Guidance · CISO
If you lead the security function
You own the security decisions the packs give the Head of Information Security, and you carry the rest to the people who own them.
The decisions you'll be asked to make
Who decides…
Which decisions can I make myself in my first months, and which do I share or escalate?Find the rule that gives each right before you decide. Keep incident decisions with the incident plan, Policy-tier documents with the board or its equivalent (the top policy) and executive management (the rest), and exceptions and risk acceptances with their band's approvers.
Who decides…
Who can accept a risk, and does the answer change with its rating?Yes. The residual band sets who signs, and the position against appetite adds signatures on top: executive management as well outside appetite, and only the board or its equivalent outside tolerance or for any Critical risk.
Who decides…
Who approves a Critical exception in an organisation shaped like ours?Name the approver from your structure: the board, or a board risk committee it has delegated this to; the management board in a two-tier structure; executive management where there is no board.
Who decides…
Who decides whether to pay a ransom?Only the board or its equivalent decides whether to pay a ransom, and only once legal advice including a sanctions check, the insurer's view and a report to law enforcement are in place.
Who decides…
Who decides what during a crisis, and who stands in when they cannot?Write down before a crisis a short list of decisions, each with one person accountable and a named deputy.
What you own and what you hand on
From the Transition Decision Rights Matrix P27-A06, in CISO Transition, Handover & First 90 Days.
The pack's default for a new leader: whether you own, share or escalate each kind of decision as the first 90 days pass. The arrangement never gives you a right the rule does not, and incident decisions stay as the incident plan sets them.
- Owns
- The new leader takes the decision where the published rule names the Head of Information Security, and tells the named person afterwards.
- Shares
- The new leader takes the decision after asking the named person for a view, in writing. The published approvers are unchanged.
- Escalates
- The new leader does not take the decision alone. They bring it to the named person, who may take it only where the published rule gives them the right, and who otherwise gives a view.
DE-01 Policy
Who decides under the ruleThe Policy tier's approver, set in the policy framework: for the top policy the board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management, and in a NIS2 or DORA entity the management body. The Head of Information Security approves a Standard and a Procedure. (P04 PF-03)
- Days 1 to 30
- Escalates
- Days 31 to 60
- Shares
- Days 61 to 90
- Owns
These modes are the new leader's rights over a Standard and a Procedure. A Policy-tier document stays with its approver in every window. You ask: Executive sponsor.
DE-02 Exception
Who decides under the ruleThe approver for the band: control owner (Low), Head of Information Security (Medium), Head of Information Security with the accountable executive (High), and for Critical the board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management. Where the exception leaves a risk outside appetite, executive management signs as well, and outside tolerance the board or its equivalent. A residual Severe impact adds the approvers it adds to a risk acceptance (P05 RM-13). The stricter rule always applies. Nobody approves an exception they requested or a risk they own. (P02 EX-05)
- Days 1 to 30
- Shares
- Days 31 to 60
- Owns
- Days 61 to 90
- Owns
The first decision on an inherited exception is a review, not a new approval (TR-07). You ask: Executive sponsor.
DE-03 Risk acceptance
Who decides under the ruleThe approver for the band of the residual risk: risk owner, with the Head of Information Security from Medium, the accountable executive from High, and for Critical the board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management. Outside appetite, executive management signs as well; outside tolerance only the board or its equivalent may accept. A residual Severe impact adds approvers whatever the band (P05 RM-13): executive management, and for the more likely cases the board or its equivalent alone. (P05 RM-08)
- Days 1 to 30
- Escalates
- Days 31 to 60
- Shares
- Days 61 to 90
- Owns
The new leader accepts no new risk in the first 30 days. Each goes to the accountable executive and the sponsor. For a Low-band acceptance the approver is the risk owner (P05 RM-04), so the new leader is not an approver in any window. You ask: Executive sponsor.
