New Security Leader First 90 Days — Guide

New Security Leader First 90 Days

A new security leader inherits a programme described by other people. Some of it is real, some of it is written down and not done, and some of it is a hope. The first months are for finding out which is which, and for saying little that cannot be kept. Listen first. Check what you hear against a record, a test or a system. Agree in writing who decides what while you learn. Then record where you started, in counts and in words, so that in a year you can show what changed. The result is a baseline and a plan. It is never one score.

Learn before you promise. Find out what is real, not what is claimed. Decide who decides. Show the starting position, so that progress can be shown.

Is this for you?

This pack is for you if:

• you have just started as a head of security, security manager or CISO, and you want to know what to do first, and what to leave alone;
• you are the one leaving, and you want the person after you to find the programme as it really is;
• you have a small team or none, and cannot afford a long assessment before you act;
• people keep asking you for a date, a budget or a plan, and you have not yet seen enough to give one;

It works when you were promoted from inside as well, because you still inherit what your predecessor held.

What is different about a first 90 days

You arrive with authority and no history. People tell you what they believe, and what they think you want to hear. Your first statements will be repeated, and some of them will be held against you. Six things follow.

• Listen before you promise. Spend the first three weeks listening and change nothing, except to stop harm, meet a legal duty or take an action you would take whatever you find (TR-01).
• Check what you are told. A statement is not a finding. Look for a record, a test result or a system view (TR-02).
• Ask everyone, not only the executives. The team, IT, audit and the business owners know how the programme really runs (TR-03).
• Do not assume you hold every right your predecessor held. Earlier packs give each decision right to a named role. Agree in writing what you do with each one while you learn (TR-05).
• Take over what was promised. An open incident, an exception past its review date, an access you forgot to remove or a promise to a customer or a regulator is now yours (TR-07, TR-08, TR-09).
• Record where you started. In a year, nobody can show what changed unless you wrote down the starting position (TR-12).

Before you accept responsibility

Ask these questions before you take on responsibility for security, or in your first week if you have already taken it on. They are questions to put to counsel, the sponsor and the broker. They are practice. None of them says what a law requires, and none is legal advice. Write down each answer and its date, and keep the record (TR-16).

• BA-1. Does the organisation’s directors and officers insurance cover you, if you are not a director? Does it cover what happened before you started? Ask for the policy wording.
• BA-2. Will the organisation give you an indemnity in writing for what you decide in the role? What does it leave out? Ask counsel before you sign anything in your name.
• BA-3. Do you hold written authority to stop a release, a project or a system when you judge the risk too high? Who can overrule you, and is that written?
• BA-4. Who do you report to? Do you have a direct line to the chair of the audit committee or its equivalent? Is that written?
• BA-5. Which claims, legal holds, regulator inquiries or investigations are open and touch security? Ask for the list.
• BA-6. What has already been signed in the name of the security function or of your role? Think of certifications, customer and regulator questionnaires and sub-certifications. Ask for copies, and read them before you sign anything that repeats them.
• BA-7. Is there anything the executives or the outgoing leader know that you would want to know before you accept? Ask for it in writing, and write down the answer and the date.
• BA-8. Can you take advice from counsel on your own position, apart from the organisation’s counsel? Who pays?
• BA-9. Where will you keep a dated record of what you inherited and when it was handed over: these answers, the handover document and the discovery findings? Ask counsel how to keep it.

Do not sign a statement in your own name until you have checked it. If you are asked to sign before you have, ask counsel first (NE-5).

What binds the management body, and what does not

Directive (EU) 2022/2555 is addressed to the Member States, and binds essential and important entities through their national law. Article 20 asks the Member States to ensure that the management body approves the cybersecurity risk-management measures, oversees their implementation, can be held liable for infringements of Article 21, and is required to follow training. What liability means for a member of a management body depends on national law, and counsel confirms it. Whether your organisation is an essential or an important entity comes from its scope assessment and from counsel, and this pack does not decide it.

The NCSC’s Code and toolkit and the ENISA skills framework are voluntary guidance. They are not law. They say what boards might expect and what roles typically do. They do not say what a new security leader must do, and no law named here says how a handover must be run. Following them is not a statement that your organisation complies with NIS2 or any standard.

This pack does not say which document, record or practice meets a requirement of NIS2. Each reference says what its source asks of the management body or the organisation and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.

