How do I hand over the function when I leave?

Start

I am leaving, and someone else will run the security function

The pack's idea is to learn before promising and to decide who decides. Your part is to make that possible: say what you hold, what you have promised and what is open, and check the account of it yourself. A short, honest handover with its gaps marked is worth more than a long one that hides them.

• Then: Confirm with HR and Legal what you must hand over, and by when

Step

Confirm with HR and Legal what you must hand over, and by when

What an outgoing leader must hand over, and whether they can be asked for help after the last day, depends on the contract and any leaving agreement. HR confirms the departure date and notice terms. Legal confirms the duty and decides how any later request is made. Nothing in the pack is advice on employment.

• Then: Is a successor, or an interim, starting before your last day?

Decision

Is a successor, or an interim, starting before your last day?

The form is completed by you and checked by the person who takes over. If nobody is named yet, or you do not know the start date, answer no. The route then names someone to receive the form so that it does not wait for a new leader.

• Yes: List every account, token, secret and portal login only you hold
• No, or not known: Ask the executive sponsor to name who receives the form

Step

Ask the executive sponsor to name who receives the form

Judgement, not a pack rule: the pack covers a new leader who has started, or one who builds the form from records after you have gone. Where no successor exists, ask the executive sponsor to name one person to receive it, hold the records and sign for receipt, so that it is not left on a shared drive. That person need not be security staff.

• Then: List every account, token, secret and portal login only you hold

Step

List every account, token, secret and portal login only you hold

Start here, because access is the section that cannot wait. List each account, administrator right, token, shared secret and vendor portal login you hold or alone know, including any personal account used for work. Write where a secret is held and how it passes on. Never write a password, token or key in the form.

• Then: Is any incident, or any reporting duty, still open?

Decision

Is any incident, or any reporting duty, still open?

Include incidents closed in the last 12 months whose review is not done. If you cannot tell from the incident log, answer yes. An open incident or an unmet reporting duty dropped at a handover is one of the pack's named risks.

• Yes, or not known: List each one, with the incident manager and the deputy
• No, after checking: List open risks, exceptions, promises and critical suppliers

Step

List each one, with the incident manager and the deputy

Name who holds each incident role and who deputises, and list what is still open. Do not restate roles, decision rights, severities or clocks. Those belong to the incident packs and the handover changes none of them. The new leader confirms the holders in writing in week 1.

• Then: List open risks, exceptions, promises and critical suppliers

Step

List open risks, exceptions, promises and critical suppliers

Fill HD-03, HD-04, HD-06 and HD-07. Include verbal promises and anything you track in your own notes. Where a section is empty, write None with the date and the name of the person who says so. A blank section counts as a gap, and a promise to a customer goes in even if a tracker also holds it.

• Then: Is any exception or risk acceptance past its review date?

Decision

Is any exception or risk acceptance past its review date?

Check the review date on each entry in HD-04. If you have not checked, answer yes. Inherited items past their date are a named risk. The new leader reviews them within the first period, and nothing continues by default.

• Yes, or not known: Mark it past review, and leave the decision with its approver
• No, after checking: Complete scope, roles, contacts, programme state and calendar

Step

Mark it past review, and leave the decision with its approver

Judgement: do not renew items in your last days to clear the list. Mark each one in the past-review column and say what you know. The approver is set by the band (P02 EX-05, P05 RM-08), and nobody approves an exception they requested. The new leader takes the decision only where the published rule names the Head of Information Security.

• Then: Complete scope, roles, contacts, programme state and calendar

Step

Complete scope, roles, contacts, programme state and calendar

Fill HD-01, HD-02, HD-08, HD-10 and HD-11. None is not an acceptable answer in these: if a section is empty, say what is missing and who was asked. Include the regulator, the insurer and the responders with named contacts, every date due in the next 90 days, and each role and delegation you hold. Introduce the new leader to the contacts. They confirm each by a call.

• Then: Can you complete every section before your last day?

Decision

Can you complete every section before your last day?

Complete means each section lists entries, or says None with a date and a name where None is allowed. If you cannot say, answer no. Admitting a gap early lets the new leader plan for it. Hiding one leaves them to find it.

• Yes: Does the organisation come under NIS2, as counsel confirms?
• No, or not known: Mark open sections Partial, with the date the rest is due

Step

Mark open sections Partial, with the date the rest is due

Say which sections are incomplete, who you asked and when the rest will follow. Until it arrives the section counts as partial. Agree with HR and Legal how you can be asked after you leave, because whether you can be asked depends on your contract. Early, polite questions are often answered.

• Then: Does the organisation come under NIS2, as counsel confirms?

Decision

Does the organisation come under NIS2, as counsel confirms?

Whether an organisation is an essential or an important entity is for counsel to confirm, so the form makes no claim. If counsel has not said, answer yes. The reason is NIS2 Article 20: it asks the management body to approve the cybersecurity risk-management measures and to oversee their implementation.

• Yes, or not known: Ask the sponsor to tell the management body the leader is changing
• No, as counsel confirms: Go through the form with the receiver, then both sign

Step

Ask the sponsor to tell the management body the leader is changing

Through the executive sponsor, the management body is told that the head of security has changed and what has been handed over. It is the board, a board committee or the management board, whichever governs your organisation, or executive management where there is no board. Counsel confirms what this means for the management body's liability. Open notifications and the registration with the authority go in HD-05 and HD-08.

• Then: Go through the form with the receiver, then both sign

Step

Go through the form with the receiver, then both sign

Book an hour or two to walk through it. Sign HD-12 only when the gaps are listed and dated. Signing records that the form was handed over. It does not say every entry is true. The new leader treats each entry as Described only until they have seen a record, a test or a system view. If you have gone before the walk-through, the new leader builds the form from records and writes down what is missing.

• Then: On your last day, IT removes your access

Step

On your last day, IT removes your access

Your accounts, administrator rights, tokens, shared secrets, vendor portals and any personal account used for work end that day. The Head of IT does the removal and the new leader answers for it. Hand over where each secret is held before you go, so that rotating it does not break a service.

• Then: Does a fresh extract still show any account of yours?

Decision

Does a fresh extract still show any account of yours?

Within the pack's default of 2 working days, a fresh extract of accounts and privileged rights is compared with your HD-09 list and the HR leaver record. If nobody has taken one yet, answer yes. Ask each system owner for any account only you knew.

• Yes, or not known: Remove what remains, then confirm again
• No: Handed over: the form is signed, gaps are dated and access is gone

Step

Remove what remains, then confirm again

Remove each remaining account, right, token or portal login, and rotate any secret you knew. Then take another fresh extract. Repeat until it shows nothing of yours.

• Then: Does a fresh extract still show any account of yours? (back to an earlier step)

Outcome

Handed over: the form is signed, gaps are dated and access is gone

The new leader now checks each section against a record, a test or a system view, and each gap that needs work becomes a plan item. Your involvement ends here unless your contract and Legal agree that you can be asked about gaps.