Topics in this domain
- Exam Technique: Thinking Like a Security Manager
- Security Governance vs Security Management
- Organisational Culture and Tone at the Top
- Ethics, Codes of Conduct and Accountability
- Integrating Security into Corporate Governance
- Legal, Regulatory and Contractual Requirements
- Due Diligence, Due Care and Legal Liability
- Privacy and Data Protection Governance
- Governance Roles, the CISO and Reporting Lines
- The Security Steering Committee
- The Three Lines Model and Independent Assurance
- Aligning Security Strategy with Business Objectives
- Developing a Security Strategy and Roadmap
- Gaining and Keeping Executive Commitment
- Governing AI and Emerging Technology
- Security Frameworks Compared: NIST CSF, ISO 27001 and COBIT
- Selecting and Implementing a Framework
- Governance Models: BMIS and the Security Balanced Scorecard
- Resource Planning and Security Budgets
- Building a Business Case for Security Investment
- Demonstrating Value and Return on Security Investment
Building a Business Case for Security Investment
Why business cases matter
Every security investment competes with other uses of the same money: a new product, more sales staff, a new warehouse. A business case puts security on the same footing as everything else, explaining in business terms why this spending is worth more than the alternatives. One of the CISM job tasks is to develop business cases to support investments in information security.
What goes in it
- The problem: the business risk or opportunity, and why it matters now. Link it to business objectives and the security strategy.
- Options: always including “do nothing”, each with the residual risk it leaves.
- Costs: total cost of ownership over the solution’s life, including people, integration, support and replacement.
- Benefits: risk reduced, compliance achieved, business enabled, efficiency gained.
- Recommendation: the preferred option, a delivery plan, an owner and the measures of success.
Options, not demands
Executives make better decisions, and feel more ownership of them, when they choose between real options:
| Option | 3-year cost | Residual risk |
|---|---|---|
| Do nothing | 0 | High: unmonitored privileged access; the audit finding stays open |
| Manual quarterly reviews | 180,000 (staff time) | Medium: gaps between reviews |
| Privileged access management (PAM) tool, phased | 420,000 | Low: vaulted, recorded admin access |
| PAM as a managed service | 390,000 | Low, with a supplier dependency |
If management chooses a cheaper option, or none, the security manager makes sure the remaining risk is formally accepted and recorded.
Benefits beyond money
- Risk reduction: lower likelihood or impact of specific scenarios, quantified where possible.
- Compliance: meets a regulation, contract or audit requirement.
- Business enablement: helps win customers, enter markets or move faster.
- Efficiency: automation saves staff time and reduces incidents to handle.
Financial measures such as return on investment, net present value and payback period are useful. But many security benefits are avoided losses, which are estimates, so be honest about the assumptions behind them.
After approval
Approval isn’t the end. Track delivery against the plan and budget, measure whether the promised benefits arrive, and report the results to the sponsor and the steering committee. A record of delivered benefits makes the next business case easier to approve.
Example. A bank approves MFA for all customers to cut account-takeover fraud. Twelve months later, the CISO reports fraud losses down 70%, against a forecast of 60%. The next business case is approved faster.
How the exam asks about it
| If the question asks… | The answer is usually… |
|---|---|
| Most important element of a security business case | The link to business objectives and risk |
| Should a business case include “do nothing”? | Yes, with its residual risk |
| Main purpose of a business case | Help management make an informed investment decision |
| Which costs to include | Total cost of ownership over the solution’s life |
| What happens after approval? | Track and report the benefits realised |
In short
- A business case justifies an investment in business terms: the problem, options, costs, benefits, risks and a recommendation.
- Always include a 'do nothing' option and the residual risk of each option, so executives can make an informed choice.
- Costs should be total cost of ownership over the solution's life; benefits include risk reduction, compliance and business enablement.
- Link the investment to business objectives and the security strategy, not to technology for its own sake.
- Financial measures (ROI, NPV, payback) help, but security benefits are often avoided losses, so be realistic about estimates.
- Approved cases are tracked afterwards to show the benefits were delivered.
Exam traps
- A business case built on fear rather than business impact rarely survives scrutiny.
- Leaving out running costs makes the case look cheap now and damages credibility later.
- The business case should be owned by a business sponsor where possible, not only by security.
- Approval isn't the end: benefits realisation should be measured.
Slides
Click the slide and use the arrow keys. F toggles full screen.
What goes in it