CFO view of ISO 27001: annual report cybersecurity disclosure, ESG bonus points and budgeting

What cybersecurity information must the annual report disclose, and which figures should a CFO prepare?

Article 18, item 6 of the annual report regulations requires:

• the cybersecurity risk management framework, cybersecurity policy and concrete programmes
• the resources invested in cybersecurity management
• for the latest year and up to the printing date, the losses, possible effects and responses for major cybersecurity incidents

The CFO must be able to explain the resources invested and incident losses in financial terms; the ISO 27001 risk assessment, Statement of Applicability (SoA) and audit records let the resources, programmes and certification results be disclosed with one set of numbers. The annual report regulations apply to public companies; companies that are not public companies are not covered and can use them voluntarily.

How does ESG indicator S-12 award a bonus? Is a certificate required?

S-12 asks whether the company has built and discloses its cybersecurity risk management framework, policy, concrete programmes and the resources invested; it is scored on the annual report and is an A+ item.

• Disclosure itself is the scoring condition
• Bonus condition: implementing ISO 27001, CNS 27001 or another information security management system standard of equal or greater effect, with third-party certification, adds one point overall

The wording is the same in the 2026 and 2027 editions. The evaluation covers listed companies; companies that are not listed or not public are not covered and can use it voluntarily.

What do the internal control regulations require on cybersecurity? Can the ISO 27001 internal audit be outsourced?

Article 9 of the internal control regulations requires controls over cybersecurity inspection; Article 9-1 requires adequate human resources and equipment to plan, monitor and carry out the information security system.

The internal audit can be outsourced: ISO 19011:2018 defines an internal audit as one conducted by or on behalf of the organisation itself. The one hard limit is ISO/IEC 17021-1 clause 5.2.6: a certification body may not perform internal audits for its own certification clients, so outsource to a consultant, not your certification body. The internal control regulations apply to public companies; companies that are not public companies are not covered and can use them voluntarily.

Budgeting: how should the ISO 27001 spend be split?

Into at least two items, which cannot go to the same firm:

• Consultant: gap analysis, building the system, internal audit
• Certification body: independent audit and certification

Under ISO/IEC 17021-1 clause 5.2.5, a management system certification body and the same legal entity may not provide management system consultancy. The amount depends on scope and the maturity of existing systems; not all 93 controls are required — applicability is decided by the risk assessment and recorded in the SoA, with reasons for exclusions. This page lists no fees; Winners Consulting provides an estimate after the free mechanism diagnosis.

Timeline: how soon can certification be obtained, and in time for the annual report?

As listed on the service page, typically 4–8 months, in this order:

1. Gap analysis
2. Building the system
3. Internal audit and management review
4. Stage 1 / stage 2 certification audit

An existing IT governance base can shorten it noticeably. Implementation is always against ISO/IEC 27001:2022; the transition period for 2013 certificates ended on 31 October 2025. Because S-12 is scored on the annual report, the CFO can work back from the annual report preparation date to set the start date.

Return on investment: how far does one ISO 27001 investment reach, and does a certificate mean legal compliance?

ISO 27001 is the foundation several standards share: ISO 27701 (privacy), ISO 22301 (business continuity) and ISO 42001 (AI management) all use its management system structure, so each later certificate can reuse risk management, internal audit and management review.

The limits of the certificate must also be clear:

• ISO 27001 is an organisation-level security management standard, not a harmonised standard under the EU CRA
• ISO 27001 does not mean personal data compliance; privacy must be addressed item by item under ISO 27701 and the applicable law

How does Winners Consulting help a CFO with the ISO 27001 information security management system?

• VP- and director-level consultants lead the work end to end, never outsourced; the team holds ISO lead auditor qualifications
• We first confirm the security requirements of customers, tenders and regulators and define the certification scope, then build the assessment framework in ERM risk language and decide the controls and SoA
• For certified organisations, the internal audit can be outsourced to Winners; Winners is a consultant and does not certify

Named clients: MPI Corporation (旺矽科技), 訊光資訊科技 (InfoLight), 卓元科健 (Cho Yuan), Hypercore Fitness Center; Taiwan Stock Exchange (TWSE) — internal control system integrated with ISO 9000 and ISMS. Read more: ISO 27001 consulting, Choosing an ISO 27001 consultant, Outsourcing the ISO 27001 internal audit, CISO role page, CFO role page. Request a free mechanism diagnosis