Return on Security Investment for ISO 27001 Decisions

Return on security investment is an estimate of the loss a security measure may avoid compared with what the measure costs. It can improve budget decisions, but it cannot prove exactly how much money an incident that never occurs would have cost.

For an ISO 27001 programme, the most useful result is not a dramatic percentage. It is a transparent decision record that connects risk, treatment, cost, uncertainty, residual risk and later evidence of control performance.

Direct answer: ROSI can be estimated, not known precisely. Calculate expected loss before and after a proposed control, subtract the control’s full cost, and divide by that cost if a percentage is useful. Present ranges and sensitivity because event frequency and control effectiveness are uncertain.

Understand what ROSI measures

A common structure is:

ROSI = (expected loss avoided − control cost) ÷ control cost

If a control reduces estimated annual loss from $500,000 to $300,000 and costs $125,000 over the same period, estimated loss avoided is $200,000. The resulting ROSI is 60%: ($200,000 − $125,000) ÷ $125,000.

This does not mean the organisation will earn $75,000. It means the assumptions imply expected avoided loss exceeds cost by that amount over the stated horizon. Real outcomes may differ because the incident may not occur, may be more severe than modelled or may not be reduced as expected.

ENISA’s introduction to ROSI notes the underlying difficulty: security commonly prevents loss rather than generating direct profit, and effectiveness and incident cost are hard to estimate.

Do not use ROSI for every decision

ROSI is most useful when management is comparing discretionary treatments for a bounded risk. It is less useful when:

• a law or binding contract requires a control outcome;
• safety or catastrophic exposure makes average loss misleading;
• evidence is too weak even for defensible ranges;
• options have materially different non-financial consequences; or
• the decision is small enough that modelling costs more than it informs.

A negative ROSI does not automatically justify rejecting a control. The control may satisfy an obligation, protect trust, reduce tail risk or enable a strategic service. Conversely, a positive estimate does not prove feasibility or operating effectiveness.

ISO/IEC 27001 requires risk-based treatment and retained results; it does not require a ROSI calculation. Use the method as decision support, not as invented certification criteria.

Define the risk scenario and horizon

State exactly what is being modelled. Include event, affected service or information, cause, consequence, scope and time period.

For example:

During the next three years, compromised administrator credentials enable unauthorised extraction of customer data from the production analytics environment.

Choose a horizon that matches cost and benefit. A three-year software commitment should not be compared with one year of avoided loss without adjustment. If implementation takes six months, do not count a full year of benefit immediately.

Link the scenario to the risk register, owner and treatment plan. The inherent and residual risk guide explains why the remaining exposure must be assessed rather than assumed away.

Estimate loss components

Break consequence into components to reduce omissions and double counting:

• service interruption and lost transactions;
• investigation, containment and restoration labour;
• specialist, legal and notification costs;
• contractual credits or compensation;
• replacement equipment or services;
• regulatory consequence where legally supportable;
• customer support and communications;
• fraud or data reconstruction; and
• longer-term commercial effects, clearly separated from direct cost.

Use internal finance, incident, recovery and contract data where possible. Show low, central and high estimates with sources and dates. Reputation effects may be material, but avoid inserting an unsupported headline value simply to improve the case.

Estimate event frequency

Frequency is often the weakest input. Use internal event history, relevant industry data, threat exposure, control test results and expert judgement. Account for changes in scope and detection: zero recorded events may reflect poor visibility rather than low frequency.

Express the estimate as a range. “Between 5% and 20% per year” exposes uncertainty better than “12.4%.” For rare events, consider multi-year probability and severe-but-plausible loss alongside annual expected loss.

The risk quantification investment guide provides a deeper method for building scenarios and comparing portfolios.

Estimate control effectiveness

Control effectiveness is the expected reduction in event frequency, loss magnitude or both. Document the mechanism.

For strong authentication, the effect may be a lower chance that stolen credentials produce access. For tested isolated recovery copies, the main effect may be reduced outage duration and restoration cost. For training, the effect may depend on role, completion, behaviour and reporting speed.

Use evidence such as pilot results, comparable internal controls, independent tests, supplier performance or credible studies. Vendor claims should not be treated as the organisation’s realised result.

Model effectiveness as a range and include adoption. A technically capable control deployed to 60% of the relevant population cannot be credited as if coverage were complete.

Calculate the full control cost

Include more than the purchase price:

• implementation and integration;
• internal labour and training;
• licences, infrastructure and support;
• monitoring and administration;
• process delay or user friction;
• assurance and testing;
• migration, exit and decommissioning; and
• contingency for delivery risk.

Separate one-time and recurring costs. State whether values include tax, inflation or discounting. Sophisticated financial treatment is optional, but consistent treatment across options is essential.

Use a three-case model

Suppose a control has a three-year total cost of $360,000.

Case	Expected loss without control	Expected loss with control	Avoided loss	Estimated ROSI
Conservative	$520,000	$380,000	$140,000	-61%
Central	$900,000	$420,000	$480,000	33%
Severe but plausible	$1,600,000	$620,000	$980,000	172%

The point is not to select the largest percentage. Ask which assumptions drive the change, whether downside is tolerable and whether better evidence would alter the decision.

Use the free ISO 27001 Risk Score Calculator to record a consistent qualitative view before building a financial case. Do not convert its ordinal scores directly into money.

Compare alternatives and constraints

Evaluate at least the status quo and feasible alternatives. One expensive control may reduce multiple risks; several smaller measures may create better coverage but more operating overhead.

Compare:

• risk reduction range;
• full cost and timing;
• obligation coverage;
• implementation feasibility;
• new failure modes;
• dependency on suppliers or scarce skills;
• reversibility; and
• residual risk after treatment.

Management should also see the consequence of delay. A treatment with strong long-term value may provide no reduction during a lengthy implementation, while a temporary measure may reduce near-term exposure.

Approve, monitor and revisit

Retain the scenario, inputs, sources, calculation, alternatives, assumptions, decision authority and residual-risk approval. Define review triggers such as a major incident, material scope change, price increase, failed control test or new threat evidence.

After implementation, measure coverage and effect. Examples include reduction in exposed privileged accounts, achieved restoration time, blocked attack paths, incident containment speed or completion of high-risk remediation.

The ISO 27001 management review guide explains how management can evaluate changing risks, performance and resource needs. The free ISO 27001 Clause Explainer connects that review to the wider ISMS.

Audit the decision, not the percentage

An auditor can ask:

• Is the risk scenario bounded and owned?
• Are data sources relevant and dated?
• Are frequency and effectiveness expressed honestly?
• Do costs cover implementation and operation?
• Were alternatives considered on the same basis?
• Did an authorised owner approve residual risk?
• Is realised performance reviewed against assumptions?

Pass: Ranges and sources are visible, alternatives are comparable, authority is clear, and post-implementation evidence updates the risk view.

Partial: The formula is correct, but important costs, adoption effects or uncertainty are missing.

Fail: A precise ROSI is presented as guaranteed, the business case relies on unsupported incident figures, or the model is used to avoid a binding obligation.

Use ROSI as a conversation with evidence

ROSI is valuable when it translates risk into the language of constrained choices while preserving uncertainty. Its discipline lies in the assumptions, not the final percentage.

Keep the model proportionate, review it when evidence changes and pair economic analysis with obligations, risk appetite and operational feasibility. That produces a stronger ISO 27001 treatment decision than either intuition or false precision.