If my predecessor left without a handover, then how do I rebuild what I need?

Start

Your predecessor has gone and left no handover

A function with no handover is not a function with no records. The risks, exceptions, incidents, contracts and accounts exist somewhere, and so do the people who know them. The task is to rebuild the handover from those records and write down what is missing. Start in week 1 and do not wait for anyone to produce it.

• Then: Change nothing and promise nothing yet

Step

Change nothing and promise nothing yet

You do not yet know what is real, so a promise or a change rests on what you were told. Until discovery ends, change no policy, tool, team structure or priority, except to stop harm, act on a legal duty or take a no-regret action. Promise no date, budget or result to executives, customers, auditors or regulators until you have checked it can be kept.

• Then: Is their access removed, and checked against a fresh extract?

Decision

Is their access removed, and checked against a fresh extract?

Accounts, administrator rights, tokens, shared secrets, vendor portals and any personal account used for work can stay live after a leaver. The pack's default is removal on the day they leave and confirmation against a fresh extract within 2 working days. Where nobody can show the extract, answer no.

• Yes, and checked: Is any incident or reporting duty open, or not known?
• No, or not known: Remove it now and take a fresh extract to confirm

Step

Remove it now and take a fresh extract to confirm

Ask each system owner, or the head of IT where that is who holds them, to remove the accounts, rights, tokens and portal logins, and to give you an extract taken after the removal. Check the identity system, the vendor portal admin lists and the password manager's shared vaults, because secrets known only to the predecessor are the ones that get missed. Keep the extract as the record.

• Then: Is any incident or reporting duty open, or not known?

Decision

Is any incident or reporting duty open, or not known?

Read the incident log and the post-incident reviews, and ask the incident responders and legal. An incident or a notification dropped at a handover is one of the costliest gaps. If you cannot tell whether one is open, take the yes branch.

• Yes, or not known: Confirm who holds each incident role, in writing
• No, and checked: Start the handover document from records, section by section

Step

Confirm who holds each incident role, in writing

List each open incident and reporting duty, and confirm in writing who holds each incident role and who deputises. The roles, decision rights and clocks stay as the incident plan sets them. Do not change who decides during a live incident, and do not take a right the plan does not give the head of security.

• Then: Start the handover document from records, section by section

Step

Start the handover document from records, section by section

Use the twelve sections of the handover form as the checklist, and mark each Built from records. The risk and exception registers, incident log, correspondence with customers, auditors and regulators, the supplier register, the identity system and the board calendar each answer a part. Say who was asked for what the records do not show.

• Then: May you ask the predecessor for help, and has Legal said how?

Decision

May you ask the predecessor for help, and has Legal said how?

Whether a departed leader may be asked to help depends on their contract and any agreement on leaving. HR and Legal confirm that, and Legal decides how to ask. This pack gives no employment advice. If nobody has confirmed it, answer no and ask others first.

• Yes: Put short written questions to them, and ask others too
• No, or not known: Ask their manager, team and colleagues instead

Step

Put short written questions to them, and ask others too

Many outgoing leaders will answer a short question after they have left, if asked politely and early. Keep each question narrow, such as who holds a supplier relationship or where a record is kept. Still ask their manager, their team and the people who worked with them, and do not blame the predecessor in front of others.

• Then: Fill the sections that cannot wait: contacts and promises

Step

Ask their manager, team and colleagues instead

The people who built the programme know the most. Ask the manager, the team and the people who worked with the predecessor, and note who said what. Record what you find, not who is to blame. Revisit the predecessor once Legal and HR have said how to ask.

• Then: Fill the sections that cannot wait: contacts and promises

Step

Fill the sections that cannot wait: contacts and promises

Start with the regulator, the CSIRT, the insurer, the responders and the critical suppliers, and confirm each contact by a call, not from a list. The pack's default is within 30 days. Then list what the organisation has promised to regulators, customers and auditors, and note each as Noted, not committed until you have checked it can be kept.

