First 90 Days Security Leader Checklist

Week-by-week actions across people, risk, controls, incidents, suppliers and reporting.

Available soon

Format: Excel
Size: 83 KB
Length: 12 sheets
Version: 1.0
Updated: 10 Oct 2026

Follow this documentFree account. We can email you when it changes.

What changed

1.010 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Use this workbook with the New Security Leader First 90 Days — Guide. The new security leader completes one copy, from the first day. The executive sponsor reads it at the reviews on day 30, day 60 and day 90.
2	On the 90 Days sheet, enter the start date, the as-at date and the names. Day 1 is the first day at work. Change the as-at date each time you open the workbook. The sheet works out the day, the week and the phase.
3	Start with the eight week 1 must-dos. Then work down the actions one week at a time. Promise nothing until it is checked (TR-04). Change nothing until discovery ends at the close of week 7, except to stop harm, to meet a legal duty or to take an action that is needed whatever the plan turns out to be (TR-01).
4	For each action choose a state. When an action is Done, enter the date and say where the record that shows it is kept. The column Record that shows it was done says what to keep. A statement alone is not a record.
5	An action past the end of its week shows as Overdue. Add a note and a new date. The sheet counts overdue actions. It does not turn them into a score.
6	On the Requirements sheet, choose a state for each of the sixteen requirements. Met needs the place where the evidence is kept. Not met needs a note and a name. The time limits at the top are house defaults. Change them to your own, and the latest dates change with them.
7	Read the risks table below the requirements. It shows, for each of the ten risks, how many of the requirements that answer it are met.
8	Before you act on anything in the first seven weeks, read the Not Early sheet. On the Who Does What sheet, write the name of each person who holds a role, and agree who is accountable for each activity. The decision-rights arrangement itself is in the Transition Decision Rights Matrix.
9	Review the checklist at day 30, day 60 and day 90, and the baseline and the calendar at the first anniversary (TR-15). Enter the reviewer and the date at the foot of the 90 Days sheet. Keep the completed workbook for the records period (TR-16). To clear the EXAMPLE, delete the EXAMPLE sheet.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

The idea of this pack: Learn before you promise. Find out what is real, not what is claimed. Decide who decides. Show the starting position, so that progress can be shown.

TR-01: Change no policy, tool, team structure or priority until discovery ends at the close of week 7, except to stop harm, to act on a legal duty or to take a no-regret action. Spend the first three weeks listening.

TR-04: Promise nothing until it is checked. A commitment is recorded as Committed only after the new leader has checked that it can be kept, and says how. Anything else is recorded as Noted, not committed, or Declined, with the reason.

Related documents: Inherited Security Programme Discovery Workbook (what the programme really does), Stakeholder Interview Guide & Record, Security Function Handover Document, Transition Decision Rights Matrix, 100-Day Security Plan, First-Year Security Operating Calendar, First Executive Briefing Deck for a New Security Leader and Security Posture Baseline Scorecard.

This document helps a new head of security, and the one who is leaving, to hand over and take over a security function. It is not legal advice and not advice on employment. It does not say that you comply with NIS2 or any standard. What liability means for a member of a management body, what an outgoing leader may be asked to hand over under their contract, and whether your organisation is an essential or an important entity are for counsel to confirm.

EXAMPLE: Kestrel Components B.V. (EXAMPLE), a manufacturer of industrial pumps and valves in an EU Member State, with about 600 staff and two plants, as at 2026-09-30. The EXAMPLE sheet shows nine of the actions and six of the requirements, each tied to a dated fact.

Hidden columns hold the workings of the counts and the lists. Leave them as they are.

Adapting this template.

Small organisation: one person often holds several of the roles on the Who Does What sheet. The head of security may report to the chief executive, who is then also the executive sponsor. Where one person has two roles, write the name against both roles. Where a role does not exist, choose Not applicable and say why, and do not delete the row.

Regulated organisation: add columns to the right of the calculated ones for what your regulator asks of a change of security leader, such as a notification of the appointment. Do not insert columns inside the tables, because the formulas read them by position. Move the time limits on the Requirements sheet to your own.

Service provider or outsourced IT: where an outsourced provider runs your IT or your security service, send the actions that ask for an extract, a log or a test record to the provider in writing, and keep its reply as the record. Record what it could not show as Not met, with the name of the person who will chase it.

