Guidance · CISO
If you lead the security function
You own the security decisions the packs give the Head of Information Security, and you carry the rest to the people who own them.
The decisions you'll be asked to make
Who decides…
Which decisions can I make myself in my first months, and which do I share or escalate?Find the rule that gives each right before you decide. Keep incident decisions with the incident plan, Policy-tier documents with executive management, and exceptions and risk acceptances with their band's approvers.
Who decides…
Who can accept a risk, and does the answer change with its rating?Yes. The residual band sets who signs, and the position against appetite adds signatures on top: executive management as well outside appetite, and only the board or its equivalent outside tolerance or for any Critical risk.
Who decides…
Who approves a Critical exception in an organisation shaped like ours?Name the approver from your structure: the board, or a board risk committee it has delegated this to; the management board in a two-tier structure; executive management where there is no board.
Who decides…
Who decides whether to pay a ransom?Only the board or its equivalent decides whether to pay a ransom, and only once legal advice including a sanctions check, the insurer's view and a report to law enforcement are in place.
Who decides…
Who decides what during a crisis, and who stands in when they cannot?Write down before a crisis a short list of decisions, each with one person accountable and a named deputy.
What you own and what you hand on
From the Transition Decision Rights Matrix P27-A06, in CISO Transition, Handover & First 90 Days.
The pack's default for a new leader: whether you own, share or escalate each kind of decision as the first 90 days pass. The arrangement never gives you a right the rule does not, and incident decisions stay as the incident plan sets them.
- Owns
- The new leader takes the decision where the published rule names the Head of Information Security, and tells the named person afterwards.
- Shares
- The new leader takes the decision after asking the named person for a view, in writing. The published approvers are unchanged.
- Escalates
- The new leader does not take the decision alone. They bring it to the named person, who may take it only where the published rule gives them the right, and who otherwise gives a view.
DE-01 Policy
Who decides under the ruleExecutive management approves a Policy-tier document. The Head of Information Security approves a Standard and a Procedure. (P04 PF-03)
- Days 1 to 30
- Escalates
- Days 31 to 60
- Shares
- Days 61 to 90
- Owns
These modes are the new leader's rights over a Standard and a Procedure. A Policy-tier document stays with executive management in every window. You ask: Executive sponsor.
DE-02 Exception
Who decides under the ruleThe approver for the band: control owner (Low), Head of Information Security (Medium), Head of Information Security with the accountable executive (High), the board or its equivalent (Critical). Nobody approves an exception they requested or a risk they own. (P02 EX-05)
- Days 1 to 30
- Shares
- Days 31 to 60
- Owns
- Days 61 to 90
- Owns
The first decision on an inherited exception is a review, not a new approval (TR-07). You ask: Executive sponsor.
DE-03 Risk acceptance
Who decides under the ruleThe approver for the band of the residual risk: risk owner, with the Head of Information Security from Medium, the accountable executive from High, the board or its equivalent at Critical. Outside tolerance only the board or its equivalent. (P05 RM-08)
- Days 1 to 30
- Escalates
- Days 31 to 60
- Shares
- Days 61 to 90
- Owns
The new leader accepts no new risk in the first 30 days. Each goes to the accountable executive and the sponsor. For a Low-band acceptance the approver is the risk owner (P05 RM-04), so the new leader is not an approver in any window. You ask: Executive sponsor.
DE-04 Incident decision
Who decides under the ruleAs P09's decision rights say: the incident manager, the executive incident lead, the communications lead and the board, by decision. (P09)
- Days 1 to 30
- Owns
- Days 31 to 60
- Owns
- Days 61 to 90
- Owns
Unchanged in every window. The new leader takes only what P09 gives the Head of Information Security, and confirms the role holders and deputies in week 1 (TR-09). You ask: Executive sponsor.
DE-05 Supplier
Who decides under the ruleEach supplier assessment ends in a documented decision (Approve, Approve with conditions, Escalate, Reject); a supplier outside appetite goes to the risk register (P06 TP-06). (P06 TP-05)
- Days 1 to 30
- Escalates
- Days 31 to 60
- Shares
- Days 61 to 90
- Owns
Renewals already due are decided by the contract owner as before, with the new leader's view. You ask: Executive sponsor.
DE-06 Spend
Who decides under the rulewho may commit money, up to what limit. No earlier pack sets spending authority. (the organisation's own authority limits)
- Days 1 to 30
- Escalates
- Days 31 to 60
- Shares
- Days 61 to 90
- Owns
Owns means up to the limit the sponsor has set in writing. You ask: Executive sponsor.
DE-07 Hiring
Who decides under the rulewho may open, fill or end a post. No earlier pack sets hiring authority. (the organisation's own authority limits)
- Days 1 to 30
- Escalates
- Days 31 to 60
- Escalates
- Days 61 to 90
- Shares
Changes to the team structure wait for the Decide phase (TR-01). You ask: Executive sponsor.
DE-08 Regulator contact
Who decides under the ruleContact with the competent authority and the CSIRT as the organisation sets it named contact. A decision to report an incident to an authority stays with P09's executive incident lead, on the incident manager's screen. (P12 NR-02)
- Days 1 to 30
- Escalates
- Days 31 to 60
- Shares
- Days 61 to 90
- Owns
Owns covers routine contact. A reporting decision is P09's and P18's, unchanged. You ask: Legal.
Underlined values are the pack's defaults: your organisation sets its own when it adopts the document.
This page shows what the pack's matrix assigns to a role. It records nothing about who holds a role in your organisation.