Natural persons under NIS2. NIS2 Article 32(6) asks Member States to ensure that any natural person responsible for, or acting as a legal representative of, an essential entity on the basis of the power to represent it, the authority to take decisions on its behalf or the authority to exercise control of it has the power to ensure its compliance. It also asks Member States to ensure that it is possible to hold such persons liable for breach of their duties to ensure compliance. Article 33(5) applies that paragraph to important entities. For an essential entity, Article 32(5)(b) goes further. Where enforcement measures prove ineffective and a deadline set by the competent authority passes, the authority may request that the relevant bodies, courts or tribunals, in accordance with national law, temporarily prohibit a natural person responsible for managerial responsibilities at chief executive officer or legal representative level from exercising managerial functions in that entity. Whether a head of security is one of these persons depends on national law and on the role. Counsel confirms. Read on 24 October 2026 from the Publications Office text of Directive (EU) 2022/2555.

US securities rules. If the organisation files reports with the US Securities and Exchange Commission, two rules touch the head of security. Regulation S-K Item 106 (17 CFR 229.106) asks the company to describe its processes for assessing, identifying and managing material risks from cybersecurity threats. It also asks for the board’s oversight of those risks and for management’s role in assessing and managing them, including which management positions or committees are responsible and the relevant expertise of the people in them. Form 8-K Item 1.05 asks the company, where it experiences a cybersecurity incident that it determines to be material, to describe the material aspects of the nature, scope and timing of the incident and its material impact or reasonably likely material impact on the company. A foreign private issuer reports the equivalent on Form 20-F and Form 6-K. Ask counsel what the company has said under Item 106 about your role, and who makes the materiality determination. The earlier incident pack sets the Form 8-K duty and its clock. Source: SEC Release No. 33-11216 and 17 CFR 229.106, read on 24 October 2026.

The sources and their editions

The pack reads Directive (EU) 2022/2555 (NIS2); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); UK NCSC board guidance and the ENISA skills framework, as their publishers state them; as published and read on 10 October 2026. Articles 32 and 33 of the Directive and the US securities rules cited above (SEC Release No. 33-11216 and 17 CFR 229.106) were read on 24 October 2026. Article 20(2) sets no interval for training the members of the management body. The yearly interval in this pack is the pack’s own choice, taken from the NIS2 readiness pack (P12 NR-05).

We found no NCSC, ENISA, ISACA or SANS publication written for a new security leader or for a handover. The NCSC’s Code and toolkit are written for the boards of medium and large organisations. The ENISA framework describes typical roles, and we could not read its profile of the chief information security officer, so we quote none of it. Commercial guides to a CISO’s first 90 days are practitioner opinion, and none is cited. The method here is the pack’s own, built on the earlier packs. It is a way of working and not a standard.

The first two days and the first two weeks

Some things cannot wait for the weekly actions. The checklist holds them on its Before You Start sheet.

The four phases

The 90 days are thirteen weeks, counted from your first day. The sponsor and the chair hear a short position from you at day 30. The first briefing falls at the end of week 7. The plan is drafted in week 9 and agreed in week 11, and it runs 100 days from the day it is agreed.

The first week has 8 actions of its own, because some things cannot wait: your appointment in writing, the open incidents, your predecessor’s access, and the dates ahead. First 90 Days Security Leader Checklist gives every week’s actions, 40 in all, each with the record that shows it was done.

The rules

The checklist holds sixteen rules, TR-01 to TR-16. Each answers at least one of ten named risks, RK-01 to RK-10. The time limits are house defaults that you set yourself: 30 days to review inherited exceptions, 30 days to confirm contacts, 60 days to tell the management body what it must approve, 60 days to record the baseline, 10 working days to agree the decision rights and 2 working days to confirm that access is removed.

The wording of each rule is in First 90 Days Security Leader Checklist. Three of them carry most of the weight. Change nothing until discovery ends (TR-01). Show what you saw for every finding (TR-02). Promise nothing until you have checked it (TR-04).

What not to do early

Most mistakes in the first weeks are things done too soon. Each of these has a date before which it waits.

