Chapter 32 — Business case

Lesson map

Lesson 32 published. Map, example, EX094.

flowchart TD
  N0["Learning outcomes"]
  N1["32.1 The need"]
  N2["32.2 Costs and benefits"]
  N3["32.3 Options"]
  N4["32.4 Presenting"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX094"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["32.1 The need"]
  N2["32.2 Costs and benefits"]
  N3["32.3 Options"]
  N4["32.4 Presenting"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX094"]

[Learning outcomes]
    |
    v
[32.1 The need]
    |
    v
[32.2 Costs and benefits]
    |
    v
[32.3 Options]
    |
    v
[32.4 Presenting]
    |
    v
[Worked example] --> [Exercise EX094]

Learning outcomes

You will (1) build a business case for a security investment; (2) estimate costs and benefits; (3) present options to decision-makers.

32.1 The need

Ashfield's board asks whether it should buy a managed detection service, which monitors systems around the clock. Aisha prepares a business case. She starts with the problem: the IT manager reviews alerts only on weekday mornings, so an attack beginning on Friday evening could run unnoticed until Monday. She uses the risk register to show that ransomware and account compromise are top risks, both of which spread quickly when unnoticed. She also lists two weekend incidents from the previous year that were found only on Monday mornings.

32.2 Costs and benefits

Aisha estimates costs: the annual service fee, setup work and staff time to respond to alerts. For benefits, she estimates how much faster attacks would be detected and what damage that might prevent, using the impact ratings from the risk register. She is careful to present benefits as ranges with stated assumptions, not as precise savings. Dr. Carrow notes that security benefits are uncertain, so honesty about assumptions builds trust. She shows the board a simple table with low, middle and high estimates, and lists the assumptions beneath it in plain language.

32.3 Options

Aisha presents three options: do nothing, extend the IT manager's hours with an on-call rota, or buy the managed service. Doing nothing costs least but leaves weekends unmonitored. The on-call rota is cheaper than the service but would exhaust two IT staff. The managed service costs most but provides continuous monitoring and specialist analysts. She recommends the managed service with a one-year trial and clear performance measures. She sets measures for the trial, such as time from alert to Ashfield being notified, and a monthly report from the provider to the IT manager.

32.4 Presenting

Aisha presents the business case to the board in fifteen minutes. She leads with the problem and the recommendation, then shows options, costs and risks. A board member asks what happens if the provider misses an attack. She explains the contract terms and the monthly review of alerts and responses. The board approves a one-year trial. She learns that business cases succeed when they connect security to outcomes the board values. After the meeting, the chair asks her to present the trial results to the board in a year.

Worked example

Aisha builds a business case for managed detection, estimates costs and ranged benefits, compares three options and wins approval for a one-year trial.

Synthetic case. Figures are synthetic.

Errors and limits

Presenting uncertain benefits as precise savings damages credibility.

Exercises

• EX094 — Weekend gap. Why could weekend attacks go unnoticed?
  Show marking criteria

  Rubric: 3 = alerts reviewed only weekday mornings;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX095 — Rota drawback. What is the drawback of the on-call rota?
  Show marking criteria

  Rubric: 3 = it would exhaust two IT staff;; 2 = partly correct;; 1 = vague;; 0 = none.
• EX096 — Board decision. What does the board approve?
  Show marking criteria

  Rubric: 3 = a one-year trial;; 2 = partly correct;; 1 = other;; 0 = none.