Where the outgoing leader has already gone, the handover is built from records (TR-06). Mark WK-06 In progress until the gaps are listed, and do not mark an action Done on the strength of what a colleague remembers.

Replace the [[placeholders]]. Delete the EXAMPLE sheet before use. Keep the formulas.

The time limits on the Requirements sheet are house defaults. Change them to your own, and the latest dates change with them.

90 Days

First 90 days: the weekly actions

Enter the start date and the as-at date. Yellow cells are yours. The due dates, the status, the counts and the Check column calculate. Counts only, never a score.

The start

Start date (day 1)				[[YYYY-MM-DD]]
As at date				[[YYYY-MM-DD]]
New security leader				[[name of the new Head of Information Security or CISO]]
Executive sponsor				[[e.g. chief executive or chief operating officer]]
Outgoing security leader				[[name of the predecessor]]

Where you are

Today

This phase is for

Actions				0 of 40 applicable actions done; 0 in progress, 40 not started, 0 not applicable, 0 overdue
Overdue				None
Week 1 must-dos				0 of 8 week 1 must-dos done
Requirements				0 of 16 applicable requirements met; 0 not met, 16 not checked; 0 past their dates

By phase

Phase and weeks	What the phase is for	Actions	Not started
Listen (weeks 1 to 3)	Meet people, read what exists, and promise nothing. Learn who expects what.	18	18
Verify (weeks 4 to 7)	Check what you were told against a record, a test or a system. End with the first executive briefing.	15	15
Decide (weeks 8 to 10)	Choose the few priorities the findings support, agree the decision rights, and settle the plan.	5	5
Propose (weeks 11 to 13)	Take the plan, the reporting rhythm and the asks to the executives and the management body.	2	2
All actions		40	40

By area

Area	Actions	Not started
People	9	9
Risk	5	5
Controls	8	8
Incidents	4	4
Suppliers	4	4
Reporting	10	10
All actions	40	40

Counts of actions, never a share.

