For companies today, information security (InfoSec) investment decisions pose a great economic challenge. Here, assessment tools can offer support. Current tools, however, often focus on monetary criteria and are rarely applied in practice. It is yet important for a comprehensive assessment to also consider non-monetary criteria. In this study, we therefore build a design theory for multiple-criteria assessment tools for InfoSec investment decisions. In doing so, we consider the functionality and user acceptance of such tools and provide valuable insights into well-applicable InfoSec assessments.