• Announce a reorganisation, a new strategy or a new tool. Wait: the Decide phase (week 8).
• Rewrite or withdraw a policy, a standard or a procedure. Wait: the Decide phase (week 8).
• Promise a date, a budget or a result to the executives, a customer, an auditor or a regulator. Wait: the plan is agreed (week 11).
• Accept or renew an inherited exception or risk acceptance without reading it. Wait: never. Read it first.
• Sign a statement or a form to a regulator or an auditor that you have not checked. Wait: you have seen the evidence.
• Change who holds an incident role or how an incident decision is taken. Wait: p09’s own review of the plan.
• Criticise the outgoing leader or the earlier programme in front of others. Wait: never.
• Buy a tool to fix a problem you have not yet shown to exist. Wait: the Decide phase (week 8).
• Treat what you were told as a finding. Wait: you have seen a record, a test or a system view.

Finding out what is real

The discovery workbook (Inherited Security Programme Discovery Workbook) holds ten areas, governance, risk, policy, access, vulnerabilities, incidents, suppliers, resilience, awareness, assurance. Each has two items to look at, twenty in all. For each item you record one of four words.

A finding is always backed by something you saw. For each area the workbook names three kinds of proof, record, test, system view, and says which document to read first. A statement alone is Described only, however senior the person who made it.

Evidenced is at least Seen in P19’s words, and Described only is Told. A finding is not a maturity level. A level is set by P19’s rules, from a sample of records.

Count the findings and never add them up. “14 of 20 items looked at” says how far you have got. It says nothing about how good the programme is.

The interviews

Interview ten groups, in the Listen phase: executive, board or its chair, IT, legal, HR, finance, business owners, suppliers, audit, the team. Put the same four questions to every group.

1. What do you expect from the security function, and how will you know it is doing well?
2. What worries you most about security today?
3. What has been promised to you or to your area, and what is still open?
4. Who else should I talk to, and what should I read first?

Each group then has a few questions of its own, in Stakeholder Interview Guide & Record. Write each interview down in a fixed record of six fields: who and when, expectation, concern, commitment, follow-up, sent back. Send each person a note of what you heard, so that they can correct it.

The records hold candid views about named colleagues, and they are kept for the whole records period. Before the first interview, ask counsel three questions. Could the records be asked for in a dispute or by a regulator? Should any part of the discovery work be directed by counsel, so that its findings are handled as counsel advises? Can the people you interview ask to see what you wrote about them? Ask the data protection officer the last one too. If counsel asks you to route findings through them, do so. Write down what you saw and what you were told, and keep your opinions of people out of the record.

The commitment field needs care. Record each promise as Committed, Noted, not committed, Declined. You record a promise as Committed only after you have checked that you can keep it, and you say how (TR-04). Declining early, with a reason, is better than agreeing and failing.

The handover

The outgoing leader completes the handover document, eighteen sections, before they leave (TR-06). It lists what they hold and what they have promised, from open risks and incidents to contacts and accounts. It also asks for what is easy to leave out: legal matters and regulator letters, audit findings and certificates, the insurance policy and its notice conditions, weaknesses nobody has fixed, the team and the people the programme depends on, and anything the outgoing leader has not yet told the executives. The sign-off section, HD-12, keeps its number and comes last. Eleven sections may say None, with a date and the name of the person who said it. No section may stay blank.

The document is what the outgoing leader believed. Check it as you check everything else.

If the outgoing leader has gone, build the document yourself from records, and write down what is missing. Where they are still at work, ask them to sign last. The record is counted in four kinds of gap: missing, partial, access not confirmed removed, not signed. Count them as numbers, as “11 of 18 sections complete”, and work through them.

Assume your predecessor’s access was never removed. Unless the removal is already confirmed against a fresh extract, have IT disable it on your first day: accounts, administrator rights, tokens, shared secrets, vendor portals and any personal account used for work. Then confirm it against a fresh extract (TR-08). The access review pack (P07) asks the same of any removal (P07 AR-07). Before anyone searches the outgoing leader’s mailbox for what they promised, ask Legal, HR and the data protection officer how it may be done.

Who decides while you learn

The earlier packs give each decision right to a named role. When a new leader takes the role, nobody should have to guess. Agree in writing, with your executive sponsor, what you do with each kind of decision in the first 30, 60 and 90 days. There are three modes.

