A security investment is funded like any other capital decision. This one-pager gives you the structure to defend a single spend — EDR, Zero Trust or PAM — to a skeptical CFO and board: the do-nothing baseline, the options (including a cheaper partial), the recommendation and why, the financials and ROSI, the consequence of inaction, and the ask. Dollar figures are illustrative — replace them with your own.
Educational template — not financial or legal advice. The figures are illustrative placeholders; apply your own quantified estimates and assumptions.
Free · no signup · adapt it in your own doc
Security Investment Business Case One-Pager
A board-ready one-pager that justifies a single security investment (e.g. EDR, Zero Trust, PAM) to a CFO and board on risk-reduction terms: what the risk costs today, the options, the recommendation, the financials and return, the do-nothing consequence, and the decision ask. All dollar figures are ILLUSTRATIVE placeholders — replace them with your own quantified estimates.
01Problem & current exposure (the do-nothing baseline)
State the specific risk this investment addresses and what it costs you to carry it today. The annualized loss expectancy below is the baseline every later number is measured against — it is the cost of doing nothing.
Investment under consideration
e.g. Endpoint Detection & Response across all endpoints
Risk addressed
The named risk, e.g. endpoint intrusion leading to ransomware/data theft
Risk appetite / tolerance
The board’s stated tolerance for this risk — and whether it is currently exceeded
Likelihood (per year)
Estimated annual probability, e.g. 20% — mark as an estimate
ILLUSTRATIVE $ = likelihood × impact — the do-nothing baseline
Anchor on the do-nothing baseline, not on fear. "We have never been breached" is not a measurement of current risk — state today’s exposure and what has changed to raise it. Round honestly and show a range; avoid vanity precision.
02Options considered
Give the board a real choice: the do-nothing baseline, at least one cheaper partial-coverage option (and the residual risk it leaves), and the recommended option. All dollars illustrative.
Option
Cost (illustrative)
Risk reduced
Residual risk
Do nothing (baseline)
$0
None
Full current ALE remains
Option A — partial / lower-cost
$ one-time + $ annual
% of ALE removed
ILLUSTRATIVE $ residual ALE
Option B — recommended (full)
$ one-time + $ annual
% of ALE removed
ILLUSTRATIVE $ residual ALE
Option C — premium / phased max
$ one-time + $ annual
% of ALE removed
ILLUSTRATIVE $ residual ALE
No control takes risk to zero. Naming the residual risk for each option is what makes the reduction credible.
03Recommended option & rationale
Recommendation
Which option, in one line
Why it is the right level
How it brings the named risk back within the board’s appetite
Why this vendor
The weighted selection criteria it won on — fit to our risk, integration, run-cost, support, exit/portability — NOT an analyst badge or a logo
Why now
What has measurably changed to raise exposure now, or a real insurance/contract deadline — not manufactured urgency
Justify the vendor with the criteria you scored candidates against, not a market-leader badge. Justify the timing with what has changed and the cost of carrying the risk another year, not with an expiring discount.
04Financials & return (ILLUSTRATIVE)
Present total cost of ownership and the return as ROSI. ROSI = (monetary risk reduction − cost) ÷ cost, where risk reduction = baseline ALE × mitigation effectiveness. Every figure here is an illustrative placeholder — substitute your own estimates and show a range.
Line
Year 1
Annual (ongoing)
One-time / capital (capex)
$
—
Licensing / subscription (opex)
$
$
Run-cost (staff time to operate & tune)
$
$
Total cost of ownership
$
$
Risk reduction (ALE × effectiveness)
ILLUSTRATIVE $
ILLUSTRATIVE $
Payback period
months
—
ROSI = (risk reduction − cost) ÷ cost
ILLUSTRATIVE %
ILLUSTRATIVE %
Separate capex from recurring opex and always include the human run-cost — a tool nobody has time to operate delivers none of the risk reduction you promised. Round the ROSI (e.g. "~250%") rather than quoting false decimals.
05What happens if we don’t
Make the cost of inaction concrete and specific to this risk, without resorting to fear.
We continue to carry the full current annualized loss expectancy — one more year of baseline exposure, quantified above.
Any insurance condition or customer-contract requirement left unmet, and the concrete consequence — lost coverage, breached contract
The named risk remains above the board’s stated appetite, i.e. we knowingly accept a risk we already judged too high
How likelihood or attack surface is trending — why the baseline is more likely to grow than shrink
Frame inaction as accepting a measured, above-appetite risk for another year — a decision the board can own — not as impending catastrophe.
06The decision ask
The ask
Approve Option B at $X capex + $Y/year opex, phased
Phasing
Phase 1 on the highest-risk assets; later phases gated on a success metric
Success metrics we will report
e.g. mean time to detect/respond, % endpoints covered, movement of the risk on the register
Decision required by
Date, tied to the "why now" driver above
Name the handful of outcome metrics you will report post-investment before approval — it makes the spend accountable and builds the track record for your next ask. Never promise "no breaches."
Practice the decision
This one-pager records a pitch you can rehearse. The free Business Case / ROI Pitch Lab puts you in front of a CFO-led board and grades you on the exact decisions this template documents — how to frame risk reduction, show the baseline, calculate ROSI, phase the spend, and answer “why now, why this vendor”.
TL;DR
What this template is
A one-page, board-ready template to justify a single security investment (EDR / Zero Trust / PAM) to a CFO and board on risk-reduction terms.
Sections: problem & current exposure (the do-nothing baseline / ALE), options considered, recommended option & rationale, financials & return (ROSI), what happens if we don’t, and the decision ask.
All dollar figures are illustrative placeholders — replace them with your own quantified estimates and show a range rather than false precision.
Copy it or download it as Markdown and adapt it in your own document — nothing is uploaded.
Practise the underlying decisions in the free Business Case / ROI Pitch Lab.
Educational template — not financial or legal advice.
Frequently asked questions
What is this template for?+
It is a one-pager a security leader can use to justify a single security investment — such as EDR, Zero Trust or PAM — to a CFO and board. It records the risk being addressed, the do-nothing baseline (current annualized loss expectancy), the options considered, the recommended option and why, the financials and return (ROSI), the consequence of inaction, and the decision ask.
How do I calculate ROSI for the financials section?+
ROSI (return on security investment) is (monetary risk reduction − cost of the control) ÷ cost of the control. Risk reduction is your baseline annualized loss expectancy (likelihood × impact) multiplied by the control’s mitigation effectiveness. Because the inputs are estimates, round the result and present a range rather than quoting precise decimals.
Why does the template say the dollar figures are illustrative?+
Every quantitative input — likelihood, impact, effectiveness, cost — depends on your own environment and estimates. The placeholders exist to show the shape of a defensible case, not to supply numbers. Replace them with your own figures, state your assumptions, and show a range; false precision undermines the case in front of a CFO.
Is this financial or legal advice?+
No. It is an educational template. The business-case and risk-quantification techniques are summarised for orientation; apply them to your specific figures, risk appetite and circumstances, and confirm financial, insurance and regulatory specifics with qualified advisers.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout