Guidance
Decisions you will face, worked through
Questions from real security and GRC work, each answered as a flow of steps and decisions. Every step explains its reasoning. Where a CISO Times pack goes further, the step names the document and the section.
Describe it in your own words. This finds the closest answered question. It does not write new advice. Don't type names, client details or anything confidential: you don't need them. What you type stays in your browser; it is not sent or stored.
Try one of these:
Start from your situation
A short reading path for the moment you are in: the questions in the order that helps, then the documents to use.
- I've just become CISOThe first 90 days in a security function someone else built.
- The auditor arrives in six weeksA Stage 1 or Stage 2 ISO 27001 audit is in the diary.
- We may have to tell a regulatorAn incident is open and a reporting clock may be running.
- The board wants a cyber updateA board or committee paper is due and the last one was a status report.
- A customer sent a 300-question questionnaireA deal is waiting on your security answers.
- We have decided to get ISO 27001 certifiedThe decisions to take in order, then the documents to work from, up to the first certification audit.
For your role
The decisions people will bring you, and what the packs say you own and hand on.
- CISOIf you lead the security function
- GRC and assuranceIf you check that security works
- IT managerIf you're the IT manager who inherited security
- HRIf you run HR
- Legal and DPOIf you advise on law and personal data
Or choose a category.
- How do we decide what to fix first when the scanner shows thousands of findings?Vulnerabilities and exposure
- How do we set remediation deadlines the business will actually agree to?Vulnerabilities and exposure
- How do we know our scanning covers everything it should?Vulnerabilities and exposure
- How do we run a weekly triage that doesn't turn into a two-hour argument?Vulnerabilities and exposure
- How do we defend our prioritisation method to an auditor?Vulnerabilities and exposure
- How do we report vulnerability posture to executives without quoting CVE counts?Vulnerabilities and exposure
- How do we run a reliable monthly patch cycle with a small IT team?Vulnerabilities and exposure
- How do we set up patch deployment rings and maintenance windows?Vulnerabilities and exposure
- When is weekly triage necessary, and when is fortnightly enough?Vulnerabilities and exposure
- When is a finding closed: when the patch is applied, or when a rescan confirms it?Vulnerabilities and exposure
- When do we patch outside the monthly cycle, and how fast?Vulnerabilities and exposure
- Who can approve deferring a patch, and for how long?Vulnerabilities and exposure
- If a vulnerability affects a business-critical service, what happens next?Vulnerabilities and exposure
- If an exploited vulnerability can't be patched today, then what?Vulnerabilities and exposure
- If the fix depends on a supplier who won't patch, then how do we manage it?Vulnerabilities and exposure
- If remediation deadlines are routinely missed, do we change the deadline, the capacity or the scope?Vulnerabilities and exposure
- If the scanner reports a critical finding on a system nobody owns, then who fixes it?Vulnerabilities and exposure
- If a server can't be rebooted to patch, then what are the options?Vulnerabilities and exposure
- If a system is past vendor support and can't be replaced yet, then what?Vulnerabilities and exposure
- How do we write a risk so it's a risk and not an audit finding?Risk, exceptions and acceptance
- How do we score risks consistently when two people assess them?Risk, exceptions and acceptance
- How do we decide between treating, transferring, avoiding and accepting a risk?Risk, exceptions and acceptance
- How do we build a risk register from nothing?Risk, exceptions and acceptance
- How do we score an exception and set how long it lasts?Risk, exceptions and acceptance
- How do we separate duties when there are only a few people?Risk, exceptions and acceptance
- How do we stop the exception register becoming a graveyard?Risk, exceptions and acceptance
- When does a risk need reassessing outside the annual cycle?Risk, exceptions and acceptance
- When is a risk outside appetite, and what has to happen then?Risk, exceptions and acceptance
- When does a deviation from policy need a formal exception?Risk, exceptions and acceptance
- Who can accept a risk, and does the answer change with its rating?Risk, exceptions and acceptance
- Who approves a Critical exception in an organisation shaped like ours?Risk, exceptions and acceptance
- Is this a risk acceptance or a security exception?Risk, exceptions and acceptance
- If the business wants to accept a risk I think is unacceptable, then how do I proceed?Risk, exceptions and acceptance
- If an exception expires and the gap is still there, then what?Risk, exceptions and acceptance
- If the same exception comes up for renewal a third time, then what?Risk, exceptions and acceptance
- If risks sit "in treatment" for years, then how do we get them moving?Risk, exceptions and acceptance
- If the only IT administrator also manages the security logs, then how do we control that?Risk, exceptions and acceptance
- If developers deploy their own code to production, is that a conflict, and what compensates?Risk, exceptions and acceptance
- How do we separate what belongs in a policy, a standard and a procedure?Policy and governance
- How do we write a policy statement that an auditor can test?Policy and governance
- How do we decide which policies we actually need, for our size and regulation?Policy and governance
- How do we get staff to acknowledge policies, and chase those who don't?Policy and governance
- When does a policy change need re-approval and fresh acknowledgement?Policy and governance
- When do we retire a policy rather than update it?Policy and governance
- Who approves a policy, a standard and a procedure?Policy and governance
- If half of our policies are past their review date, then how do we recover?Policy and governance
- If our IT is run by a service provider, whose policies apply?Policy and governance
- If we are a NIS2 or DORA entity, what changes in how policies are governed?Policy and governance
- How do we report cyber to the board as governance rather than a status update?Board and executive reporting
- How do we choose which metrics the board sees?Board and executive reporting
- How do we turn a budget request into a decision the board can make?Board and executive reporting
- How do we prepare for the questions the board will actually ask?Board and executive reporting
- How do we know whether our board reporting is working?Board and executive reporting
- How do we define a security metric so the number means the same every month?Board and executive reporting
- How do we check a metric's data before it is reported?Board and executive reporting
- How do we decide what the executive committee sees each month, and what goes to the board?Board and executive reporting
- When does the board need a cyber update, and how often?Board and executive reporting
- When do we tell the board about bad news between meetings?Board and executive reporting
- When should a key risk indicator be escalated, and to whom?Board and executive reporting
- If the board asks "are we secure?", then how do I answer honestly?Board and executive reporting
- If a board member asks about their personal liability under NIS2, then what do I say?Board and executive reporting
- If the board asks how we compare with our peers, then how do I answer?Board and executive reporting
- If a metric informs no decision, then do we keep reporting it?Board and executive reporting
- If a figure fails its quality check just before the report goes out, then what?Board and executive reporting
- How do we decide how much assurance a supplier needs?Third parties and suppliers
- How do we check a supplier's evidence rather than trusting their questionnaire answers?Third parties and suppliers
- How do we decide which security clauses go into a contract?Third parties and suppliers
- How do we exit a supplier without losing data or access control?Third parties and suppliers
- How do we answer a customer's 300-question security questionnaire consistently?Third parties and suppliers
- How do we decide who approves our answers to a customer's security questionnaire before we send them?Third parties and suppliers
- How do we build and keep a library of security answers we can reuse?Third parties and suppliers
- How do we decide whether to answer a questionnaire in full, point to a certificate, or decline?Third parties and suppliers
- How do we write a customer-facing security overview that answers most questionnaires before they arrive?Third parties and suppliers
- How do we log customer questionnaires so none are late or answered inconsistently?Third parties and suppliers
- When is a supplier supporting a "critical or important function" under DORA?Third parties and suppliers
- When do we reassess a supplier we already use?Third parties and suppliers
- When do we share a report, certificate or policy with a customer, and on what terms?Third parties and suppliers
- If a supplier fails assessment but the business has already signed, then what?Third parties and suppliers
- If a critical supplier is unavailable, can the service continue?Third parties and suppliers
- If a supplier tells us they've had a breach, then how do we respond?Third parties and suppliers
- If many of our critical services depend on one provider, then what do we do about it?Third parties and suppliers
- If a supplier refuses our audit clause, then do we sign anyway?Third parties and suppliers
- If a customer asks us to commit to a security term we cannot meet, then what do we do?Third parties and suppliers
- If an answer we gave a customer turns out to be wrong, then what do we do?Third parties and suppliers
- How do we run an access review that isn't rubber-stamped?Identity and access
- How often do we review access, and who does the reviewing?Identity and access
- How do we decide which systems belong in the review?Identity and access
- How do we review access to a system a supplier runs for us?Identity and access
- How do we review privileged and administrator access?Identity and access
- How do we prove to an auditor that the review really happened?Identity and access
- How do we roll out phishing-resistant MFA, and in what order?Identity and access
- How do we set up a new starter's access before their first day?Identity and access
- How do we build role-based access profiles without a role-mining project?Identity and access
- How do we control administrator access without a PAM platform?Identity and access
- How do we find and control service accounts nobody owns?Identity and access
- When someone changes role, when do they lose their old access?Identity and access
- When must a leaver's access be removed, and what changes if they leave on bad terms?Identity and access
- When do we use a break-glass account, and what must happen afterwards?Identity and access
- Who approves access that isn't in the role's standard profile?Identity and access
- Who approves temporary administrator rights, and for how long?Identity and access
- If a reviewer misses the deadline, then what?Identity and access
- If the review finds leavers who still have access, then what?Identity and access
- If someone calls the help desk asking for an MFA reset, then how do we verify who they are?Identity and access
- If a session token was exposed, is a password reset enough?Identity and access
- If some SaaS accounts sit outside SSO, then how do we find and close the gaps?Identity and access
- If a contractor's engagement ends without HR knowing, then how do we catch it?Identity and access
- If an administrator uses their admin account for email or browsing, then what?Identity and access
- How do we decide whether something is an incident or just an event?Incidents and regulatory notification
- How do we decide which decisions an incident exercise should test?Incidents and regulatory notification
