ISMS Budget and Resource Plan Template (ISO/IEC 27001)
Cost lines (effort, consultant, tooling, training, pentest, certification fees, remediation), 3-year budgets per tier, FTE by role, funding tranches
Cách dùng: Use it with the business case so both show the same totals. Fill the assumptions (loaded FTE cost, contingency) and certification body quotes first, then the worked budget for your tier and the named time allocations. The main pitfall is budgeting only external spend and forgetting the recurring costs of years 2 and 3.
Xem trước
ISMS Budget and Resource Plan: [Organization name]
Budget and resource plan for establishing, certifying and running an information security management system (ISMS) under ISO/IEC 27001:2022 including Amendment 1:2024. It covers every cost line (internal effort, optional consultant, tooling, training and staff certification, penetration testing, certification body fees for the initial audit, surveillance years and recertification, and remediation), a 3-year view per size tier, a resource plan by role and the funding approval. It supports clause 7.1 (an ISMS with no people, time or money behind it is only paper) and clause 5.1 (leadership has to back the ISMS with real funding), and it gives clause 6.2 planning its "what resources" answer. Replace every
[bracketed]value and every row marked Example. All money figures are Example values in USD: use your local currency and real quotes.
Document control
| Field | Value |
|---|---|
| Document ID | DOC-ISMS-031 |
| Version | [1.0] |
| Status | [Draft / In review / Approved / Superseded] |
| Owner | [@isms-manager] |
| Approvers/reviewers | [@cfo], [@sponsor], [@ceo] |
| Last updated | YYYY-MM-DD |
| Classification | [Confidential] |
| Standard and edition | ISO/IEC 27001:2022 + Amd 1:2024 |
| Size tier used | [Small / Medium / Large or multi-site] |
| Budget period | [FY YYYY to FY YYYY, 3 years] |
| Currency and price basis | [USD / local currency], [prices as of YYYY-MM-DD, excluding / including tax] |
| Business case reference | DOC-ISMS-029 |
| Charter reference | DOC-ISMS-009 |
| Next scheduled review | YYYY-MM-DD [annual budget cycle and each phase gate] |
Approvals
| Role | Name | Decision | Date |
|---|---|---|---|
| ISMS manager | [@isms-manager] | [Prepared] | YYYY-MM-DD |
| Finance | [@cfo] | [Reviewed and funded] | YYYY-MM-DD |
| Sponsor | [@sponsor] | [Approved] | YYYY-MM-DD |
| Top management | [@ceo] | [Approved] | YYYY-MM-DD |
Revision history
| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 (Example) | YYYY-MM-DD | [@isms-manager] | Baseline approved with the business case |
| 1.1 (Example) | YYYY-MM-DD | [@isms-manager] | PCR-001: GRC tool deferred, year 1 tooling reduced |
| 2.0 (Example) | YYYY-MM-DD | [@isms-manager] | Year 2 run budget confirmed at management review |
Contents
- Purpose and scope
- Assumptions
- Cost lines
- Worked budgets by tier
- 3-year view and recertification
- Resource plan by role
- Funding approval and release
- Budget monitoring and change
- Size tiers
- Records and evidence
- References
1. Purpose and scope
This plan sets out the money and people needed to establish the ISMS, complete the initial certification audit and run the ISMS through the first certification cycle. It covers the ISMS scope in DOC-ISMS-002.