• Then: Is an inherited exception or acceptance past review, or unapproved?

Decision

Is an inherited exception or acceptance past review, or unapproved?

List every inherited exception and risk acceptance with its band, approver and review date. Where an approver is not recorded or the review date has passed, answer yes. Nothing continues by default, so read each approval before you rely on it.

• Yes, or not known: Have the band's own approver renew, change or close it
• No, and checked: Can a named person say a section has nothing to list?

Step

Have the band's own approver renew, change or close it

The pack's default is a review within 30 days of the start. Each item goes to the approver its band sets, as the exception and risk-acceptance rules say, and nobody approves what they requested or own. Accept no new risk yourself in the first 30 days under the pack's arrangement; take it to the accountable executive and the sponsor.

• Then: Can a named person say a section has nothing to list?

Decision

Can a named person say a section has nothing to list?

None is an acceptable answer only for risks, exceptions, incidents, commitments and suppliers, and only with a date and the name of the person who said it. For roles, contacts, access, programme state and the calendar, an empty section is a gap. If nobody can say it, answer no.

• Yes: Write None, with the date and who said so
• No, or not known: Mark the section Missing or Partial, and who was asked

Step

Write None, with the date and who said so

Use None for a section where it is allowed, once a named person with knowledge has said so. Do not infer it from silence in the records. Your own reading of an empty register is not a statement from someone who would know. The date and the name are what make it checkable.

• Then: Check what you built against a record, test or system view

Step

Mark the section Missing or Partial, and who was asked

A gap that is written down can be planned for, and a gap that is hidden cannot. Mark the section Missing or Partial, with what you asked, of whom and when. Do not guess a value to fill a section, and do not leave it blank.

• Then: Check what you built against a record, test or system view

Step

Check what you built against a record, test or system view

The handover document is what someone believed, or what the records suggest. Treat a statement alone as Described only, and move on to Evidenced only when you have seen a record, a test result or a system view. Use the discovery workbook for the ten areas, starting with those the interviews raised.

• Then: Might NIS2 apply to the organisation, or is that not known?

Decision

Might NIS2 apply to the organisation, or is that not known?

NIS2 Article 20 asks the management body to approve the cybersecurity risk-management measures, oversee their implementation and follow training. Whether the organisation is an essential or an important entity is for counsel to confirm. If nobody has confirmed it, take the yes branch.

• Yes, or not known: Tell the management body through the sponsor that the leader changed
• No, confirmed: Are all twelve sections complete and the form signed?

Step

Tell the management body through the sponsor that the leader changed

In a regulated entity, tell the management body promptly, through the executive sponsor, that the head of security has changed and what has been handed over. Counsel confirms what this means for the liability of its members. Registration with the authority and open notifications belong in the incident and contacts sections.

• Then: Are all twelve sections complete and the form signed?

Decision

Are all twelve sections complete and the form signed?

Count the sections as complete or not, for example 9 of 12 complete, and list the gaps by kind: Missing, Partial, access not confirmed removed and not signed. A predecessor who has gone cannot sign. Judgement: leave that section Not signed and say why, rather than signing on their behalf. Where it is a gap, carry it into the plan.

• Yes: Handover rebuilt: keep it and review at days 30, 60 and 90
• No, or not known: Carry each gap into the 100-day plan as an item

Outcome

Carry each gap into the 100-day plan as an item

Every plan item names its source, and a handover gap is a source by its section ID. Give each an owner, an effort and a due date. Report the handover as counts of sections complete and gaps by kind. No score. Bring the gaps that need a decision to the first executive briefing, and keep the records for the pack's default retention period.

Outcome

Handover rebuilt: keep it and review at days 30, 60 and 90

Even a complete rebuild is a record of what was believed and what you saw, as at a date. Keep it with the interview records, the decision-rights arrangement and the plan. Review it at day 30, day 60 and day 90, as the checklist asks for the discovery findings and the plan.