The actions, WK-01 to WK-40

ID	Week	Phase	Area	Action	State now	Carries out	Week 1 must-do	Record that shows it was done	Check
WK-01	1	Listen	People	Meet the executive sponsor. Ask what they expect in 90 days, what worries them, and what was promised.	Not started	TR-03	Yes	Interview record (A04)	Choose a state
WK-02	1	Listen	People	Agree your appointment, reporting line and authority in writing, and ask for the role description.	Not started	TR-05	Yes	A signed or emailed note from the sponsor	Choose a state
WK-03	1	Listen	Incidents	List every open incident and every open reporting duty. Confirm in writing who holds each incident role and who deputises.	Not started	TR-09	Yes	The list, and a note naming the role holders	Choose a state
WK-04	1	Listen	Controls	Confirm that the outgoing leader's accounts, administrator rights, tokens and vendor portal logins are removed.	Not started	TR-08	Yes	A fresh extract that shows the removal	Choose a state
WK-05	1	Listen	Reporting	Read the last board report, the risk register, the exception register and the last audit report. Change nothing.	Not started	TR-01	Yes	Your reading notes	Choose a state
WK-06	1	Listen	People	Collect the handover document the outgoing leader left, or build it from records, and mark every gap.	Not started	TR-06	Yes	The handover document (A05) with its gaps	Choose a state
WK-07	1	Listen	Suppliers	List the critical suppliers, the incident responders, the insurer and the regulator contacts, to confirm one by one.	Not started	TR-10	Yes	A contact list with a confirmed-on column	Choose a state
WK-08	1	Listen	Reporting	List every deadline in the next 90 days: audits, reports, renewals, regulator dates and customer commitments.	Not started	TR-04	Yes	A dated list (start of A08)	Choose a state
WK-09	2	Listen	People	Interview the executives and the chair of the management body.	Not started	TR-03		Interview records (A04, IV-01 and IV-02)	Choose a state
WK-10	2	Listen	People	Interview the heads of IT, legal, HR and finance.	Not started	TR-03		Interview records (A04, IV-03 to IV-06)	Choose a state
WK-11	2	Listen	Risk	Read the risk register end to end. Note who owns each risk and when it was last reviewed.	Not started	TR-02		Notes against the register	Choose a state
WK-12	2	Listen	Controls	Ask for the policy register and the open findings of the last internal or external audit.	Not started	TR-02		Both documents, as received	Choose a state
WK-13	2	Listen	Incidents	Read the incident log for the last 12 months and the incident response plan. Note what was learnt and what stayed open.	Not started	TR-09		Notes against the log	Choose a state
WK-14	3	Listen	People	Interview the business owners, internal audit and your own team.	Not started	TR-03		Interview records (A04, IV-07, IV-09 and IV-10)	Choose a state
WK-15	3	Listen	Suppliers	Read the supplier register. List suppliers by tier and book the interviews with the critical ones.	Not started	TR-10		The list and the bookings	Choose a state
WK-16	3	Listen	Risk	List every inherited exception and risk acceptance with its review date. Mark those past it.	Not started	TR-07		The list, with past-review items marked	Choose a state
WK-17	3	Listen	Reporting	Meet the board secretary. Learn the board calendar and the format of the papers.	Not started	TR-11		The calendar dates in A08	Choose a state
WK-18	3	Listen	Controls	Open the discovery workbook (A03). Start with the areas the interviews raised.	Not started	TR-02		Findings entered, each with what was seen	Choose a state
WK-19	4	Verify	Controls	Check access. Take an extract of leavers and of privileged accounts and compare it with the HR record.	Not started	TR-02		The extract and the comparison	Choose a state
WK-20	4	Verify	Risk	Review every inherited exception and acceptance that is past its review date. Renew, change or close each, by the approver its band sets.	Not started	TR-07		A decision on each, in the register	Choose a state
WK-21	4	Verify	Incidents	Check the record of the last incident exercise and the post-incident review of the latest incident.	Not started	TR-02		The two records, or a finding of Not found	Choose a state
WK-22	4	Verify	Suppliers	Interview the critical suppliers and confirm each contact by a call. Check the last assessment of each Tier 1 supplier.	Not started	TR-10		Contacts confirmed; assessment dates	Choose a state
WK-23	5	Verify	Controls	Ask for evidence of vulnerability handling: the last scan, the patch records and the overdue exposure.	Not started	TR-02		The records, or a finding of Not found	Choose a state
WK-24	5	Verify	Controls	Ask for the last backup restore test. Check which critical systems have had one.	Not started	TR-02		The test record, or a finding of Not found	Choose a state
WK-25	5	Verify	People	Check the awareness completion records, and the training records of the management body.	Not started	TR-02		The completion register	Choose a state
WK-26	5	Verify	Reporting	Find what the organisation has promised to regulators, customers and auditors. Build the commitments list.	Not started	TR-04, TR-06		The list, with a due date and an owner for each	Choose a state
WK-27	6	Verify	Risk	Test two controls the programme says it runs. Take a sample of records and inspect each against what the control says.	Not started	TR-02		The sample and the result	Choose a state
WK-28	6	Verify	Controls	Review the policy register: documents past their review date, and documents in force without approval.	Not started	TR-02		The two counts, and the documents	Choose a state
WK-29	6	Verify	Reporting	Record the baseline from the findings: counts, levels in words, and Unknown with a reason.	Not started	TR-12		The baseline (A10)	Choose a state
WK-30	6	Verify	Suppliers	Check the supplier register against what you now know. Note any critical supplier not in it.	Not started	TR-02		A note, and a finding for each difference	Choose a state
WK-31	7	Verify	Reporting	Close discovery. Count the findings in the four words and list every contradiction. Write the first briefing.	Not started	TR-13		The counts and the briefing deck (A09)	Choose a state
WK-32	7	Verify	People	Tell each group you interviewed what you heard. Promise nothing new.	Not started	TR-04		A short message to each group	Choose a state
WK-33	7	Verify	Reporting	Hold the first executive briefing, at the end of the week.	Not started	TR-13		The decisions asked and the answers	Choose a state
WK-34	8	Decide	Risk	Choose the few top risks the findings support. Put each on the register with an owner.	Not started	TR-14		Register entries	Choose a state
WK-35	8	Decide	People	Settle the transition arrangement for decision rights with the sponsor, and review it at day 60.	Not started	TR-05		The arrangement (A06), agreed in writing	Choose a state
WK-36	8	Decide	Reporting	Tell the management body, through the sponsor, what NIS2 Article 20 asks of it.	Not started	TR-11		A short briefing note and a minute	Choose a state
WK-37	9	Decide	Controls	Draft the 100-day plan from the findings. Mark quick wins, stabilisation and strategic decisions.	Not started	TR-14		The plan (A07)	Choose a state
WK-38	10	Decide	Incidents	Decide whether the incident plan needs an update or a new exercise, as P09 IM-12 asks.	Not started	TR-14		A decision in the plan	Choose a state
WK-39	11	Propose	Reporting	Take the plan, the reporting rhythm and the asks to the executives. Agree the plan in writing.	Not started	TR-14		The agreed plan	Choose a state
WK-40	13	Propose	Reporting	Review the checklist, the findings and the plan at day 90. Set the calendar for the first year.	Not started	TR-15		The review notes and the calendar (A08)	Choose a state

