Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

How do we…

How do I decide who to interview first, and what to ask?

7 decision pointsThe pack behind this answer: CISO Transition, Handover & First 90 Days

Add to board memo

The short answer

Recommendation
Interview the executive sponsor first, then follow the pack's order through all ten stakeholder groups by the end of week 4. Ask everyone the same four core questions in the same order, then their group's three, and promise nothing you have not checked.
Reasoning
The sponsor opens the doors to the other executives and the management body. The same questions in the same order let you compare what groups say and see who agrees. The team, IT, audit and the business owners know how the programme really runs, so hearing only the executives misses most of it. What you hear stays Described only until you have seen proof.
Considerations
  • The pace, about 45 minutes per interview and the note within 2 working days are the pack's defaults. Your own plan may change them.
  • The pack is silent where one person speaks for several groups, or someone you need is leaving soon. Judgement: hold one meeting with a record per group, or bring that interview forward.
  • The records name people and hold their opinions. Your data protection officer and counsel confirm how they are kept and what you may promise about confidentiality.
  • Never agree to hide a legal duty, a safety matter or an open incident. Take it to the right route the same day.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
  • Loop back
StartYou are new and must hear from ten stakeholder groupsStepName one person for each of the ten groupsDecisionDoes one person speak for more than one group?StepJudgement: one meeting, one record per groupStepInterview the executive sponsor firstDecisionIs anyone you need leaving, or hard to reach, soon?StepJudgement: bring that interview forwardStepFollow the pack's order of groupsStepBook it: say you are new and are listeningDecisionIs the person nervous, or guarded?StepAsk the four core questions in the same orderStepAsk the group's three questions, and ask to see proofDecisionDid they raise a legal duty, safety matter or open incident?StepTake it to the incident or legal route todayDecisionDid they ask you to agree to something?DecisionSmall, clearly needed, low risk, and checked?StepRecord Committed, and say how you checkedStepRecord Noted not committed, or Declined, with the reasonStepWrite the record the same working dayStepSend them a note of what you heardDecisionAre all ten groups heard?OutcomeAll ten groups heard: take the records into discovery

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 22 steps.

  1. Start

    You are new and must hear from ten stakeholder groups

    The pack asks for an interview with every stakeholder group by the end of week 4, each using the same core questions. Interview before judging. The groups that know how the programme really runs matter as much as the executives.

    In the pack

  2. Step

    Name one person for each of the ten groups

    The ten groups are executive, board or its chair, IT, legal, HR, finance, business owners, suppliers, audit and the team. Write down the person for each in your organisation. Where a group has no obvious person, ask the executive sponsor who speaks for it.

    In the pack

  3. Decision

    Does one person speak for more than one group?

    Small organisations often have one person who holds legal and HR, or IT and finance. The pack does not say how to count that. Judgement: hold one interview, ask the questions of each group they cover, and keep one record per group so that the count of groups still means something.

    In the pack

  4. Step

    Judgement: one meeting, one record per group

    This is a judgement, not a pack rule. Allow more time than the usual default of about 45 minutes. Ask the four core questions once, then each group's three questions in turn. Write a separate record for each group so the counts of groups interviewed stay honest.

    In the pack

  5. Step

    Interview the executive sponsor first

    The sponsor is the first interview. They open the doors to the other executives and the management body, and agree what you may say to each. Ask what they expect in 90 days, what worries them and what was promised.

    In the pack

  6. Decision

    Is anyone you need leaving, or hard to reach, soon?

    The pack sets an order but does not say what to do when a key person is about to go. Judgement: a person who holds knowledge that exists nowhere else, such as the outgoing leader or a supplier contact, should be heard before the table's order if they will not be available later. If it is not known, take the cautious branch.

    In the pack

  7. Step

    Judgement: bring that interview forward

    This is a judgement. Hear that person early, with the same four core questions, and record it in the same format. The rest of the order does not change. Where the outgoing leader is still at work, they can also say what each group was promised.

    In the pack

  8. Step

    Follow the pack's order of groups

    Executives come in weeks 1 and 2, and the chair of the management body in week 2. IT, legal, HR and finance follow in week 2. Business owners, audit and the team come in week 3. Book the critical suppliers in week 3 and meet them in week 4. The pack's pace is a default that your own plan may change.

    In the pack

  9. Step

    Book it: say you are new and are listening

    Say in the invitation that you are new, that you are listening, and that you will ask for the documents you need to see. Allow about 45 minutes. Read what the person's group has sent you, and do not read the last leader's views of them first. Say who may read the record. Counsel confirms what you may promise about confidentiality.

    In the pack

  10. Decision

    Is the person nervous, or guarded?

    The fourth core question lets a nervous person help you without judging anyone. Do not ask the outgoing leader or a predecessor's favourite to sit in. People speak more openly to a new leader alone, or with one colleague of their own choosing.

