Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

Who decides…

Which decisions can I make myself in my first months, and which do I share or escalate?

9 decision pointsThe pack behind this answer: CISO Transition, Handover & First 90 Days

Add to board memo

The short answer

Recommendation
Find the rule that gives each right before you decide. Keep incident decisions with the incident plan, Policy-tier documents with executive management, and exceptions and risk acceptances with their band's approvers. Agree the rest in writing with the executive sponsor as escalate, share or own across the first 90 days.
Reasoning
The risk in the first months is taking a decision that belongs to someone else, or one you have not checked. Each right is set by an earlier pack's rule. The transition arrangement can only hold you back or ask for another person's view, and never gives a right that rule does not give. Agreeing it in writing stops a decision being taken twice, by the wrong person or not at all.
Considerations
  • The three modes, the windows and the 10 working days are the pack's defaults. Your sponsor may set others. Where a regulator or the law expects the management body to approve more, move that decision to escalate, never the right itself.
  • Critical items go to the board, or a board risk committee it has delegated to; the management board in a two-tier structure; or executive management where there is no board.
  • Spending and hiring limits are the organisation's own. No earlier pack sets them, so escalate until the sponsor names your limit in writing.
  • Nobody approves an exception they requested or one to a control they operate, a risk they own, or a document they own or wrote.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartA decision lands on you in your first monthsDecisionIs a written arrangement agreed with the executive sponsor?StepAgree it now. Meanwhile use the pack's days 1 to 30 columnDecisionIs it an incident decision?OutcomeTake what the incident plan gives you, nothing moreDecisionIs it approving or withdrawing a Policy-tier document?OutcomeEscalate: it stays with executive managementDecisionIs it an exception or a risk acceptance?StepIf it was granted before you started, review it within 30 daysDecisionIs it a risk acceptance, rather than an exception?DecisionAre you past day 30?OutcomeDo not accept it: take it to the accountable executiveDecisionIs it rated High or Critical, or is the rating not known?OutcomeEscalate: you take part, you do not decide aloneOutcomeDecide it as the band's approver, after the sponsor's viewDecisionIs it a standard, procedure, supplier or regulator decision?DecisionWhich window of the 90 days are you in?OutcomeEscalate: bring it to the sponsor, or legal for regulator contactOutcomeShare: ask for a view in writing, then decideOutcomeOwn it: decide, then tell the named personOutcomeUse the organisation's own limits: ask the sponsor to name them

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 21 steps.

  1. Start

    A decision lands on you in your first months

    The risk in the first months is taking a decision that belongs to someone else, or one you have not yet checked. Each decision has a rule in an earlier pack that says who decides. The transition arrangement only holds you back or asks another person for a view. It never gives you a right that rule does not give.

    In the pack

  2. Decision

    Is a written arrangement agreed with the executive sponsor?

    The arrangement says, for each type of decision and each window of the 90 days, whether you own it, share it or escalate it. The pack's default is to agree it in writing within 10 working days of the start, and to review it at day 30, 60 and 90. Your own standard may set a different limit. If it is not agreed, or you do not know, take the cautious branch.

    In the pack

  3. Step

    Agree it now. Meanwhile use the pack's days 1 to 30 column

    Judgement, not a pack rule: until the sponsor has agreed the arrangement, work to the pack's default column for the first 30 days, which is the most cautious. Take the filled-in matrix to the sponsor, change what the organisation does differently, and get the agreement in writing. Spending and hiring limits are the organisation's own and need the sponsor to name them.

    In the pack

  4. Decision

    Is it an incident decision?

    Incident decisions are the incident plan's in every window. You take only what the plan gives the Head of Information Security. The plan lists who decides to isolate a system, stop a service, report to an authority, speak outside the organisation or deal with a ransom demand. Yes, or not sure whether the matter is an incident, takes the incident branch.

    In the pack

  5. Outcome

    Take what the incident plan gives you, nothing more

    Open the incident plan's decision rights, not the transition matrix. In week 1, list the open incidents and open reporting duties, and confirm in writing who holds each incident role and who deputises. Change no role and no decision right in a crisis. A change waits for the plan's own review. Waiting for an executive is never a reason to let harm spread.

    In the pack

  6. Decision

    Is it approving or withdrawing a Policy-tier document?

    The pack's matrix quotes the earlier rule: executive management approves a Policy-tier document, and the Head of Information Security approves a Standard and a Procedure. An approver of a higher tier may approve a lower one, never the reverse. Nobody approves a document they own or wrote.

    In the pack

  7. Outcome

    Escalate: it stays with executive management

    A Policy-tier document stays with executive management in every window of the 90 days. Bring your reasons to the sponsor. The top policy is approved by the board or its equivalent, which depends on how your organisation is governed. Leave policies, standards and procedures alone until the Decide phase in week 8, as the pack advises. Discovery gives you the reasons that a change needs.

    In the pack

  8. Decision

    Is it an exception or a risk acceptance?

    An exception allows a deviation from a control for a fixed time. A risk acceptance records that a risk is carried at its residual rating. They have different approvers, set by an earlier pack for each band. If it is neither, move on.

    In the pack

  9. Step

    If it was granted before you started, review it within 30 days

    Read the reason, the date and who approved it. An item past its review date is renewed, changed or closed by the approver its band sets. Nothing continues by default. The first decision on an inherited exception is a review, not a new approval. Do not renew one without reading it.

