The item CEOs are most likely to confuse is the information security investment amount.

From a CEO's perspective, you may want to see all equipment or services bought for security as information security investment. But in practice, the standard is not that simple.

IT investment is viewed broadly. Information security investment is viewed narrowly and conservatively. Products with clear security functions, such as firewalls, VPNs, DLP, and encryption solutions, can be recognized as information security investment. 

By contrast, ordinary servers bought to run EDR, simple network-isolated PCs, standard VDI, and general backup equipment are hard to recognize as information security investment. That is because the product itself does not perform a security function. The key criterion here is not ‘why it was bought’. It is what function the product or service actually performs.

Companies disclosing for the first time in 2027 must organize accounting accounts and security functions together starting this year. It is not enough for the security team to say it was bought ‘for security purposes.’ The expense must be identifiable in the accounting records, and that expense must be linked to information security functions.