Transition Decision Rights Matrix sets the arrangement for twelve kinds of decision. Four of them are the organisation’s own, because no earlier pack sets them: the authority to stop or pause a release, a project or a system outside an incident, to end a supplier or managed service contract, to send a message to all staff, and to raise a concern directly with the chair of the audit committee. The arrangement never gives you a right that the pack which sets the right does not give you. It holds you back, or asks another person for a view, or refers a decision upward.

The rights are set by P04 PF-03, P02 EX-05, P05 RM-08, P09 and P06 TP-05. No earlier pack sets spending or hiring. They are the organisation’s own, and the matrix leaves them as [[placeholders]] for you to fill. Agree the arrangement within 10 working days of the start (TR-05). Review it at day 30, day 60 and day 90.

Nothing in this pack changes who holds an incident role, what each may decide or how fast anything is reported. Those belong to the incident pack (P09) and the regulatory notification pack (P18). In days 1 to 30 the new leader shares an incident decision with the outgoing leader, or with the deputy incident manager where the outgoing leader has gone. That asks for a view and moves no right. In week 1, list every open incident and every open reporting duty, and confirm in writing who holds each role and who stands in (P09 IM-03). For each open incident, ask the incident manager whether the reporting screen is recorded (P09 IM-06) and whether the notice condition of the cyber insurance policy has been checked (P09 RD-15).

Inherited exceptions, acceptances and promises

An exception or a risk acceptance that your predecessor approved is still in force. Some will be past their review date. Review each one within 30 days, and renew, change or close it by the approver its band sets (P02 EX-05, P05 RM-08). Nothing continues by default (TR-07). Read the reason, the date and who approved it before you decide anything.

Find what the organisation has promised to regulators, customers, auditors and the insurer, and put it on one list with an owner and a date for each (TR-04, TR-06). Customer commitments made in questionnaires sit in the tracker of the questionnaire pack (P26-A07, P26 QG-17).

Telling the management body

Within 60 days of the start, tell the management body, through your executive sponsor, what NIS2 Article 20 asks of it: to approve the measures, to oversee their implementation and to follow training (TR-11). Say in plain words that it can be held liable, and that counsel confirms what that means. Tell the chair in your first interview that this note will follow (WK-09). The NIS2 readiness pack records what the management body approved and oversaw (P12 NR-03 to NR-05), and the awareness pack covers its training (P16 AW-07).

The day-30 position

One page, or one slide, for the sponsor to read and to pass to the chair of the management body. It tells them how far you have got. It is not the first briefing, and it asks for no decision. Give it at day 30, in writing or in ten minutes. The day-30 review of your checklist, findings and plan is your own and stays internal (TR-15).

The briefing deck (First Executive Briefing Deck for a New Security Leader) holds this position as one slide. Send it to the sponsor, to pass to the chair. Say “so far”. Promise nothing new (TR-04).

The first executive briefing

Brief the executives at the end of discovery, in week 7. First Executive Briefing Deck for a New Security Leader gives thirteen briefing slides, inside a deck that also holds framing, example and reference slides: what you did, what is working, what is described and not yet shown, what you could not find, what contradicts what you were told, the top risks, the inherited items, the baseline, what the management body must approve, the proposed priorities and the decisions asked. Each ask has options, a recommendation, the cost and the risk of not deciding, as the board reporting pack asks (P03 BR-06).

Six asks go to the executives, EA-1 to EA-6.

Recording where you start

The baseline (Security Posture Baseline Scorecard) is the starting position, as at a date. It holds twelve measures, each taken unchanged from the measures catalogue (P11), and a level in words for each domain of the maturity pack (P19). The starting position, recorded as counts and as levels in words, with a reason wherever a value is unknown. It is never one score.

The rules are BL-01 to BL-06, and Security Posture Baseline Scorecard holds them. The levels are Not in place, Informal, Defined, Managed. The evidence words are Told, Seen, Tested. Where you do not know a value, write Unknown, with one reason from this list: not measured here; data not available; not yet asked; owner disputes the data. Do not estimate. An Unknown with a reason and a plan item to find it out is honest and useful. An estimate is a promise in disguise.

Do not add the baseline up. It is a set of counts and words. In a year, repeat the same measures with the same definitions, and compare only where the definition and the scope are unchanged.

The 100-day plan

The plan has two parts, because the rules ask you to learn first and some work cannot wait.