Reviews

Review	What to review	Reviewed by (name)	Date reviewed
Day 30 review (TR-15)	The checklist, the discovery findings and the plan	[[Name]]	[[YYYY-MM-DD]]
Day 60 review (TR-15)	The checklist, the discovery findings and the plan	[[Name]]	[[YYYY-MM-DD]]
Day 90 review (TR-15)	The checklist, the discovery findings and the plan	[[Name]]	[[YYYY-MM-DD]]
First anniversary (TR-15)	The baseline and the calendar	[[Name]]	[[YYYY-MM-DD]]

Requirements

The sixteen requirements, and the ten risks they answer

Choose a state for each requirement. Yellow cells are yours. The latest dates, the date status, the counts and the Check column calculate. The time limits below are house defaults: change them to your own.

Your time limits (house defaults)

Decision rights agreed in writing, within this many working days of the start (TR-05)	10	Days count from the start date as day 1. Working days are Monday to Friday; add any public holidays by hand.
Inherited exceptions and acceptances reviewed, within this many days of the start (TR-07)	30
Contacts confirmed, within this many days of the start (TR-10)	30
Management body told what it must approve, within this many days of the start (TR-11)	60
Baseline recorded, within this many days of the start (TR-12)	60
Outgoing leader's access confirmed removed, within this many working days (TR-08)	2

Where the requirements stand

Requirements			0 of 16 applicable requirements met; 0 not met, 16 not checked; 0 past their dates
Not met			None
Not checked			TR-01, TR-02, TR-03, TR-04, TR-05, TR-06, TR-07, TR-08, TR-09, TR-10, TR-11, TR-12, TR-13, TR-14, TR-15, TR-16
Past their dates			None