    In the pack

  10. Decision

    Is it a risk acceptance, rather than an exception?

    The matrix treats them differently in the first 30 days. You take no new risk acceptance in that time. An exception may be decided in the first 30 days after you have the sponsor's view. Not sure which it is: a deviation from a control with an end date is an exception, a risk carried as it stands is an acceptance.

    In the pack

  11. Decision

    Are you past day 30?

    The pack's default window for taking no new risk acceptance on your own runs to day 30, counted from your first day as day 1. Your own arrangement may differ. Not sure of the day: the first-90-days workbook counts it from your start date.

    In the pack

  12. Outcome

    Do not accept it: take it to the accountable executive

    In the first 30 days, a new risk acceptance goes to the accountable executive and the sponsor, whatever the band. You ask, you do not decide. Judgement: you may still give your view on the risk and its rating. The risk owner and the band's approvers are unchanged.

    In the pack

  13. Decision

    Is it rated High or Critical, or is the rating not known?

    The band decides who approves. High needs both the Head of Information Security and the accountable executive. Critical goes to the board or its delegated risk committee, to the management board in a two-tier structure, or to executive management where there is no board. An unrated item takes the higher branch. Nobody approves what they requested, own or operate.

    In the pack

  14. Outcome

    Escalate: you take part, you do not decide alone

    For a High item, you and the accountable executive both approve. For Critical, the top body for your governance decides, on your recommendation. For a risk acceptance outside appetite, executive management signs as well, and outside tolerance only the board or its equivalent may accept. Bring it with options and a recommendation. Counsel confirms what the management body's duties mean.

    In the pack

    See also

  15. Outcome

    Decide it as the band's approver, after the sponsor's view

    Judgement on the order: ask the sponsor for a view in writing first, then decide. Exceptions: share until day 30, own from day 31. Risk acceptances: share from day 31 to 60, own from day 61. Low items are approved by the control owner or risk owner, not you. A Medium risk acceptance needs the risk owner as well as you. Tell the named person afterwards. Do not approve what you requested or operate; it goes up a level.

    In the pack

  16. Decision

    Is it a standard, procedure, supplier or regulator decision?

    These follow the same three modes. A Standard or Procedure is approved by the Head of Information Security. A supplier assessment ends in a documented decision. Routine contact with the regulator or the CSIRT is set by the organisation. A decision to report an incident is the incident plan's, not this branch.

    In the pack

  17. Decision

    Which window of the 90 days are you in?

    The pack's matrix runs to day 90, counted from your first day as day 1. Day 90 is also a review of the arrangement, so decide with the sponsor what follows. Judgement: after day 90, use the third window until that review says otherwise.

    In the pack

  18. Outcome

    Escalate: bring it to the sponsor, or legal for regulator contact

    Do not decide alone. Bring it to the named person, who may take it only where the published rule gives them the right. Otherwise they give a view. Renewals already due stay with the contract owner, with your view.

    In the pack

  19. Outcome

    Share: ask for a view in writing, then decide

    Take the decision after asking the named person for a view in writing. The published approvers are unchanged. Keep the answer with the decision. Do not promise a date, budget or result outside the organisation before the plan is agreed.

    In the pack

  20. Outcome

    Own it: decide, then tell the named person

    Take the decision where the published rule names the Head of Information Security, and tell the named person afterwards. Routine regulator contact is covered. A decision to report an incident is not.

    In the pack

  21. Outcome

    Use the organisation's own limits: ask the sponsor to name them

    No earlier pack sets spending or hiring authority, and none covers other decisions this list leaves out. Judgement: escalate until the sponsor names your limit in writing. Spending: share from day 31, own up to the limit from day 61. Hiring: escalate to day 60, share after. Team structure waits for week 8.

    In the pack

Practical checklist

  1. Agree the arrangement in writing with the sponsor and review it at day 30, 60 and 90. Until it is agreed, work to the days 1 to 30 column.
  2. Send any incident decision to the incident plan's decision rights, and take only what it gives the head of information security.
  3. Escalate any approval or withdrawal of a Policy-tier document to executive management, in every window.
  4. Review each inherited exception and risk acceptance within 30 days, by the approver its band sets (rule TR-07).
  5. Take no new risk acceptance alone in the first 30 days; send it to the accountable executive and the sponsor.
  6. Take High, Critical or unrated items higher: you take part, you do not decide alone. Decide a Medium item as the band approver with any co-approver it names, asking the sponsor while you share.
  7. For standards, procedures, supplier and regulator decisions, escalate in days 1 to 30, share in days 31 to 60 and own from day 61.
  8. Tell the named person after each decision you own, and keep any written view you asked for with the decision.

Evidence to have ready

  • The decision-rights arrangement agreed in writing with the sponsor, and the date of each review.
  • The inherited exceptions and risk acceptances, with the decision on each, its approver and its date.
  • For each shared decision, the written view you asked for, kept with the decision.
  • The sponsor's written spending and hiring limits.

Assumptions

  • You are new to the head of security or CISO role, or you are the leader handing it over, and an executive sponsor exists.
  • The earlier packs' approvers apply in your organisation, or your own standard names its equivalents. Check who approves what in your own documents first.
  • The three modes and the 10 working days are the pack's defaults. Your sponsor may set different ones.
  • You do not yet know the programme well, so what you were told is not yet a finding.

Not covered here