- How do we run a tabletop that tests decisions rather than rehearsing a script?Incidents and regulatory notification
- How do we decide an incident's severity when the facts are still unclear?Incidents and regulatory notification
- How do we decide whether an incident is significant under NIS2?Incidents and regulatory notification
- How do we decide whether an ICT incident is major under DORA?Incidents and regulatory notification
- How do we write a NIS2 early warning when we still know very little?Incidents and regulatory notification
- How do we make sure we can notify a regulator before an incident happens?Incidents and regulatory notification
- When do we have to notify a regulator, and under which regime?Incidents and regulatory notification
- When one incident triggers NIS2, DORA and GDPR at once, which clock runs first?Incidents and regulatory notification
- When do we tell the board during an incident?Incidents and regulatory notification
- When do we call in outside incident-response help?Incidents and regulatory notification
- When does each group of people need an incident exercise, and how often?Incidents and regulatory notification
- When is a post-incident review needed, and what must it produce?Incidents and regulatory notification
- When must we tell people affected by a personal data breach, and what do we tell them?Incidents and regulatory notification
- Who has the authority to take a production system offline?Incidents and regulatory notification
- Who decides whether to pay a ransom?Incidents and regulatory notification
- Who should facilitate, observe and take part in an incident exercise?Incidents and regulatory notification
- Who approves and submits a regulatory notification, including out of hours?Incidents and regulatory notification
- If a VPN appliance may be compromised, do we patch, rebuild or replace it?Incidents and regulatory notification
- If a service was compromised, what evidence is enough to reconnect it?Incidents and regulatory notification
- If ransomware has encrypted production, do we restore or rebuild?Incidents and regulatory notification
- If a payment has gone to a fraudster, then what do we do in the first hour?Incidents and regulatory notification
- If an exercise finds a gap, then how do we make sure it is fixed and stays fixed?Incidents and regulatory notification
- If we can't tell whether an incident is reportable and the deadline is close, then what?Incidents and regulatory notification
- How do we know our backups will actually restore?Resilience and recovery
- How do we agree recovery time and data-loss targets with the business?Resilience and recovery
- How do we plan recovery from a destructive cyberattack, and how is it different from disaster recovery?Resilience and recovery
- How do we find the dependencies that decide whether a service can meet its recovery time?Resilience and recovery
- How do we choose which backup to restore from after a cyberattack?Resilience and recovery
- How do we recover when the attacker may control our sign-in directory?Resilience and recovery
- How do we decide what to back up, how often and for how long?Resilience and recovery
- How do we choose which restore tests to run, and how often, for each system?Resilience and recovery
- How do we protect data in a cloud or software-as-a-service system when the provider does not back it up?Resilience and recovery
- How do we show an auditor or an insurer that our backups restore?Resilience and recovery
- When do we test recovery, and how much testing is enough?Resilience and recovery
- Who decides what during a crisis, and who stands in when they cannot?Resilience and recovery
- If backups can be reached with production administrator credentials, then what?Resilience and recovery
- If a critical supplier's recovery time is longer than our service can wait, then what do we do?Resilience and recovery
- If a service cannot be back within its recovery time, how do we keep the business running?Resilience and recovery
- If a backup job fails, then what do we do, and by when?Resilience and recovery
- If a restore test misses the recovery time or loses too much data, then what do we do?Resilience and recovery
- If we lose the key or the console password for our backups, then how do we get in?Resilience and recovery
- How do we set the scope of our ISMS?Regulation, audit and certification
- How do we justify excluding an Annex A control?Regulation, audit and certification
- How do we prepare our people for auditor interviews?Regulation, audit and certification
- How do we run an internal audit when we are small?Regulation, audit and certification
- How do we run a management review that actually decides things?Regulation, audit and certification
- How do we set up an ISO 27001 risk assessment and treatment method that stands up to an audit?Regulation, audit and certification
- How do we get the top management commitment and resources an ISO 27001 project needs?Regulation, audit and certification
- How do we write an information security policy and objectives that stand up to an ISO 27001 audit?Regulation, audit and certification
- How do we show that the people running our ISMS are competent and that our staff are aware?Regulation, audit and certification
- How do we choose a certification body and agree our audit dates?Regulation, audit and certification
- How do we keep our ISO 27001 certificate after the certification audit?Regulation, audit and certification
- How do we decide whether our own people, a consultant or both do the ISO 27001 implementation work?Regulation, audit and certification
- How do we decide which issues and interested parties' requirements our ISMS has to address?Regulation, audit and certification
- How do we decide what to monitor and measure in our ISMS, and who evaluates it?Regulation, audit and certification
- How do we use our cloud providers' certificates and reports in our ISMS scope and Statement of Applicability?Regulation, audit and certification
- How do we build a register of legal, regulatory and contractual requirements that stands up to an ISO 27001 audit?Regulation, audit and certification