| Included | Excluded |
|---|---|
| Internal effort of named roles on ISMS work | Business-as-usual operations already funded (for example existing endpoint protection licences) |
| External advice, tooling, training, testing and audits | Product development not driven by a risk treatment action |
| Remediation capital and one-off spend driven by the risk treatment plan | Spend for other management systems, except shared costs stated in section 9 |
| Contingency on external project lines | Tax treatment and depreciation (finance applies its own rules) |
2. Assumptions
| ID | Assumption | Small | Medium | Large |
|---|---|---|---|---|
| BA-001 (Example) | Loaded cost per FTE per year (salary, benefits, overhead) | USD 150,000 | USD 140,000 | USD 135,000 |
| BA-002 (Example) | Contingency on external project lines (not on internal effort) | 10% | 10% | 10% |
| BA-003 (Example) | Certification body fees are based on written quotes; audit time is set by the certification body under ISO/IEC 27006-1:2024 | 2 quotes | 3 quotes | 3 quotes, integrated audit option |
| BA-004 (Example) | Penetration test once a year, scope set by the risk assessment | Web application and cloud | Platform, colocation network, external perimeter | IT and OT, all 6 sites over the cycle |
| BA-005 (Example) | Existing security tooling continues to be funded from operations | Yes | Yes | Yes |
| BA-006 (Example) | Year 1 starts at project kick-off, not at the start of a financial year | Yes | Yes | Yes |
The small tier uses a higher loaded cost because its ISMS effort falls mostly on senior engineering staff; the medium and large tiers spread it across a wider mix of roles. Replace all three with your finance team's figures.
Audit time and any audit-day figure in this plan are Example values. The certification body determines audit time from the number of persons doing work under the organization's control and complexity factors, so ask for its calculation in the quote.
3. Cost lines
| Code | Cost line | What it covers | Nature |
|---|---|---|---|
| CL-01 | Internal effort | Time of the ISMS manager, project manager, security team, control owners and internal auditor on ISMS work, in FTE x loaded cost | Recurring, higher in year 1 |
| CL-02 | Consultant (optional) | Gap assessment support, coaching, template review, pre-audit check, external internal auditor where no independent staff exist | Mostly year 1 |
| CL-03 | Tooling | GRC or ISMS platform, or the incremental cost of using existing tools (ticketing, wiki) for registers and evidence | Recurring subscription |
| CL-04 | Training and staff certification | Awareness platform, role training (risk, internal audit, secure development), professional certifications such as ISO/IEC 27001 lead implementer or lead auditor courses | Recurring |
| CL-05 | Penetration testing | Independent technical testing of in-scope systems; retests after fixes | Recurring, usually annual |
| CL-06 | Certification body fees | Stage 1 and Stage 2 in year 1, surveillance audits in years 2 and 3, recertification before expiry; auditor travel where on site | Recurring by cycle |
| CL-07 | Remediation capex and one-off spend | Controls the treatment plan requires that do not exist yet: logging and monitoring, backup immutability, device management, network segmentation, physical access | Mostly year 1 |
| CL-08 | Contingency | 10% of CL-02 to CL-07 (Example) | Each year |
Cash cost is CL-02 to CL-08. Full economic cost adds CL-01.
CL-01 is the time of people already on the payroll, valued at loaded cost: an opportunity cost, not new spending. If you hire or backfill a role for the ISMS, move that cost into a cash line so it is not counted twice. Finance approves the cash budget; line managers approve the time (section 6). Never present the economic total as the cash request.
4. Worked budgets by tier
4.1 Small: Quillmere Analytics Ltd
46 staff (38 employees, 8 contractors), one office plus remote staff, production on one public cloud provider in two regions. Part-time ISMS manager (0.5 FTE, the Head of Engineering Operations). Target: certification in 6 months.
| Code | Cost line | Year 1 | Year 2 | Year 3 | 3-year total |
|---|---|---|---|---|---|
| CL-01 | Internal effort (0.8, 0.6, 0.6 FTE x 150,000) | 120,000 | 90,000 | 90,000 | 300,000 |
| CL-02 | Consultant, including external internal auditor | 25,000 | 5,000 | 5,000 | 35,000 |
| CL-03 | Tooling (lightweight GRC platform) | 12,000 | 12,000 | 12,000 | 36,000 |
| CL-04 | Training and staff certification | 7,000 | 4,000 | 4,000 | 15,000 |
| CL-05 | Penetration testing | 18,000 | 18,000 | 18,000 | 54,000 |
| CL-06 | Certification body fees (initial, surveillance 1, surveillance 2) | 16,000 | 7,000 | 7,000 | 30,000 |
| CL-07 | Remediation (device management, logging, backup immutability) | 30,000 | 8,000 | 8,000 | 46,000 |
| CL-08 | Contingency (10% of CL-02 to CL-07) | 10,800 | 5,400 | 5,400 | 21,600 |
| Total economic cost | 238,800 | 149,400 | 149,400 | 537,600 | |
| of which cash (CL-02 to CL-08) | 118,800 | 59,400 | 59,400 | 237,600 |
For Quillmere Analytics the money actually spent is USD 118,800 in year 1 and USD 59,400 in each later year (Example). The USD 300,000 of internal effort is mostly the ISMS manager's 0.5 FTE, which already sits in the Head of Engineering Operations' salary, plus control owners' time. Year 1 is a 6-month build followed by about 6 months of operation, so the year 1 FTE covers both.
