Return on Investment

These are the situations we see before anyone talks about a breach. The data is not gone. It is missing, spread out, hard to find, or stuck in a person's head.

• The customer questionnaire. A prospect sends a long security questionnaire on Friday. Multifactor authentication lives in the identity system. Backup status lives with the technology provider. The last access review is a file from the audit. Two people answer yes for a control neither of them can open. The deal waits, or the answer is wrong.
• The customer contract. The agreement says you will protect their data, limit access, and tell them about a security incident. When they ask for proof, the evidence is an email thread and a screenshot from last year. You are describing a program. You are not showing it.
• The vendor contract. You require the vendor to protect your data and to tell you if they have an incident. If you cannot name which vendors hold customer data, who owns each relationship, and when you last reviewed them, the clause is a sentence. It is not a control.
• The person who knows. The only person who can explain how backups are tested is on leave. The insurance renewal is this month. The answer becomes whatever someone remembers.
• The audit that starts from zero. The control ran all year. The proof did not live with the control. The team spends weeks collecting screenshots and chasing owners. The cost is their time, and the risk that the story they rebuild does not match what actually happened.

A program you can run has to say what it knows, what it knows it does not know, and where something has not been named yet. Trygg does not invent the third category. It gives the first two a home, so the third one has somewhere to land when you find it.

• Known knowns. The policy says multifactor authentication is required, and the identity system shows who has it. You can manage that. You can show it to a customer.
• Known unknowns. You know backups are in scope, and you know this month's result is not in the program yet. The gap is visible. Someone owns it. It does not wait for an auditor to discover it.
• Unknown unknowns. A former employee's access. A shared mailbox nobody owns. A vendor who still has a connection. A daily practice that drifted away from the written policy. You cannot fix what the program has not named. One source of truth does not reveal every unknown. It makes an unnamed gap harder to hide: a control with no owner, a date that is blank, evidence that is no longer current.

The figures below are from the 2025 IBM Cost of a Data Breach Report. Ponemon Institute did the research. IBM published it. They describe breaches that already happened. They are not a Trygg savings calculator, and they are not a promise that a portal prevents an incident.

They do show the price of finding out late. The same report found that organizations which detected the breach themselves had breach costs about $900,000 lower than when an attacker disclosed it. Seeing your own program is not the same as detecting an intruder. It is how leaders stop guessing about the controls that are supposed to be running.

Source: IBM, Cost of a Data Breach Report 2025.

• $4.44 million. The global average cost of a data breach in the 2025 report.
• $10.22 million. The United States average in the same report, a record for any region in that study.
• 241 days. The average time to identify and contain a breach, the lowest in nine years of the study, and still most of a year.

Contracts assume you know your program. A customer security exhibit, a vendor obligation, and an insurance application all ask the same kind of question: who can see the data, what protects it, who owns the control, and what you will do if something goes wrong.

If those answers live in different tools, or only in people, you are negotiating from memory. The other party is not. Their contract is written down.

• Safeguarding their data. You can say customer data is protected. You can show which systems hold it, which control applies, who owns that control, and when the evidence was last refreshed.
• Your position with a customer. When they assess you, you answer from the program you operate. You do not build a second story for the questionnaire.
• Your position with a vendor. You can see which suppliers are in scope, what they are trusted with, and whether the review is current. The contract clause then has an owner and a date behind it.
• The insurance conversation. The application asks about access, backups, training, and incident response. A current program is an answer. A search through old files is a delay, and sometimes a guess.

The return is time you do not spend reconstructing the program, and answers you can stand behind. Why Trygg describes the idea. How it works describes the twelve weeks. This is what those weeks are buying.

• One set of risks, controls, owners, processes, and evidence. Not a folder for the audit and a different folder for the business.
• A date on the evidence, so last quarter is not mistaken for today.
• The same view for the leader, the control owner, and the auditor.
• A place to answer a customer or a vendor without starting the search over.

The return is also a position with the customer. A buyer who can see your commitment to an information security standard, and to improving it, has a reason to choose you over a competitor who cannot show the same thing. They have a reason to stay, because the commitment does not expire when the proposal does.

A certificate is a moment. Continuous improvement is the part a customer can believe in later. When the program is current, the next security question is an answer, not a project. Deals move because the customer is not waiting for you to reconstruct the story.

A 2024 survey of ISO-registered businesses in the United Kingdom, checked by Digital Scorecard, asked whether registration had helped them win business. It also looked at who reported that result. Businesses that spent more than a day a month running the system were much more likely to say the certification helped them win work. Businesses that held the registration and did little with it were less likely to see that benefit.

These figures are what the surveyed businesses reported. They cover ISO registration in general, not only ISO/IEC 27001, and they describe the businesses that answered, not every company. They are not a Trygg forecast, and they are not a promise that you will win a contract or keep a customer.

Source: Statius, The UK ISO Standards Survey, Summer 2024. The finding on time spent running the system is in the paper on maintaining standards.

• 56 percent. ISO-registered businesses in that survey who said registration had helped them win more business.
• 12 percent. The share who said it had not.
• More than a day a month. The businesses putting at least that much time into running the system were much more likely to report winning business because of the certification.

Trygg does not guarantee that you will avoid a breach, win a contract, satisfy an insurer, or pass an audit. An independent certification body decides certification. A contract is still a contract.

The investment is a management system you can see and operate. The costly alternative is a program that exists only when someone has time to assemble it.

Book a demo when you are ready to invest in what our name means: Trustworthy, reliable, steadfast, and safe.