The requirements, TR-01 to TR-16

ID	Area	Requirement	Risks it answers	Actions that carry it out	Actions done	Time limit	State now	Check
TR-01	Learn first	Change no policy, tool, team structure or priority until discovery ends at the close of week 7, except to stop harm, to act on a legal duty or to take a no-regret action. Spend the first three weeks listening.	RK-01, RK-02, RK-08	WK-05	0 of 1 actions done	No set limit	Not checked	Choose a state
TR-02	Evidence	Every discovery finding states what was seen: a record, a test result or a system view. A statement alone is Described only. A finding is checked again after [[6]] months, or on a material change.	RK-02, RK-01	WK-11, WK-12, WK-18, WK-19, WK-21, WK-23, WK-24, WK-25, WK-27, WK-28, WK-30	0 of 11 actions done	No set limit	Not checked	Choose a state
TR-03	Interviews	Book an interview with every stakeholder group in A04 during the Listen phase and hold it by the end of week 4, with the same core questions, and record each interview in the record format: expectation, concern, commitment and follow-up. Interview before judging.	RK-08, RK-02	WK-01, WK-09, WK-10, WK-14	0 of 4 actions done	No set limit	Not checked	Choose a state
TR-04	Commitments	Promise nothing until it is checked. A commitment is recorded as Committed only after the new leader has checked that it can be kept, and says how. Anything else is recorded as Noted, not committed, or Declined, with the reason.	RK-01, RK-05	WK-08, WK-26, WK-32	0 of 3 actions done	No set limit	Not checked	Choose a state
TR-05	Decision rights	Agree the transition arrangement for decision rights in writing with the executive sponsor within [[10]] working days of the start, and review it at day 30, day 60 and day 90. The arrangement gives no right that the packs which set each right do not give.	RK-06, RK-01	WK-02, WK-35	0 of 2 actions done	Within 10 working days of the start	Not checked	Choose a state
TR-06	Handover	The outgoing leader completes the handover document (A05) before they leave. Where they have gone, the new leader builds it from records and writes down what is missing. A section with nothing in it says None, with a date, and who said so.	RK-05, RK-09, RK-04, RK-03	WK-06, WK-26	0 of 2 actions done	No set limit	Not checked	Choose a state
TR-07	Inherited exceptions	Review every inherited exception and risk acceptance within [[30]] days of the start. One that is past its review date is renewed, changed or closed by the approver its band sets (P02 EX-05, P05 RM-08). Nothing continues by default.	RK-03, RK-06	WK-16, WK-20	0 of 2 actions done	Within 30 days of the start	Not checked	Choose a state
TR-08	Access	Remove the outgoing leader's access on the day they leave: accounts, administrator rights, tokens, shared secrets, vendor portals and any personal account used for work. Confirm the removal against a fresh extract within [[2]] working days, as P07 AR-07 asks of any removal.	RK-04, RK-09	WK-04	0 of 1 actions done	On the day they leave; confirmed within 2 working days	Not checked	Choose a state
TR-09	Incidents	In week 1, list every open incident and every open reporting duty, and confirm in writing who holds each incident role and who deputises (P09 IM-03). The roles, decision rights and clocks are P09's and P18's, unchanged.	RK-05, RK-06	WK-03, WK-13	0 of 2 actions done	No set limit	Not checked	Choose a state
TR-10	Contacts	Confirm, by a call or a message and not from a list, the contacts at the regulator, the CSIRT, the insurer, the responders and each critical supplier within [[30]] days of the start. Record the date of each confirmation.	RK-09, RK-05	WK-07, WK-15, WK-22	0 of 3 actions done	Within 30 days of the start	Not checked	Choose a state
TR-11	Management body	Within [[60]] days of the start, tell the management body, through the executive sponsor, what NIS2 Article 20 asks of it: to approve the measures, to oversee their implementation and to follow training, and that it can be held liable. Counsel confirms what liability means.	RK-07, RK-06	WK-17, WK-36	0 of 2 actions done	Within 60 days of the start	Not checked	Choose a state
TR-12	Baseline	Record the baseline within [[60]] days of the start, in counts and in levels in words. Record an unknown value as Unknown, with a reason and the plan item that will find it out. Repeat the baseline in month 12, so that the comparison is ready at the first anniversary.	RK-10, RK-02	WK-29	0 of 1 actions done	Within 60 days of the start	Not checked	Choose a state
TR-13	First briefing	Brief the executives at the end of discovery with the findings in the four words, the top risks, the baseline and the asks. Make each ask as P03 BR-06 sets out: options, a recommendation, the cost and the risk of not deciding.	RK-01, RK-06, RK-07	WK-31, WK-33	0 of 2 actions done	No set limit	Not checked	Choose a state
TR-14	Plan	Every item in the 100-day plan traces to a finding, an interview record, a handover gap or an inherited exception. The plan lists what was dropped and why. A promise outside the organisation follows the plan, and never leads it.	RK-01, RK-10	WK-34, WK-37, WK-38, WK-39	0 of 4 actions done	No set limit	Not checked	Choose a state
TR-15	Review	Review this checklist, the discovery findings and the plan at day 30, day 60 and day 90, and the baseline and the calendar at the first anniversary. Record what changed and why.	RK-10, RK-03	WK-40	0 of 1 actions done	No set limit	Not checked	Choose a state
TR-16	Records	Keep the handover document, the interview records, the decision-rights arrangement and the plan for [[3]] years, the P22 records period, or longer where a contract or a law asks.	RK-05, RK-06	No weekly action	No weekly action	No set limit	Not checked	Choose a state