4.2 Medium: Quillmere Health Systems
320 staff, two offices and one colocation suite. Full-time ISMS manager plus a 3-person security team. Target: ISO/IEC 27001 in 10 months, ISO/IEC 27701 the year after (the privacy add-on is costed separately in the business case, option D).
| Code | Cost line | Year 1 | Year 2 | Year 3 | 3-year total |
|---|---|---|---|---|---|
| CL-01 | Internal effort (3.5, 3.0, 3.0 FTE x 140,000) | 490,000 | 420,000 | 420,000 | 1,330,000 |
| CL-02 | Consultant | 60,000 | 15,000 | 15,000 | 90,000 |
| CL-03 | Tooling (GRC platform) | 30,000 | 30,000 | 30,000 | 90,000 |
| CL-04 | Training and staff certification | 25,000 | 15,000 | 15,000 | 55,000 |
| CL-05 | Penetration testing | 45,000 | 45,000 | 45,000 | 135,000 |
| CL-06 | Certification body fees (initial, surveillance 1, surveillance 2) | 35,000 | 15,000 | 15,000 | 65,000 |
| CL-07 | Remediation (SIEM onboarding, colocation access control, network segmentation) | 150,000 | 40,000 | 40,000 | 230,000 |
| CL-08 | Contingency (10% of CL-02 to CL-07) | 34,500 | 16,000 | 16,000 | 66,500 |
| Total economic cost | 869,500 | 596,000 | 596,000 | 2,061,500 | |
| of which cash (CL-02 to CL-08) | 379,500 | 176,000 | 176,000 | 731,500 |
4.3 Large or multi-site: Quillmere Group
2,400 staff, 6 sites in 4 countries (HQ, 3 plants, 1 service centre, 1 data centre), OT and IT, already certified to ISO 9001 and ISO 22301. CISO with a 14-person security office. Target: ISO/IEC 27001 for the group in 15 months, phased by site.
| Code | Cost line | Year 1 | Year 2 | Year 3 | 3-year total |
|---|---|---|---|---|---|
| CL-01 | Internal effort (12.0, 9.0, 9.0 FTE x 135,000) | 1,620,000 | 1,215,000 | 1,215,000 | 4,050,000 |
| CL-02 | Consultant (OT security and programme support) | 180,000 | 40,000 | 40,000 | 260,000 |
| CL-03 | Tooling (enterprise GRC, integrated with the existing management system) | 90,000 | 90,000 | 90,000 | 270,000 |
| CL-04 | Training and staff certification | 80,000 | 50,000 | 50,000 | 180,000 |
| CL-05 | Penetration testing, including OT assessments | 160,000 | 140,000 | 140,000 | 440,000 |
| CL-06 | Certification body fees (initial multi-site, surveillance 1, surveillance 2) | 110,000 | 50,000 | 50,000 | 210,000 |
| CL-07 | Remediation (OT segmentation, site physical controls, monitoring) | 900,000 | 250,000 | 250,000 | 1,400,000 |
| CL-08 | Contingency (10% of CL-02 to CL-07) | 152,000 | 62,000 | 62,000 | 276,000 |
| Total economic cost | 3,292,000 | 1,897,000 | 1,897,000 | 7,086,000 | |
| of which cash (CL-02 to CL-08) | 1,672,000 | 682,000 | 682,000 | 3,036,000 |
The 15-month programme spans parts of two budget years. To keep the three tiers comparable, year 1 above carries the whole build effort and the initial certification fee, although Stage 1 and Stage 2 fall in months 14 and 15 of the programme (Example). If your finance team budgets by financial year, move the Stage 2 fee and the matching effort into the year in which the audit happens, and shift the surveillance years with it.