- How do we keep an asset inventory that stands up to an ISO 27001 audit?Regulation, audit and certification
- How do we decide what documented information our ISMS needs and keep it under control?Regulation, audit and certification
- How do we decide what to log and monitor, and who reviews it, for an ISO 27001 audit?Regulation, audit and certification
- How do we decide which changes to systems need approval, and handle emergency changes, under ISO 27001?Regulation, audit and certification
- How do we decide where we need encryption and how we manage keys and certificates under ISO 27001?Regulation, audit and certification
- How do we decide the rules for remote working and personal devices under ISO 27001?Regulation, audit and certification
- How do we decide how to prevent data leakage and set the rules for sending information out, under ISO 27001?Regulation, audit and certification
- How do we find the minimum control set when DORA, NIS2 and ISO 27001 all apply to us?Regulation, audit and certification
- How do we show that our management body has approved and oversees our NIS2 measures?Regulation, audit and certification
- How do we get ready for a NIS2 supervisor's request for evidence?Regulation, audit and certification
- How do we plan cybersecurity training for our management body?Regulation, audit and certification
- How do we build and keep our register of information on ICT third-party arrangements?Regulation, audit and certification
- How do we show our management body has approved and oversees our ICT risk management framework?Regulation, audit and certification
- How do we get ready for a supervisor's request for DORA evidence?Regulation, audit and certification
- How do we leave an ICT provider that supports a critical or important function without stopping the service?Regulation, audit and certification
- When are we ready for the Stage 1 audit?Regulation, audit and certification
- When will certification realistically happen, and what will it cost?Regulation, audit and certification
- When is a NIS2 readiness gap blocking, and who must hear about it?Regulation, audit and certification
- When does DORA require threat-led penetration testing, and how do we plan the other tests?Regulation, audit and certification
- When is a DORA readiness gap blocking, and who must hear about it?Regulation, audit and certification
- Do we need a separate register of risks and opportunities for our ISMS itself, apart from our risk register?Regulation, audit and certification
- Is our organisation in scope of NIS2, and as essential or important?Regulation, audit and certification
- Is our organisation a financial entity under DORA, and which duties follow?Regulation, audit and certification
- Do we qualify for the simplified ICT risk management framework or the microenterprise relief?Regulation, audit and certification
- Does our ISO 27001 certificate satisfy DORA's ICT risk management framework?Regulation, audit and certification
- If the auditor raises a major nonconformity, then what?Regulation, audit and certification
- If we are halfway through implementation and behind plan, then do we move the audit date?Regulation, audit and certification
- If Stage 1 has raised concerns, then how do we get ready for Stage 2?Regulation, audit and certification
- If we build or configure software ourselves, how much secure development does ISO 27001 expect?Regulation, audit and certification
- If we work from a shared building or a rented office, which physical controls do we still need under ISO 27001?Regulation, audit and certification
- If an internal audit, an incident or a complaint shows a nonconformity, then how do we correct it and stop it coming back?Regulation, audit and certification
- If we are not sure whether we must register with our NIS2 authority, then what do we do?Regulation, audit and certification
- If a customer that is a financial entity asks us to accept DORA contract terms, then what do we do?Regulation, audit and certification
- How do we classify information without everything ending up "Confidential"?Data and AI
- How do we assess the security of a GenAI feature we are building ourselves?Data and AI
- How do we decide whether a proposed AI use case can go ahead?Data and AI
- How do we find and record all the AI we use, including AI inside tools we already own?Data and AI
- How do we assess the risk and impact of an AI use case before we approve it?Data and AI
- How do we review an LLM feature or an AI agent for security before it goes live?Data and AI
- How do we defend an LLM application against prompt injection?Data and AI
- How do we check an AI vendor or model provider before we rely on it?Data and AI
- How do we test an LLM application the way an attacker would?Data and AI
- How do we configure a generative AI service securely before it goes live?Data and AI
- How do we track AI security findings and the deviations we accept?Data and AI
- When does personal data make a security incident a GDPR breach?Data and AI
- When must staff who use AI have training, and what must it cover?Data and AI
- Who is accountable for an AI decision, and who can stop an AI use?Data and AI
- What should an AI agent be allowed to do on its own, and what needs a person's approval?Data and AI
- Should staff be allowed to use public generative AI tools, and on what terms?Data and AI
- Does the EU AI Act apply to our use of AI, and are we a provider or a deployer?Data and AI
- If an AI vendor may train on our data, then what do we require?Data and AI
- If staff are already using AI tools nobody approved, then what do we do?Data and AI
- If an LLM application leaks data or is manipulated into a harmful action, then what do we do?Data and AI
- How do I hand over the function when I leave?Leading the security function
- How do I find out what an inherited security programme really does, as opposed to what it claims?Leading the security function
- How do I decide who to interview first, and what to ask?Leading the security function