DE-04 Incident decision
Who decides under the ruleAs P09's decision rights say: the incident manager, the executive incident lead, the communications lead and the board, by decision. (P09)
- Days 1 to 30
- Shares
- Days 31 to 60
- Owns
- Days 61 to 90
- Owns
P09's decision rights and roles do not change in any window. In days 1 to 30 the new leader shares with the outgoing leader, or with the deputy incident manager where the outgoing leader has gone: they ask for a view before they take a decision that P09 gives the Head of Information Security, and write it up afterwards if the incident cannot wait. The new leader confirms the role holders and deputies in week 1 (TR-09). You ask: Outgoing security leader.
DE-05 Supplier
Who decides under the ruleEach supplier assessment ends in a documented decision (Approve, Approve with conditions, Escalate, Reject); a supplier outside appetite goes to the risk register (P06 TP-06). (P06 TP-05)
- Days 1 to 30
- Escalates
- Days 31 to 60
- Shares
- Days 61 to 90
- Owns
Renewals already due are decided by the contract owner as before, with the new leader's view. You ask: Executive sponsor.
DE-06 Spend
Who decides under the rulewho may commit money, up to what limit. No earlier pack sets spending authority. (the organisation's own authority limits)
- Days 1 to 30
- Escalates
- Days 31 to 60
- Shares
- Days 61 to 90
- Owns
Owns means up to the limit the sponsor has set in writing. You ask: Executive sponsor.
DE-07 Hiring
Who decides under the rulewho may open, fill or end a post. No earlier pack sets hiring authority. (the organisation's own authority limits)
- Days 1 to 30
- Escalates
- Days 31 to 60
- Escalates
- Days 61 to 90
- Shares
Changes to the team structure wait for the Decide phase (TR-01). You ask: Executive sponsor.
DE-08 Regulator contact
Who decides under the ruleContact with the competent authority and the CSIRT as the organisation sets it named contact. A decision to report an incident to an authority stays with P09's executive incident lead, on the incident manager's screen. (P12 NR-02)
- Days 1 to 30
- Escalates
- Days 31 to 60
- Shares
- Days 61 to 90
- Owns
Owns covers routine contact. A reporting decision is P09's and P18's, unchanged. You ask: Legal.
DE-09 Stop or pause
Who decides under the rulewho may stop or pause a release, a project or a system outside an incident, and who may overrule. No earlier pack sets this authority outside an incident. (the organisation's own authority limits)
- Days 1 to 30
- Shares
- Days 31 to 60
- Owns
- Days 61 to 90
- Owns
Ask for this authority in writing in week 1 (WK-02). Inside an incident the right is P09's. You ask: Executive sponsor.
DE-10 Supplier or service termination
Who decides under the rulewho may end a supplier, a managed security service or an outsourced IT contract. No earlier pack sets contract termination authority. (the organisation's own authority limits)
- Days 1 to 30
- Escalates
- Days 31 to 60
- Escalates
- Days 61 to 90
- Shares
P06 sets how a supplier is assessed (P06 TP-05). Ending a contract is the contract owner's decision, with Legal. You ask: Legal.
DE-11 Staff communication
Who decides under the rulewho may send a security instruction or message to all staff. No earlier pack sets this outside an incident. (the organisation's own authority limits)
- Days 1 to 30
- Shares
- Days 31 to 60
- Owns
- Days 61 to 90
- Owns
Messages to the security team are the new leader's own from day 1. In an incident only the communications lead may say anything outside the organisation (the incident pack's decision rights). You ask: Executive sponsor.
DE-12 Direct escalation
Who decides under the rulewho may raise a concern directly with the chair of the audit committee or its equivalent. No earlier pack sets this line. (the organisation's own authority limits)
- Days 1 to 30
- Owns
- Days 31 to 60
- Owns
- Days 61 to 90
- Owns
Ask for this line in writing (BA-4). Owns means you tell the sponsor that you used it, not that you ask first. You ask: Executive sponsor.
Underlined values are the pack's defaults: your organisation sets its own when it adopts the document.
This page shows what the pack's matrix assigns to a role. It records nothing about who holds a role in your organisation.