The no-regret list is the Quick wins. Agree it with the sponsor in weeks 1 to 2. It holds small actions that are needed whatever you find, such as the open incident, the access, the contacts and the leaver accounts. These are the only changes TR-01 allows before discovery ends. Each is due within 30 days of the start.

The rest of the plan is drafted from the findings in week 9 and agreed in writing in week 11 (WK-37 and WK-39). Its due dates count from the plan date, the day it is agreed, so that nothing falls due before the plan exists. From the findings, the interviews and the handover gaps, draft the Stabilisation items and the Strategic decisions. Every item says where it came from (PL-01), so that the plan follows what you found and not what you assumed. There are three categories.

A Strategic decision names who decides, under the arrangement in Transition Decision Rights Matrix (PL-04). Keep Large items to three or fewer (PL-05). List what you dropped and why (PL-07). Report the plan as counts: done, in progress, not started, dropped, overdue and due soon (PL-08). A promise outside the organisation follows the plan. It never leads it (TR-14).

The first year

The plan ends 100 days after the plan date, but the work does not. First-Year Security Operating Calendar sets out twenty-nine recurring items for the first year, from month 1, the month you start: eight for reporting, four for risk, eight for controls, three for incidents, three for suppliers, three for people. Four are monthly and sixteen are yearly. Every interval comes from the pack that sets it, such as the access review pack (P07 AR-02), the supplier pack (P06 TP-09) and the incident pack (P09 IM-12). It also holds the dates that belong to the organisation: the budget request, the insurance renewal, the audits and the certificate expiry dates. Gather the fixed dates in weeks 1 to 3 (WK-08, WK-17), and complete the calendar in week 13. Months 1 to 3 are past by then: ask each owner whether the item was done. Move each month to your own board and audit dates.

The order to work in

The document numbers are not the order of use. Work through the documents as the phases need them.

Start with First 90 Days Security Leader Checklist on your first day. It tells you what the week holds.

How it runs in practice (EXAMPLE)

Take Kestrel Components B.V. (EXAMPLE), a manufacturer of industrial pumps and valves in an EU Member State, with about 600 staff and two plants. It is treated as an important entity under NIS2 (manufacturing), on its own scope assessment, which counsel has not yet re-checked. It is not the distributor of the earlier packs, who held the role throughout. Every value here is made up.

Sam Okafor (Head of Information Security) started on 14 September 2026. Jonas Brandt left on 28 August 2026, after a notice period of three weeks and a partial handover. Ines Moreau (chief executive) is the executive sponsor. On 30 September 2026, day 17 and week 3, the Listen phase is ending.

• Interviews. 9 of 10 groups interviewed; 3 committed, 5 noted and not committed, 1 declined; 8 follow-ups open, 1 overdue. The critical suppliers are booked and not yet interviewed. One request, a cut in licence spend this quarter, was declined with a reason.
• Discovery. 14 of 20 items looked at: 6 Evidenced, 5 Described only, 2 Not found, 1 Contradicted; 6 not yet looked at. The one contradiction is in the area of access. Leavers were described as removed within the window. An extract compared with the HR list showed 11 leaver accounts still active. The plan has a quick win for it (PI-01), and it is done.
• Inherited items. 2 inherited exceptions are past their review dates, IE-1 (legacy order-entry server without multi-factor sign-in, Medium band) and IE-2 (shared engineering account on the plant network, High band). Each goes to the approver its band sets. None of the three inherited risk acceptances is past its review date.
• An open incident. INC-2026-041, a phishing-led mailbox compromise in the finance team, opened on 24 August 2026 and is contained, not closed. Its recovery criteria are not recorded as met and its post-incident review has not been held. The incident pack sets who decides and what is reported.
• The handover. 11 of 18 sections complete; 7 gaps (4 missing, 2 partial, 0 access, 1 unsigned). HD-06, HD-11, HD-13 and HD-15 are missing, HD-08 and HD-17 are partial and HD-12 is unsigned. The insurance section (HD-15) is empty, so the notice condition of the policy is read from the policy itself.
• Decision rights and plan. Ines Moreau agreed the arrangement on 23 September 2026, seven working days after the start, and the six no-regret actions on 24 September 2026. The rest of the plan is drafted in week 9. The plan date is planned for 23 November 2026, in week 11. As at 30 September 2026: 2 of 14 items done; 4 in progress, 8 not started, 1 overdue, 3 due within 14 days.
• The baseline. 8 of 12 measures recorded, 4 Unknown; 9 of 14 domains given a level, 5 Unknown. The Unknown values carry a reason, most of them “Not yet asked”, and each points to the plan item that will find it out.