5. 3-year view and recertification
5.1 Summary by tier (Example, USD)
| Tier | Year 1 | Year 2 | Year 3 | 3-year economic cost | 3-year cash cost |
|---|---|---|---|---|---|
| Small: Quillmere Analytics Ltd | 238,800 | 149,400 | 149,400 | 537,600 | 237,600 |
| Medium: Quillmere Health Systems | 869,500 | 596,000 | 596,000 | 2,061,500 | 731,500 |
| Large: Quillmere Group | 3,292,000 | 1,897,000 | 1,897,000 | 7,086,000 | 3,036,000 |
5.2 Certification body fees across the cycle (Example, USD)
| Audit | Timing | Small | Medium | Large |
|---|---|---|---|---|
| Initial certification (Stage 1 and Stage 2) | Year 1 | 16,000 | 35,000 | 110,000 |
| Surveillance 1 | No later than 12 months from the certification decision | 7,000 | 15,000 | 50,000 |
| Surveillance 2 | Following calendar year | 7,000 | 15,000 | 50,000 |
| Recertification (memo, outside the 3-year total) | Planned and completed before the certificate expires, usually in year 4 of spend | 11,000 | 25,000 | 80,000 |
Surveillance audits take place at least once each calendar year, except
in recertification years. A scope extension, a new site or a transfer
between certification bodies changes these figures; plan them in
isms/scope-extension-multisite-plan and isms/certification-cycle-plan.
5.3 Cost profile
Typical pattern (Example): year 1 is 40% to 50% of the 3-year total across the three worked tiers (small 238,800 of 537,600 is 44%; medium 869,500 of 2,061,500 is 42%; large 3,292,000 of 7,086,000 is 46%).
6. Resource plan by role
6.1 FTE by role and year (Example)
| Role | Small Y1 | Small Y2 and Y3 | Medium Y1 | Medium Y2 and Y3 | Large Y1 | Large Y2 and Y3 |
|---|---|---|---|---|---|---|
| ISMS manager or ISMS core team | 0.5 | 0.5 | 1.0 | 1.0 | 4.0 | 3.5 |
| Project manager | 0 (ISMS manager runs it) | 0 | 0.5 | 0 | Included in core team | Included in core team |
| Security team share | 0 | 0 | 1.2 | 1.3 | Included in core team | Included in core team |
| Site coordinators (6 sites) | Not applicable | Not applicable | Not applicable | Not applicable | 3.0 (6 x 0.5) | 1.5 (6 x 0.25) |
| Control owners (IT, HR, facilities, engineering, legal) | 0.3 | 0.1 | 0.6 | 0.5 | 3.5 | 2.5 |
| Internal auditor | 0 (external, in CL-02) | 0 | 0.2 | 0.2 | 1.0 | 1.0 |
| OT security lead | Not applicable | Not applicable | Not applicable | Not applicable | 0.5 | 0.5 |
| Total FTE (CL-01) | 0.8 | 0.6 | 3.5 | 3.0 | 12.0 | 9.0 |
Top management time (policy approval, management review, risk
acceptance) and all-staff time for awareness training (for example 46
staff x 2 hours a year in the small tier) are not costed here; they are
absorbed in normal operations but are a real commitment. Schedule them
in the annual calendar (isms/isms-annual-calendar).