- How do I record my starting position so I can show progress at the end of the first year?Leading the security function
- How do I brief the executives at the end of discovery?Leading the security function
- How do I build a hundred-day plan that mixes quick wins with the decisions that take longer?Leading the security function
- How do I plan the first year of recurring reviews, reports and renewals?Leading the security function
- How do we tell whether our security programme is mature, and which gaps matter?Leading the security function
- How do we score maturity consistently when different people assess?Leading the security function
- How do we tell whether evidence actually proves the level someone claims?Leading the security function
- How do we set target maturity levels without aiming for the top everywhere?Leading the security function
- How do we turn maturity gaps into an improvement plan the budget can carry?Leading the security function
- How do we test whether a security control actually works between audits?Leading the security function
- How many samples do we need when testing a control?Leading the security function
- What evidence is good enough to show a control operated?Leading the security function
- How do we rate a control deficiency and set its deadline?Leading the security function
- How do we plan a year of control testing around audits and reviews?Leading the security function
- How do we test a control once and use the result for several frameworks?Leading the security function
- How do we run awareness training that changes behaviour, not just completion rates?Leading the security function
- How do we plan a year of awareness from our own incidents and risks?Leading the security function
- How do we run phishing simulations that teach rather than punish?Leading the security function
- How do I set next year's priorities with a fixed budget?Leading the security function
- What do I do in my first 90 days as a new CISO?Leading the security function
- When should we commission an independent assessment instead of self-assessing?Leading the security function
- When can we close an improvement action, and when do we re-assess?Leading the security function
- When do we know whether awareness is working, and what do we measure?Leading the security function
- Which decisions can I make myself in my first months, and which do I share or escalate?Leading the security function
- Who should assess our security practices when the team is too small to be independent?Leading the security function
- Who should test our controls when the team is too small to be independent?Leading the security function
- Who needs more than the standard awareness training, and what?Leading the security function
- If I inherit a programme with no documentation, where do I start?Leading the security function
- If my predecessor left without a handover, then how do I rebuild what I need?Leading the security function
- If a re-assessment shows a lower level than last time, then what do we do?Leading the security function
- If a control test finds an exception, has the control failed?Leading the security function
- If the same person keeps clicking simulated phishing emails, then what do we do?Leading the security function
Vulnerabilities and exposure
Finding, ranking and fixing weaknesses: scan coverage, priorities and deadlines, and what to do when a fix can't happen in time.
Show the 19 questions
- How do we decide what to fix first when the scanner shows thousands of findings?
- How do we set remediation deadlines the business will actually agree to?
- How do we know our scanning covers everything it should?
- How do we run a weekly triage that doesn't turn into a two-hour argument?
- How do we defend our prioritisation method to an auditor?
- How do we report vulnerability posture to executives without quoting CVE counts?
- How do we run a reliable monthly patch cycle with a small IT team?
- How do we set up patch deployment rings and maintenance windows?
- When is weekly triage necessary, and when is fortnightly enough?
- When is a finding closed: when the patch is applied, or when a rescan confirms it?
- When do we patch outside the monthly cycle, and how fast?
- Who can approve deferring a patch, and for how long?
- If a vulnerability affects a business-critical service, what happens next?
- If an exploited vulnerability can't be patched today, then what?
- If the fix depends on a supplier who won't patch, then how do we manage it?
- If remediation deadlines are routinely missed, do we change the deadline, the capacity or the scope?
- If the scanner reports a critical finding on a system nobody owns, then who fixes it?
- If a server can't be rebooted to patch, then what are the options?
- If a system is past vendor support and can't be replaced yet, then what?
19 questionsP01P17P29P30
Risk, exceptions and acceptance
Writing, scoring and deciding on risk, and handling the gaps you can't close yet: exceptions, acceptances and segregation of duties.
Show the 19 questions
- How do we write a risk so it's a risk and not an audit finding?
- How do we score risks consistently when two people assess them?
- How do we decide between treating, transferring, avoiding and accepting a risk?
- How do we build a risk register from nothing?
- How do we score an exception and set how long it lasts?
- How do we separate duties when there are only a few people?
- How do we stop the exception register becoming a graveyard?
- When does a risk need reassessing outside the annual cycle?
- When is a risk outside appetite, and what has to happen then?
- When does a deviation from policy need a formal exception?
- Who can accept a risk, and does the answer change with its rating?
- Who approves a Critical exception in an organisation shaped like ours?
- Is this a risk acceptance or a security exception?
- If the business wants to accept a risk I think is unacceptable, then how do I proceed?
- If an exception expires and the gap is still there, then what?
- If the same exception comes up for renewal a third time, then what?
