A decision memo for a security tool fits on one page: the problem, the options considered, what the pilot showed, the risks and how they are handled, the cost to run, and the exact decision you want. Approvers are busy and cautious. A clear page lowers the chance of a delay or a no.
The seven parts
| Part | Length | Content |
|---|---|---|
| 1. Decision requested | One sentence | "Approve purchase of X for Y for a term of Z" |
| 2. Problem | Three sentences | What goes wrong today, in plain words |
| 3. Options | A short table | Do nothing, free services, scripts, buy |
| 4. Pilot results | Four bullets | What you tested and what you measured |
| 5. Risks and controls | A short table | Data, access, vendor, exit |
| 6. Cost and ownership | Three lines | Cost per year, owner, renewal date |
| 7. Next steps | Three lines | Contract, onboarding, review date |
Part by part
Decision requested. Put it first. Readers who stop here still know what you want.
Problem. Use plain words. "We cannot say which of our applications use a library with a newly announced flaw" is better than "lack of supply chain visibility".
Options. Include "do nothing" and the free path, since approvers will ask. See free scans, a bought tool or scripts.
Pilot results. Only true numbers from your pilot. If you did not measure something, say so.
Risks and controls. Cover the four questions every reviewer asks:
| Risk | Control |
|---|---|
| What data does it see? | Data flow description, attached |
| Who can access it? | Role set and single sign-on, tested in pilot |
| What if the vendor fails? | Export tested, fallback named |
| What if funding stops? | Renewal path and exit terms |
Cost and ownership. Name one owner. Include staff time.
Attach, do not paste
Keep the page clean and attach: data flow notes, access test results, the signed or draft terms, any accessibility report, and the exit plan. See what to ask about data flow and access control questions.
Style rules for the memo
- Plain words. No unexplained acronyms.
- Active voice, short sentences.
- Numbers only if you can trace them.
- No claims of certification or compliance that the vendor has not documented. Quote the vendor's wording and cite the document.
A sentence you can adapt
"We piloted the tool on one non-sensitive project for four weeks. It found issues we could confirm by hand, it accepted our single sign-on, and we exported our records successfully. We ask approval to continue for one year, with a review at month nine."
Mistakes that slow approval
- Starting with the vendor name instead of the problem.
- Burying the cost in an attachment.
- Leaving out who owns the tool after purchase.
- Presenting a pilot with no measures set in advance.
- Using words the approver has to look up.
Read the memo aloud to someone outside IT. Wherever they stop you, rewrite.
After approval
Send the memo with the purchase record. When the term ends, the same memo shows what you promised, so the renewal review is simple.
Quick check
How long should a decision memo be?
One page, with attachments for detail.
Should the memo include a do nothing option?
Yes. Approvers will ask, and the comparison builds trust.
Last reviewed: 19 October 2026.