6.2 Named allocations
| Person | Role | Allocation | Period | Line manager agreement |
|---|---|---|---|---|
| [@isms-manager] (Example) | ISMS manager | 100% | Year 1 to year 3 | [@coo], YYYY-MM-DD |
| [@isms-project-manager] (Example) | Project manager | 50% | Kick-off to project closure | [@pmo-lead], YYYY-MM-DD |
| [@security-engineer-1] (Example) | Security team, risk and monitoring | 40% | Year 1 | [@security-lead], YYYY-MM-DD |
| [@it-lead] (Example) | Control owner, IT operations | 20% | Year 1 | [@cto], YYYY-MM-DD |
| [@hr-lead] (Example) | Control owner, people controls | 10% | Year 1 | [@chro], YYYY-MM-DD |
| [@internal-auditor] (Example) | Internal auditor | 20% | Phase 7 onward | [@cfo], YYYY-MM-DD |
6.3 Capacity risks
- If the ISMS manager also has an operational role (common in small organisations), protect fixed days each week for ISMS work.
- Backfill delivery roles before releasing control owners; otherwise delivery work always wins.
- Plan a deputy for the ISMS manager to avoid a single point of failure.
7. Funding approval and release
7.1 Year 1 tranches for the medium tier (Example, USD)
| Tranche | Released at | Lines covered | Amount |
|---|---|---|---|
| T1 | Charter approval (phase 0 gate) | Consultant 30,000; tooling 30,000; training 10,000 | 70,000 |
| T2 | Risk assessment, SoA and treatment plan approved (phase 3 gate) | Remediation 150,000; penetration test 45,000; training 15,000; consultant 20,000 | 230,000 |
| T3 | Management review held (phase 8 gate) | Certification body fees 35,000; consultant pre-audit check 10,000 | 45,000 |
| Contingency | On sponsor approval, logged as a change | Any CL-02 to CL-07 line | 34,500 |
| Year 1 cash total | 379,500 |
7.2 Approval flow
Finance checks the plan against the business case before the sponsor recommends it; money is then released tranche by tranche.
7.3 Funding decision record
| Field | Value |
|---|---|
| Decision ID | [DEC-ISMS-002] |
| Approved amount | [Year 1 USD amount; years 2 and 3 indicative, confirmed in the annual budget cycle] |
| Approved by and date | [@ceo / Board], YYYY-MM-DD |
| Conditions | [Tranches as in 7.1; contingency drawn only with sponsor approval] |
| Cost centre | [Cost centre code] |
8. Budget monitoring and change
| Month (Example) | Planned cumulative cash | Actual cumulative cash | Variance | Comment |
|---|---|---|---|---|
| Month 3 | 70,000 | 64,000 | -6,000 | Tooling discount |
| Month 6 | 250,000 | 270,000 | +20,000 | Segmentation work brought forward |
| Month 10 | 379,500 | 372,000 | -7,500 | Contingency partly unused |
Rules:
- Report variance above 10% of a year budget to the sponsor within one week.
- Reallocation between lines follows the tolerances in the charter
(
isms/isms-project-charter, section 11). - From year 2, present the actual spend and the next year's request at
management review (
compliance/management-review), so that resource decisions appear in its outputs.