- If risks sit "in treatment" for years, then how do we get them moving?
- If the only IT administrator also manages the security logs, then how do we control that?
- If developers deploy their own code to production, is that a conflict, and what compensates?
19 questionsP05P02
Policy and governance
Which documents you need, who approves them, and how to keep them current and acknowledged.
Show the 10 questions
- How do we separate what belongs in a policy, a standard and a procedure?
- How do we write a policy statement that an auditor can test?
- How do we decide which policies we actually need, for our size and regulation?
- How do we get staff to acknowledge policies, and chase those who don't?
- When does a policy change need re-approval and fresh acknowledgement?
- When do we retire a policy rather than update it?
- Who approves a policy, a standard and a procedure?
- If half of our policies are past their review date, then how do we recover?
- If our IT is run by a service provider, whose policies apply?
- If we are a NIS2 or DORA entity, what changes in how policies are governed?
10 questionsP04
Board and executive reporting
Telling the board where you stand against appetite, what you need from them, and how to answer the hard questions.
Show the 16 questions
- How do we report cyber to the board as governance rather than a status update?
- How do we choose which metrics the board sees?
- How do we turn a budget request into a decision the board can make?
- How do we prepare for the questions the board will actually ask?
- How do we know whether our board reporting is working?
- How do we define a security metric so the number means the same every month?
- How do we check a metric's data before it is reported?
- How do we decide what the executive committee sees each month, and what goes to the board?
- When does the board need a cyber update, and how often?
- When do we tell the board about bad news between meetings?
- When should a key risk indicator be escalated, and to whom?
- If the board asks "are we secure?", then how do I answer honestly?
- If a board member asks about their personal liability under NIS2, then what do I say?
- If the board asks how we compare with our peers, then how do I answer?
- If a metric informs no decision, then do we keep reporting it?
- If a figure fails its quality check just before the report goes out, then what?
16 questionsP03P11
Third parties and suppliers
How much assurance each supplier needs, what goes in the contract, and what to do when a supplier fails or is breached.
Show the 20 questions
- How do we decide how much assurance a supplier needs?
- How do we check a supplier's evidence rather than trusting their questionnaire answers?
- How do we decide which security clauses go into a contract?
- How do we exit a supplier without losing data or access control?
- How do we answer a customer's 300-question security questionnaire consistently?
- How do we decide who approves our answers to a customer's security questionnaire before we send them?
- How do we build and keep a library of security answers we can reuse?
- How do we decide whether to answer a questionnaire in full, point to a certificate, or decline?
- How do we write a customer-facing security overview that answers most questionnaires before they arrive?
- How do we log customer questionnaires so none are late or answered inconsistently?
- When is a supplier supporting a "critical or important function" under DORA?
- When do we reassess a supplier we already use?
- When do we share a report, certificate or policy with a customer, and on what terms?
- If a supplier fails assessment but the business has already signed, then what?
- If a critical supplier is unavailable, can the service continue?
- If a supplier tells us they've had a breach, then how do we respond?
- If many of our critical services depend on one provider, then what do we do about it?
- If a supplier refuses our audit clause, then do we sign anyway?
- If a customer asks us to commit to a security term we cannot meet, then what do we do?
- If an answer we gave a customer turns out to be wrong, then what do we do?
20 questionsP06P26
Identity and access
Who should have access, how to prove it, and how to handle the identity weaknesses attackers use most.
Show the 23 questions
- How do we run an access review that isn't rubber-stamped?
- How often do we review access, and who does the reviewing?
- How do we decide which systems belong in the review?
- How do we review access to a system a supplier runs for us?
- How do we review privileged and administrator access?
- How do we prove to an auditor that the review really happened?
- How do we roll out phishing-resistant MFA, and in what order?
- How do we set up a new starter's access before their first day?
- How do we build role-based access profiles without a role-mining project?
- How do we control administrator access without a PAM platform?
- How do we find and control service accounts nobody owns?
- When someone changes role, when do they lose their old access?
- When must a leaver's access be removed, and what changes if they leave on bad terms?
- When do we use a break-glass account, and what must happen afterwards?
- Who approves access that isn't in the role's standard profile?
- Who approves temporary administrator rights, and for how long?
- If a reviewer misses the deadline, then what?
- If the review finds leavers who still have access, then what?
- If someone calls the help desk asking for an MFA reset, then how do we verify who they are?
- If a session token was exposed, is a password reset enough?
- If some SaaS accounts sit outside SSO, then how do we find and close the gaps?
- If a contractor's engagement ends without HR knowing, then how do we catch it?
- If an administrator uses their admin account for email or browsing, then what?
23 questionsP07P13P14
Incidents and regulatory notification
Deciding what counts as an incident, who can act, when regulators must hear, and when a service is safe to reconnect.
Show the 25 questions
- How do we decide whether something is an incident or just an event?