    In the pack

  11. Step

    Ask the four core questions in the same order

    The four questions are: what they expect from the security function and how they would know it is doing well; what worries them most; what has been promised to them and is still open; and who else you should talk to and what to read first. If the person is nervous, judgement: start with the last, which lets them help without judging anyone, then ask the other three in order. The third question finds the promises nobody wrote down. Write each in the person's words and say who made it.

    In the pack

  12. Step

    Ask the group's three questions, and ask to see proof

    Each group has three questions, a thing to listen for and a thing to ask to see. For example, ask IT where the lists of systems, accounts and backups live, and ask to see them. When someone says a thing is done, ask where you can see it, and write down what they offer, even if you cannot look today.

    In the pack

  13. Decision

    Did they raise a legal duty, safety matter or open incident?

    Never agree to hide something. If a person tells you of a legal duty, a safety matter or an open incident, take it to the right route the same day. The incident route is your incident response plan, whose decisions and clocks the pack does not restate. Not known takes the cautious branch.

    In the pack

  14. Step

    Take it to the incident or legal route today

    Do not hold it back until the record is written. Notification decisions and clocks belong to the incident response plan and its reporting screen, which the interview does not change. Ask counsel what you may say to the person who raised it. Then finish the interview and keep the record.

    In the pack

  15. Decision

    Did they ask you to agree to something?

    People will ask you to agree on the spot, to a date, a budget, a rule change or a result. Agree to nothing in the room. Say that you will note it and check whether it can be kept. A promise made in week 2 rests on what you were told.

    In the pack

  16. Decision

    Small, clearly needed, low risk, and checked?

    The pack allows Committed in the room only for a small task that is clearly needed and carries little risk, once you have checked that you have the time. If it is not known, take the other branch.

    In the pack

  17. Step

    Record Committed, and say how you checked

    Committed means you have checked that you can keep it, and you say how. Nothing else is Committed. Put the action in the follow-up with its owner and due date.

    In the pack

  18. Step

    Record Noted not committed, or Declined, with the reason

    Use Noted, not committed for a request you have not yet checked, and say what you will check and when you will answer. Use Declined when you cannot or will not do it now, with the reason. Spend, for example, is Declined until discovery shows what is used. A date, a budget or a result waits until the plan is agreed.

    In the pack

  19. Step

    Write the record the same working day

    Use the six fields: who and when, expectation, concern, commitment, follow-up and sent back. Write their words, and put your own reading on a separate line marked as yours. A statement is Described only until you have seen a record, a test result or a system view. Where two groups disagree, record both accounts and let the discovery workbook settle it from proof.

    In the pack

  20. Step

    Send them a note of what you heard

    The pack's default is within 2 working days. The note says what you heard and asks them to correct it. It promises nothing new, and it names a commitment only if it is Committed. It is how a person corrects you and learns you listened.

    In the pack

  21. Decision

    Are all ten groups heard?

    The count to keep is groups interviewed, out of 10. The pack's deadline for holding every interview is the end of week 4. If it is not known, count the group as not yet heard. Past the end of week 4 with groups missing, judgement: tell the executive sponsor which are missing and why, and book them next.

    In the pack

  22. Outcome

    All ten groups heard: take the records into discovery

    Tell each group what you heard once the interviews end. Open the proof you were offered and enter what you see in the discovery workbook, starting with the areas the interviews raised. Keep the records, which name people, where only you and those you name can open them.

    In the pack

    See also

Practical checklist

  1. Name one person for each of the ten groups, and ask the sponsor who speaks for any group without an obvious person.
  2. Interview the executive sponsor first, and bring forward anyone who holds knowledge that exists nowhere else and will not be available later.
  3. Book each interview in the pack's order, saying you are new and listening, and do not read the last leader's views of the person first.
  4. Ask the four core questions in the same order, then the group's three questions, and ask where you can see anything described as done.
  5. Agree to nothing in the room: record a request as Committed only once checked, otherwise Noted, not committed or Declined with the reason (rule TR-04).
  6. Write the record in the six fields the same working day, keeping the person's words apart from your own reading.
  7. Send each person a note of what you heard, ask them to correct it, and promise nothing new.
  8. Count the groups heard out of ten, and tell the sponsor which are missing if any remain after week 4.

Evidence to have ready

  • An interview record for each group in the six fields, written the same working day.
  • The interview log with groups interviewed out of 10, and the date each note was sent back.
  • The commitments list: each request's word, how each Committed one was checked, and its follow-up owner and due date.

Assumptions

  • You have just taken over a security function and discovery has not ended, so you are listening and changing nothing yet.
  • You have an executive sponsor, or someone who can open doors to the other groups for you.
  • The pack's timings, such as the end of week 4 and the 2-working-day note, are its defaults. Your own plan may set others.
  • The records name people. Your data protection officer and counsel confirm how they are kept and what you may promise.

Not covered here