The ten risks, and how many of the requirements that answer each are met

Risk	What could go wrong	Answered by	How many are met
RK-01	The new leader promises a date, a budget or a result before learning what is real, and cannot keep it.	TR-01, TR-02, TR-04, TR-05, TR-13, TR-14	0 of 6 requirements met
RK-02	The programme is described as doing more than it does, and the new leader builds on the description.	TR-01, TR-02, TR-03, TR-12	0 of 4 requirements met
RK-03	Inherited exceptions and risk acceptances run past their review dates without anyone seeing them.	TR-06, TR-07, TR-15	0 of 3 requirements met
RK-04	The outgoing leader's access, accounts or tokens stay live after they have gone.	TR-06, TR-08	0 of 2 requirements met
RK-05	An open incident, a notification or a commitment to a customer, auditor or regulator is dropped at the handover.	TR-04, TR-06, TR-09, TR-10, TR-16	0 of 5 requirements met
RK-06	Nobody is sure who decides, so a decision is taken twice, taken by the wrong person or not taken.	TR-05, TR-07, TR-09, TR-11, TR-13, TR-16	0 of 6 requirements met
RK-07	The management body does not know what it must approve and oversee, or that it can be held liable (NIS2 Article 20).	TR-11, TR-13	0 of 2 requirements met
RK-08	The new leader hears only one or two voices, and misses the people who know how the programme really runs.	TR-01, TR-03	0 of 2 requirements met
RK-09	Contacts at the regulator, the responders, the insurer and the critical suppliers go with the outgoing leader.	TR-06, TR-08, TR-10	0 of 3 requirements met
RK-10	In a year nobody can show what changed, because nobody recorded where the programme started.	TR-12, TR-14, TR-15	0 of 3 requirements met

Counts of requirements, never a score. Each requirement answers at least one risk, and each risk is answered by at least two requirements.

Not Early

What not to do early, and the pitfalls

Read this before you act on anything in the first seven weeks. Learn before you promise. Nothing here changes a decision right: the earlier packs and the Transition Decision Rights Matrix own those.

What not to do early, NE-1 to NE-9

ID	Do not	Until	Why
NE-1	Announce a reorganisation, a new strategy or a new tool.	The Decide phase (week 8)	You do not yet know what works, who does it, or what it cost to get there.
NE-2	Rewrite or withdraw a policy, a standard or a procedure.	The Decide phase (week 8)	Policies are approved at a set level (P04 PF-03), and a change needs the reasons discovery gives.
NE-3	Promise a date, a budget or a result to the executives, a customer, an auditor or a regulator.	The plan is agreed (week 11)	Learn before you promise. A promise made in week 2 rests on what you were told.
NE-4	Accept or renew an inherited exception or risk acceptance without reading it.	Never. Read it first	Nothing continues by default (TR-07). Read the reason, the date and who approved it.
NE-5	Sign a statement or a form to a regulator or an auditor that you have not checked.	You have seen the evidence	A statement is held against the organisation and against you.
NE-6	Change who holds an incident role or how an incident decision is taken.	P09's own review of the plan	The roles and decision rights belong to the incident plan (P09 IM-03). Confirm them, and change nothing in a crisis.
NE-7	Criticise the outgoing leader or the earlier programme in front of others.	Never	The people who built it will tell you the most. Record what you find, not who is to blame.
NE-8	Buy a tool to fix a problem you have not yet shown to exist.	The Decide phase (week 8)	The finding comes first, then the choice, then the money.
NE-9	Treat what you were told as a finding.	You have seen a record, a test or a system view	A statement alone is Described only (TR-02).

The ten pitfalls, NP-1 to NP-10

ID	Pitfall	What to do instead
NP-1	Treating the handover document as the truth.	It is what the outgoing leader believed. Check each part against a record, a test or a system view (TR-02).
NP-2	Promising a date, a budget or a result in the first weeks.	Note it, check it can be kept, and say so before you commit (TR-04).
NP-3	Interviewing only the executives.	The team, IT, audit and the business owners know how the programme really runs (TR-03).
NP-4	Changing things early for a quick, visible win.	Take only the no-regret actions. Everything else waits for the findings (TR-01).
NP-5	Letting an inherited exception run because someone signed it.	Read it, check its date and band, and renew, change or close it by the right approver (TR-07).
NP-6	Forgetting the outgoing leader's accounts, tokens and portal logins.	Remove them on the day they leave and confirm against a fresh extract (TR-08).
NP-7	Assuming you hold every right the last leader held.	Read what each earlier pack gives the role, and agree the arrangement in writing (TR-05).
NP-8	Blaming the outgoing leader in front of others.	Record what you find, not who is to blame. The people who built it will tell you the most.
NP-9	Adding the baseline up into one number.	Record counts and levels in words, and the unknowns with their reasons (BL-01).
NP-10	Briefing the management body in jargon, or not telling it what it must approve.	Say in plain words what NIS2 Article 20 asks of it, and ask counsel what liability means (TR-11).

