A security options memo asks for one decision and fits on one page. State the decision and the date it is needed, describe two or three realistic options with their costs and risks, and recommend one. Leaders act faster when you do the weighing and show your reasoning.
Start with the decision
The first lines should say what you need and by when. "We need a decision by 30 October on how to handle end-of-support for our authentication library." Everything after that supports the choice. Avoid starting with background. Readers who stop after two lines should still know what is being asked.
Layout of the page
| Section | Content | Length |
|---|---|---|
| Decision and deadline | What, who decides, by when | 2 lines |
| Why now | The trigger and the cost of waiting | 3 lines |
| Options | Two or three, each with effort, risk and side effects | A short table |
| Recommendation | One option and why | 3 to 4 lines |
| Risks of the recommendation | What could go wrong and how you will notice | 2 to 3 lines |
| Next steps if approved | Owner and first dates | 2 to 3 lines |
Write honest options
Include "do nothing" or "defer" as an option, with its real consequences. It shows you considered it, and it gives the reader a baseline. Avoid strawmen. If two of three options are obviously bad, the memo reads as a sales pitch, and readers will trust it less.
For each option, compare the same attributes:
| Option A: upgrade now | Option B: patch in place | Option C: defer | |
|---|---|---|---|
| Effort | Larger | Smaller | None now |
| Risk during work | Medium, tests needed | Low | Exposure continues |
| Ends the problem | Yes | Partly | No |
| Needs from leader | Staff time | Little | Accept the risk and name an owner |
Use words or ranges, and any numbers you can support. If effort is a guess, say so.
Make the recommendation clear
One option, one paragraph. "We recommend option A, because it removes the exposure and the effort is similar to B once you count repeated patching." Add what would change your mind: "If the upgrade shows breakage in more than the two services we expect, we will switch to B and report back."
State what you do not know
List open questions, and how you will resolve them. It shows rigor and sets expectations. A memo that hides uncertainty looks careless when facts shift.
Make approval easy
End with a line the leader can reply to: "Reply 'approve A' and we will start Monday." Recording the decision in the same thread creates a usable trail for audit and for later review.
Review before sending
Hand it to someone outside the team and ask them to say what is being asked and what you recommend. If they cannot, shorten it. Check that every claim has a source or a stated assumption, and that you have not used jargon without explanation.
Safeguard's policies, gates and guardrails and compliance and evidence automation can record the decision and attach evidence to it. The free scan at gold.safeguard.sh/scan can supply facts for the "Why now" section.
Quick check
How many options should a memo present?
Two or three. More than that dilutes the recommendation.
Should the memo always recommend?
Yes. Leaders expect your judgement. If you truly cannot recommend, say what information is missing.
Last reviewed: 19 October 2026.