The one-sentence position for the executives reads: 9 of 10 stakeholder groups interviewed; 14 of 20 discovery items looked at, 1 Contradicted; 2 inherited exceptions past their review date; 1 incident open at handover; 11 of 18 handover sections complete; 2 of 14 plan items done, 1 overdue.

The first briefing is set for 30 October 2026. Read all of this as Kestrel’s own record. It does not say that Kestrel, or any of its documents, meets any standard or law.

What to report

Report six counts, each as a count or “n of m”, every month, to the executives that sponsor you.

• Stakeholder groups interviewed (TM-01).
• Discovery items looked at (TM-02).
• Inherited exceptions and acceptances past their review date (TM-03).
• Handover sections complete (TM-04).
• Plan items done by their due date (TM-05).
• Baseline values recorded (TM-06).

Never combine them into a percentage, a score, a weighting or a traffic-light total. List the unknowns beside the counts, with their reasons.

Everything in the pack

• XLSExcel

  First 90 Days Security Leader Checklist

  The rules TR-01 to TR-16, the risks they answer and the weekly actions

  Open the document

• XLSExcel

  Inherited Security Programme Discovery Workbook

  The ten areas and twenty items to check, and one finding word for each

  Open the document

• DOCWord

  Stakeholder Interview Guide & Record

  The ten stakeholder groups, the questions, and a record for each interview

  Open the document

• DOCWord

  Security Function Handover Document

  The eighteen sections the outgoing leader completes, and the gaps

  Open the document

• XLSExcel

  Transition Decision Rights Matrix

  Who decides what in the first 30, 60 and 90 days, without moving a right that the earlier packs set

  Open the document

• XLSExcel

  100-Day Security Plan

  Items from the findings, by category, owner, effort and due date, with counts

  Open the document

• XLSExcel

  First-Year Security Operating Calendar

  The twenty-nine recurring items of the first year, by month

  Open the document

• PPTPowerPoint

  First Executive Briefing Deck for a New Security Leader

  thirteen briefing slides and six asks for the end of discovery, in a deck with its own framing slides

  Open the document

• XLSExcel

  Security Posture Baseline Scorecard

  The starting position, in counts and levels in words, with the unknowns

  Open the document

No document matches those words.

Limits

• Not legal advice, and not advice on employment. This document helps a new head of security, and the one who is leaving, to hand over and take over a security function. It is not legal advice and not advice on employment. It does not say that you comply with NIS2 or any standard. What liability means for a member of a management body, what an outgoing leader may be asked to hand over under their contract, and whether your organisation is an essential or an important entity are for counsel to confirm.
• No mapping. A reference says what its source asks of the management body or the organisation, and which CISO Times document helps with that work. It does not say that a document from this pack meets a requirement of NIS2.
• Other packs own the rest. Incident roles, decision rights and clocks are the incident pack’s (P09) and the reporting pack’s (P18). Policy approval is P04’s, risk acceptance P05’s, exceptions P02’s and supplier assurance P06’s. This pack states no clock and changes no decision right.
• A baseline is a snapshot. It describes the organisation on the day it was recorded, for the scope it states.
• The method is the pack’s own. No standard or regulator says how a handover must be run, or how a new leader must spend the first months.
• The files are yours. Every file in the pack stays on your own systems. Nothing you enter in them goes back to the CISO Times.
• The example is not a real firm. Kestrel is fictional, marked EXAMPLE, and every value in it is made up.

Where it maps

• NIS2, Directive (EU) 2022/2555: Article 20 (the management body), Article 21(1), and Articles 32 and 33 (natural persons), read on 24 October 2026. SEC Release No. 33-11216 and 17 CFR 229.106, read on 24 October 2026. NIST CSF 2.0: GV.RR-01.
• UK NCSC, Cyber Governance Code of Practice and Cyber Security Toolkit for Boards, and the ENISA European Cybersecurity Skills Framework, as their publishers state them. Both are voluntary guidance.
• ISO/IEC 27001:2022: Clause 5.1, Leadership and commitment. By number and title only. ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of NIS2, or that your organisation holds a certificate.