months, phased by site |
| 3-year economic cost, option C *(Example)* | USD 537,600 = internal effort 300,000 (0.8, 0.6, 0.6 FTE) + cash 237,600 | USD 2,061,500 = internal effort 1,330,000 + cash 731,500 | USD 7,086,000 = internal effort 4,050,000 + cash 3,036,000 |
| Decision forum | Founders and CEO | Executive committee | Group board with site management input |
| Business case depth | 4 to 6 pages, costs and two options | Full template | Full template plus a site-by-site annex and integration savings |

Integration note for the large tier: an organisation already certified
to ISO 9001 and ISO 22301 reuses document control, internal audit,
management review and corrective action. Show those savings explicitly
(see `compliance/iso-map` and `isms/integrated-management-27013`).

## 12. Benefits realisation and follow-up

<!-- Guidance: A business case is tested later. Set the measures now so management review can compare plan with reality. -->

| Measure | Baseline *(Example)* | Target *(Example)* | Check at | Owner |
|---|---|---|---|---|
| Tenders bid that require ISO/IEC 27001 | 0 a year | 4 a year | First management review after certification | [@head-of-sales] |
| Average hours per security questionnaire | 18 | 6 | 6 months after certification | [@sales-engineering-lead] |
| Customer on-site security audits | 5 a year | 2 a year | Year 2 | [@isms-manager] |
| Project spend against approved budget | Plan | Within 10% | Each steering committee | [@cfo] |
| Stage 2 audit completed | Not started | By target date | Project closure | [@sponsor] |

Report realisation to management review (`compliance/management-review`)
and record improvements in the continual improvement register
(`isms/continual-improvement-register`).

## 13. Records and evidence

<!-- Guidance: List the records that show the decision was made and resourced. Keep them with the ISMS records so they are available at Stage 1. -->

| Record | Proves | Owner | Location | Retention *(Example)* |
|---|---|---|---|---|
| Approved business case (this document) | Basis for the decision | [@isms-manager] | [Document management system] | Life of the ISMS plus 3 years |
| Decision minutes (section 10) | Top management commitment and resources (clause 5.1) | [@company-secretary] | [Board portal] | As per corporate records policy |
| Approved budget (DOC-ISMS-031) | Resources provided (clause 7.1) | [@cfo] | [Finance system] | 7 years or as finance rules require |
| Benefits realisation reports | Follow-up and improvement | [@isms-manager] | [ISMS records library] | 3 years |

Map these records in the control evidence matrix
(`isms/control-evidence-matrix`) and the documented information register
(`isms/isms-documented-information-register`).

## 14. References

<!-- Guidance: Cite exact editions. Laws are examples of drivers only; confirm applicability in the legal register. -->

| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022, information security management systems requirements | 2022, with Amd 1:2024 (published 2024-02-23) | Clauses 5.1 and 7.1 (leadership and resources), certification basis. https://www.iso.org/standard/82875.html and https://www.iso.org/standard/88435.html |
| ISO/IEC 27002:2022, information security controls | 2022 | Control guidance used in remediation estimates. https://www.iso.org/standard/75652.html |
| ISO/IEC 27701:2025, privacy information management systems | 2025 | Option D. https://www.iso.org/standard/85819.html |
| ISO/IEC 27006-1:2024, requirements for ISMS certification bodies | 2024 | Audit time set by the certification body. https://www.iso.org/standard/82908.html |
| AICPA Trust Services Criteria | 2017, revised points of focus 2022 (cited by name only) | Option B |
| Directive (EU) 2022/2555 (NIS2) | Adopted 2022-12-14 | Example regulatory driver |
| Regulation (EU) 2022/2554 (DORA) | Adopted 2022-12-14, applies from 2025-01-17 | Example regulatory driver |

Related templates: `isms/isms-budget-resource-plan`,
`isms/isms-project-charter`, `isms/isms-implementation-roadmap`,
`compliance/iso-27001-gap-assessment`, `compliance/soc2-readiness-assessment`,
`isms/pims-27701-scope-roles`, `isms/certification-body-selection`.

## Standard and licence note

Structure aligned with ISO/IEC 27001:2022 including Amd 1:2024
(clauses 5.1 and 7.1) and common business case practice. The text,
options, figures and examples are original; no ISO/IEC text is
reproduced and the AICPA Trust Services Criteria are cited by name only.
You need the official standards for the requirements themselves:
https://www.iso.org/standard/82875.html. Check the current edition of
every standard and law before use. All figures are *Example* values,
not benchmarks, and certification decisions belong to the accredited
certification body. This is a documentation format, not legal or
financial advice. Template licence: MIT.