9. Size tiers
| Aspect | Small: Quillmere Analytics Ltd | Medium: Quillmere Health Systems | Large: Quillmere Group |
|---|---|---|---|
| Biggest cost line | Internal effort, then remediation | Internal effort, then remediation | Internal effort, then OT and site remediation |
| Tooling approach | Lightweight GRC platform or existing wiki and ticketing | GRC platform | Enterprise GRC shared with ISO 9001 and ISO 22301 |
| Consultant use | Coaching and external internal audit | Targeted support and pre-audit check | OT expertise and programme support |
| Certification body fees | Single site plus remote; small audit team | Two offices plus colocation | Multi-site sampling under ISO/IEC 27006-1:2024 and IAF MD 1:2023 (now re-issued by Global ACI as Global ACI-TECH-3-001; check the current issue); integrated audit with existing certificates may reduce total audit time |
| Shared costs | None | Shared with privacy programme in year 2 | Document control, internal audit, management review and corrective action shared with the integrated management system; show the saving (see isms/integrated-management-27013) |
| Approval | CEO | Executive committee | Group board, with site budgets |
10. Records and evidence
| Record | Proves | Owner | Location | Retention (Example) |
|---|---|---|---|---|
| Approved budget and resource plan (this document) | Resources determined | [@isms-manager] | [Document management system] | Life of the ISMS plus 3 years |
| Funding decision record (section 7.3) | Resources provided by top management | [@cfo] | [Board portal / finance system] | As corporate records policy requires |
| Named allocations with line manager agreement (section 6.2) | People made available | [@isms-manager] | [HR or project system] | 3 years |
| Monthly spend reports (section 8) | Budget controlled | [@finance-business-partner] | [Finance system] | As finance rules require |
| Certification body quotes and contract | Basis for CL-06 | [@procurement-lead] | [Contract repository] | Contract term plus 6 years (Example) |
Map these records in the control evidence matrix
(isms/control-evidence-matrix) and list the plan in the documented
information register (isms/isms-documented-information-register).
11. References
| Reference | Edition | Use |
|---|---|---|
| ISO/IEC 27001:2022, information security management systems requirements | 2022, with Amd 1:2024 (published 2024-02-23) | Clauses 5.1, 6.2 and 7.1. https://www.iso.org/standard/82875.html, https://www.iso.org/standard/88435.html |
| ISO/IEC 27006-1:2024, requirements for ISMS certification bodies | 2024 | How audit time is determined. https://www.iso.org/standard/82908.html |
| ISO/IEC 17021-1:2015, requirements for certification bodies | 2015 | Certification cycle, surveillance and recertification. https://www.iso.org/standard/61651.html |
| ISO/IEC 27003:2017, ISMS guidance | 2017 (a revision is in progress; check for a newer edition) | Resource planning guidance. https://www.iso.org/standard/63417.html |
| IAF MD 1:2023, audit and certification of a multi-site management system, now re-issued by Global ACI as Global ACI-TECH-3-001 | IAF MD 1 issue 3 (2023). Global Accreditation Cooperation Incorporated (Global ACI) replaced IAF and ILAC on 2026-01-01; Global ACI-TECH-3-001 v1.0 issued 2026-07-10, in force 2026-08-28: check the current issue | Multi-site sampling (large tier); accredited certification under the Global ACI MRA (formerly IAF MLA) |
Related templates: isms/isms-business-case, isms/isms-project-charter,
isms/isms-implementation-roadmap, isms/isms-roles-raci,
isms/isms-competence-training-matrix, isms/certification-body-selection,
isms/certification-cycle-plan.
Standard and licence note
Structure aligned with ISO/IEC 27001:2022 including Amd 1:2024 (clauses 5.1, 6.2 and 7.1) and the certification cycle in ISO/IEC 17021-1:2015 and ISO/IEC 27006-1:2024. The cost lines, figures, tables and examples are original; no ISO/IEC text is reproduced. You need the official standards for the requirements themselves: https://www.iso.org/standard/82875.html. Check the current edition of every standard and accreditation document before use. All figures are Example values, not benchmarks or quotes, and certification decisions belong to the accredited certification body. This is a documentation format, not financial advice. Template licence: MIT.
Template liên quan
Certification Cycle Plan Template (ISO/IEC 27001 3-year cycle)
3-year certificate cycle, timing rules, Gantt timeline, audit coverage, change notifications, suspension and withdrawal, recertification, transfers, budget
ISMS và ISO/IEC 27001Certification Findings Action Plan Template (ISO/IEC 27001)
CB audit findings log, correction, extent check, root cause, corrective action, CB deadlines, submission log, verification and closure
ISMS và ISO/IEC 27001Cloud Exit Plan Template (ISO/IEC 27001 A.5.23, ISO/IEC 27036-4)
Exit triggers, lock-in and data inventory, formats, strategy options, alternative providers, timeline, contract exit terms, runbook, exit tests, DORA, Data Act