Message from the Interagency Security Committee Chief
The Interagency Security Committee (ISC) vision statement is: “Federal facilities, the people who work at
them, and those who visit them are safe and secure throughout the country.” The ISC achieves its vision by establishing security policies, ensuring compliance, and enhancing the quality and effectiveness of security and protection of federal facilities. Chaired by the Cybersecurity and Infrastructure Security Agency’s (CISA) Executive Assistant Director for Infrastructure Security, the ISC consists of 66 departments and agencies working collaboratively to achieve its vision.
As Chief of the ISC, I am pleased to introduce Making a Business Case for Security: An Interagency Security Committee Best Practice, 2022 Edition. Increasingly complex security challenges and a dynamic threat environment necessitate the requirement for a strong and agile security planning, programming and budgeting process. To that end, this publication assists security professionals in constructing a decisionmaking process or rationale for proceeding with a security project or security program, completing a benefit-cost analysis (BCA) to support spending decisions, applying these concepts to the ISC Risk Management Process, and measuring success.
This best practice guide represents exemplary leadership from the Making a Business Case for Security
Working Group and collaboration across the entire ISC membership.
1.0 Introduction
Leaders can build and sustain a culture of readiness within their organizations by investing in effective
budget-conscious security measures Developing the business case for security provides value to an
organization by reinforcing the importance of security investments.
This best practice guide provides insight for making a business case for security, completing a benefitcost analysis (BCA), applying these concepts to the ISC Risk Management Process, and measuring success.
2.0 Background
On April 19, 1995, at 9:02 a.m., a major explosion occurred in Oklahoma City. The source of the blast was a truck packed with explosives parked outside of the Alfred P. Murrah Federal Building. The blast destroyed the facility, which housed 14 federal agencies and The America’s Kids Daycare Center. This tragedy remains the worst domestic-based terrorist attack against the United States government in our history: 168 lives were lost, including 19 children, and more than 800 people were injured.
As a result, on October 19, 1995, the president signed Executive Order (EO) 12977 establishing the
“Interagency Security Committee” (ISC). EO 12977 mandates the ISC enhance the quality and effectiveness
of security in and protection of buildings and facilities in the United States occupied by federal employees
for nonmilitary activities, and to provide a permanent body to address continuing government-wide
security for federal facilities. Since its inception, the ISC has developed and published over 20 policies,
standards, and recommendations to identify, assess, and prioritize risks at federal facilities.
The ISC membership requested the development of Making a Business Case for Security, An Interagency
Security Committee Best Practice to assist organizations in developing and presenting a business case to
support security projects and programs necessary to reduce risk to federal facilities and enhance compliance with ISC standards.
3.0 Applicability and Scope
Consistent with EO 12977, Making a Business Case for Security, An Interagency Security Committee Best
Practice, 2022 Edition, is a resource intended to assist security professionals in developing security projects or programs that enhance the security and protection of federal buildings and facilities. It is applicable to all executive branch buildings and facilities in the United States occupied by federal personnel for nonmilitary activities. These facilities include currently owned, to be purchased, or leased facilities; standalone facilities; federal campuses; and, where appropriate, individual facilities on federal campuses and specialuse facilities.