- How do we decide which decisions an incident exercise should test?
- How do we run a tabletop that tests decisions rather than rehearsing a script?
- How do we decide an incident's severity when the facts are still unclear?
- How do we decide whether an incident is significant under NIS2?
- How do we decide whether an ICT incident is major under DORA?
- How do we write a NIS2 early warning when we still know very little?
- How do we make sure we can notify a regulator before an incident happens?
- When do we have to notify a regulator, and under which regime?
- When one incident triggers NIS2, DORA and GDPR at once, which clock runs first?
- When do we tell the board during an incident?
- When do we call in outside incident-response help?
- When does each group of people need an incident exercise, and how often?
- When is a post-incident review needed, and what must it produce?
- When must we tell people affected by a personal data breach, and what do we tell them?
- Who has the authority to take a production system offline?
- Who decides whether to pay a ransom?
- Who should facilitate, observe and take part in an incident exercise?
- Who approves and submits a regulatory notification, including out of hours?
- If a VPN appliance may be compromised, do we patch, rebuild or replace it?
- If a service was compromised, what evidence is enough to reconnect it?
- If ransomware has encrypted production, do we restore or rebuild?
- If a payment has gone to a fraudster, then what do we do in the first hour?
- If an exercise finds a gap, then how do we make sure it is fixed and stays fixed?
- If we can't tell whether an incident is reportable and the deadline is close, then what?
25 questionsP09P10P18P03
Resilience and recovery
Proving you can restore, agreeing recovery targets with the business, and limiting the damage when something fails.
Show the 18 questions
- How do we know our backups will actually restore?
- How do we agree recovery time and data-loss targets with the business?
- How do we plan recovery from a destructive cyberattack, and how is it different from disaster recovery?
- How do we find the dependencies that decide whether a service can meet its recovery time?
- How do we choose which backup to restore from after a cyberattack?
- How do we recover when the attacker may control our sign-in directory?
- How do we decide what to back up, how often and for how long?
- How do we choose which restore tests to run, and how often, for each system?
- How do we protect data in a cloud or software-as-a-service system when the provider does not back it up?
- How do we show an auditor or an insurer that our backups restore?
- When do we test recovery, and how much testing is enough?
- Who decides what during a crisis, and who stands in when they cannot?
- If backups can be reached with production administrator credentials, then what?
- If a critical supplier's recovery time is longer than our service can wait, then what do we do?
- If a service cannot be back within its recovery time, how do we keep the business running?
- If a backup job fails, then what do we do, and by when?
- If a restore test misses the recovery time or loses too much data, then what do we do?
- If we lose the key or the console password for our backups, then how do we get in?
18 questionsP22P23P21
Regulation, audit and certification
Scoping, preparing for and passing audits, and working out where ISO 27001, NIS2, DORA and GDPR overlap.
Show the 49 questions
- How do we set the scope of our ISMS?
- How do we justify excluding an Annex A control?
- How do we prepare our people for auditor interviews?
- How do we run an internal audit when we are small?
- How do we run a management review that actually decides things?
- How do we set up an ISO 27001 risk assessment and treatment method that stands up to an audit?
- How do we get the top management commitment and resources an ISO 27001 project needs?
- How do we write an information security policy and objectives that stand up to an ISO 27001 audit?
- How do we show that the people running our ISMS are competent and that our staff are aware?
- How do we choose a certification body and agree our audit dates?
- How do we keep our ISO 27001 certificate after the certification audit?
- How do we decide whether our own people, a consultant or both do the ISO 27001 implementation work?
- How do we decide which issues and interested parties' requirements our ISMS has to address?
- How do we decide what to monitor and measure in our ISMS, and who evaluates it?
- How do we use our cloud providers' certificates and reports in our ISMS scope and Statement of Applicability?
- How do we build a register of legal, regulatory and contractual requirements that stands up to an ISO 27001 audit?
- How do we keep an asset inventory that stands up to an ISO 27001 audit?
- How do we decide what documented information our ISMS needs and keep it under control?
- How do we decide what to log and monitor, and who reviews it, for an ISO 27001 audit?
- How do we decide which changes to systems need approval, and handle emergency changes, under ISO 27001?
- How do we decide where we need encryption and how we manage keys and certificates under ISO 27001?
- How do we decide the rules for remote working and personal devices under ISO 27001?
- How do we decide how to prevent data leakage and set the rules for sending information out, under ISO 27001?
- How do we find the minimum control set when DORA, NIS2 and ISO 27001 all apply to us?
- How do we show that our management body has approved and oversees our NIS2 measures?
- How do we get ready for a NIS2 supervisor's request for evidence?
- How do we plan cybersecurity training for our management body?
- How do we build and keep our register of information on ICT third-party arrangements?
- How do we show our management body has approved and oversees our ICT risk management framework?
- How do we get ready for a supervisor's request for DORA evidence?