Who Does What

Who does what in the handover and the first 90 days

R is responsible, A is accountable (one for each activity), C is consulted and I is informed. Write the name of each person who holds a role. The roles that hold the decision rights are those the earlier packs name. This sheet gives none.

The activities, TX-01 to TX-13

ID	Activity	Rule	New security leader	Outgoing security leader	Executive sponsor	Management body	HR	Legal	Data Protection Officer	Head of IT
TX-01	Agree the appointment and the decision-rights arrangement	TR-05	R		A	I	C	C
TX-02	Complete the handover document	TR-06	C	A	I		C	C		C
TX-03	Remove the outgoing leader's access and confirm it	TR-08	A	I			C			R
TX-04	Interview the stakeholder groups	TR-03	A		C
TX-05	Look for the proof and record the findings	TR-02	A	C				C	C	C
TX-06	Review the inherited exceptions and risk acceptances	TR-07	A		C			I		C
TX-07	Confirm the incident roles and list the open incidents and duties	TR-09	A	C	I			C		C
TX-08	Confirm the regulator, responder and supplier contacts	TR-10	A	C				R
TX-09	Tell the management body what NIS2 Article 20 asks of it	TR-11	R		A	I		C
TX-10	Record the baseline	TR-12	A		I					C
TX-11	Give the first executive briefing	TR-13	R		A	I		C
TX-12	Agree the 100-day plan	TR-14	R		A		C	C		C
TX-13	Review the checklist, the findings and the plan at day 30, 60 and 90	TR-15	A		C	I

The roles, and who holds each

No.	Role	Name	What the role does
1	New security leader	[[name of the new Head of Information Security or CISO]]	Learns the programme, interviews the stakeholders, verifies what is claimed, keeps the discovery workbook, agrees the decision rights, proposes the plan and reports counts. Promises nothing until it is checked.
2	Outgoing security leader	[[name of the predecessor]]	Completes the handover document, lists what they hold and have promised, introduces the new leader to contacts and hands over access and accounts. Where they have gone, the new leader builds the handover from records.
3	Executive sponsor	[[e.g. chief executive or chief operating officer]]	Agrees the decision-rights arrangement and the plan in writing, opens doors to the other executives and the management body, and decides what only an executive may decide.
4	Management body	[[the board, or the equivalent]]	Approves the cybersecurity risk-management measures and oversees their implementation (NIS2 Article 20), follows training, and receives the reports.
5	HR	[[HR lead]]	Confirms the leaver and joiner records, the outgoing leader's departure date and notice terms, and the new leader's training and onboarding.
6	Legal	[[in-house or external counsel]]	Confirms what the outgoing leader must hand over, what commitments to customers and regulators exist, and what the management body's liability means.
7	Data Protection Officer	[[or the privacy lead where no DPO is appointed]]	Gives the new leader the records of processing, breach decisions and open data protection matters.
8	Head of IT	[[Head of IT]]	Gives the new leader system views, the account inventory and the change calendar, and removes access.

Where one person holds two roles, write the name against both. Where a role does not exist in your organisation, say so in the name cell and agree who covers it.

EXAMPLE

EXAMPLE: Kestrel, three weeks into the role

Kestrel Components B.V. (EXAMPLE), a manufacturer of industrial pumps and valves in an EU Member State, with about 600 staff and two plants, as at 2026-09-30. Every value is made up. Nine of the forty actions and six of the sixteen requirements are shown. Delete this sheet before use.

The organisation and the day

Organisation				Kestrel Components B.V. (EXAMPLE)
New security leader				Sam Okafor, Head of Information Security
Start date (day 1)				14 Sep 2026
As at date				30 Sep 2026
Today				Day 17, week 3, Listen phase