- How do we leave an ICT provider that supports a critical or important function without stopping the service?
- When are we ready for the Stage 1 audit?
- When will certification realistically happen, and what will it cost?
- When is a NIS2 readiness gap blocking, and who must hear about it?
- When does DORA require threat-led penetration testing, and how do we plan the other tests?
- When is a DORA readiness gap blocking, and who must hear about it?
- Do we need a separate register of risks and opportunities for our ISMS itself, apart from our risk register?
- Is our organisation in scope of NIS2, and as essential or important?
- Is our organisation a financial entity under DORA, and which duties follow?
- Do we qualify for the simplified ICT risk management framework or the microenterprise relief?
- Does our ISO 27001 certificate satisfy DORA's ICT risk management framework?
- If the auditor raises a major nonconformity, then what?
- If we are halfway through implementation and behind plan, then do we move the audit date?
- If Stage 1 has raised concerns, then how do we get ready for Stage 2?
- If we build or configure software ourselves, how much secure development does ISO 27001 expect?
- If we work from a shared building or a rented office, which physical controls do we still need under ISO 27001?
- If an internal audit, an incident or a complaint shows a nonconformity, then how do we correct it and stop it coming back?
- If we are not sure whether we must register with our NIS2 authority, then what do we do?
- If a customer that is a financial entity asks us to accept DORA contract terms, then what do we do?
49 questionsP08P12P21P28
Data and AI
Classifying information, setting terms for AI tools, and assessing the AI features you build.
Show the 20 questions
- How do we classify information without everything ending up "Confidential"?
- How do we assess the security of a GenAI feature we are building ourselves?
- How do we decide whether a proposed AI use case can go ahead?
- How do we find and record all the AI we use, including AI inside tools we already own?
- How do we assess the risk and impact of an AI use case before we approve it?
- How do we review an LLM feature or an AI agent for security before it goes live?
- How do we defend an LLM application against prompt injection?
- How do we check an AI vendor or model provider before we rely on it?
- How do we test an LLM application the way an attacker would?
- How do we configure a generative AI service securely before it goes live?
- How do we track AI security findings and the deviations we accept?
- When does personal data make a security incident a GDPR breach?
- When must staff who use AI have training, and what must it cover?
- Who is accountable for an AI decision, and who can stop an AI use?
- What should an AI agent be allowed to do on its own, and what needs a person's approval?
- Should staff be allowed to use public generative AI tools, and on what terms?
- Does the EU AI Act apply to our use of AI, and are we a provider or a deployer?
- If an AI vendor may train on our data, then what do we require?
- If staff are already using AI tools nobody approved, then what do we do?
- If an LLM application leaks data or is manipulated into a harmful action, then what do we do?
20 questionsP15P24P25P28
Leading the security function
Starting, running and handing over a security function: the first 90 days, maturity, awareness and priorities.
Show the 35 questions
- How do I hand over the function when I leave?
- How do I find out what an inherited security programme really does, as opposed to what it claims?
- How do I decide who to interview first, and what to ask?
- How do I record my starting position so I can show progress at the end of the first year?
- How do I brief the executives at the end of discovery?
- How do I build a hundred-day plan that mixes quick wins with the decisions that take longer?
- How do I plan the first year of recurring reviews, reports and renewals?
- How do we tell whether our security programme is mature, and which gaps matter?
- How do we score maturity consistently when different people assess?
- How do we tell whether evidence actually proves the level someone claims?
- How do we set target maturity levels without aiming for the top everywhere?
- How do we turn maturity gaps into an improvement plan the budget can carry?
- How do we test whether a security control actually works between audits?
- How many samples do we need when testing a control?
- What evidence is good enough to show a control operated?
- How do we rate a control deficiency and set its deadline?
- How do we plan a year of control testing around audits and reviews?
- How do we test a control once and use the result for several frameworks?
- How do we run awareness training that changes behaviour, not just completion rates?
- How do we plan a year of awareness from our own incidents and risks?
- How do we run phishing simulations that teach rather than punish?
- How do I set next year's priorities with a fixed budget?
- What do I do in my first 90 days as a new CISO?
- When should we commission an independent assessment instead of self-assessing?
- When can we close an improvement action, and when do we re-assess?
- When do we know whether awareness is working, and what do we measure?
- Which decisions can I make myself in my first months, and which do I share or escalate?
- Who should assess our security practices when the team is too small to be independent?
- Who should test our controls when the team is too small to be independent?
- Who needs more than the standard awareness training, and what?
- If I inherit a programme with no documentation, where do I start?
- If my predecessor left without a handover, then how do I rebuild what I need?
- If a re-assessment shows a lower level than last time, then what do we do?
- If a control test finds an exception, has the control failed?
- If the same person keeps clicking simulated phishing emails, then what do we do?
35 questionsP27P16P19P20