Nine actions from the first weeks, as the new leader recorded them

ID	Week	Phase	Area	Action	Due (end of its week)	State	State now	Date done	Status	Carries out	Week 1 must-do	Record that shows it was done	Where the record is kept	Note	Check
WK-01	1	Listen	People	Meet the executive sponsor. Ask what they expect in 90 days, what worries them, and what was promised.	20 Sep 2026	Done	Done	16 Sep 2026	Done	TR-03	Yes	Interview record (A04)	Interview record IR-01	Met on 2026-09-15. The interview record is dated 2026-09-16.	OK
WK-04	1	Listen	Controls	Confirm that the outgoing leader's accounts, administrator rights, tokens and vendor portal logins are removed.	20 Sep 2026	Done	Done	16 Sep 2026	Done	TR-08	Yes	A fresh extract that shows the removal	A fresh extract of accounts, kept with the handover file		OK
WK-09	2	Listen	People	Interview the executives and the chair of the management body.	27 Sep 2026	Done	Done	17 Sep 2026	Done	TR-03		Interview records (A04, IV-01 and IV-02)	Interview records IR-01 and IR-02		OK
WK-10	2	Listen	People	Interview the heads of IT, legal, HR and finance.	27 Sep 2026	Done	Done	22 Sep 2026	Done	TR-03		Interview records (A04, IV-03 to IV-06)	Interview records IR-03 to IR-06		OK
WK-14	3	Listen	People	Interview the business owners, internal audit and your own team.	4 Oct 2026	Done	Done	29 Sep 2026	Done	TR-03		Interview records (A04, IV-07, IV-09 and IV-10)	Interview records IR-07 to IR-09		OK
WK-18	3	Listen	Controls	Open the discovery workbook (A03). Start with the areas the interviews raised.	4 Oct 2026	In progress	In progress		Due this week	TR-02		Findings entered, each with what was seen	Discovery workbook	14 of 20 items looked at: 6 Evidenced, 5 Described only, 2 Not found, 1 Contradicted; 6 not yet looked at	OK
WK-19	4	Verify	Controls	Check access. Take an extract of leavers and of privileged accounts and compare it with the HR record.	11 Oct 2026	Done	Done	24 Sep 2026	Done	TR-02		The extract and the comparison	Discovery workbook, DS-04-1 and DS-04-2	Done in week 2, ahead of its week. Leavers are described as removed in the window. An extract compared with the HR list shows 11 leaver accounts still active.	OK
WK-20	4	Verify	Risk	Review every inherited exception and acceptance that is past its review date. Renew, change or close each, by the approver its band sets.	11 Oct 2026	In progress	In progress		Later	TR-07		A decision on each, in the register		2 inherited exceptions are past their review dates (IE-1 and IE-2). The review is in progress (PI-02).	OK
WK-22	4	Verify	Suppliers	Interview the critical suppliers and confirm each contact by a call. Check the last assessment of each Tier 1 supplier.	11 Oct 2026	Not started	Not started		Later	TR-10		Contacts confirmed; assessment dates		The critical suppliers are booked for 6 Oct.	OK
In this extract				6 of 9 actions shown are done; 2 in progress, 1 not started, 0 overdue
Each row is tied to a dated fact: the interview records, the access extract and the discovery workbook. WK-19 was done in week 2, ahead of its own week. The other thirty-one actions are not in the example.

Six requirements, as at the same date

ID	Area	Requirement	Latest date	State	Date status	Date checked	Evidence	Note	Put right by	Check
TR-03	Interviews	Book an interview with every stakeholder group in A04 during the Listen phase and hold it by the end of week 4, with the same core questions, and record each interview in the record format: expectation, concern, commitment and follow-up. Interview before judging.		Not met				9 of 10 groups interviewed. The critical suppliers (IV-08) are booked and not yet interviewed.	Sam Okafor	OK
TR-05	Decision rights	Agree the transition arrangement for decision rights in writing with the executive sponsor within [[10]] working days of the start, and review it at day 30, day 60 and day 90. The arrangement gives no right that the packs which set each right do not give.	28 Sep 2026	Met		23 Sep 2026	The arrangement (A06), agreed in writing with the chief executive			OK
TR-07	Inherited exceptions	Review every inherited exception and risk acceptance within [[30]] days of the start. One that is past its review date is renewed, changed or closed by the approver its band sets (P02 EX-05, P05 RM-08). Nothing continues by default.	13 Oct 2026	Not met	Within its date			IE-1 and IE-2 are past their review dates. The review is in progress (PI-02).	Sam Okafor	OK
TR-08	Access	Remove the outgoing leader's access on the day they leave: accounts, administrator rights, tokens, shared secrets, vendor portals and any personal account used for work. Confirm the removal against a fresh extract within [[2]] working days, as P07 AR-07 asks of any removal.		Met		16 Sep 2026	A fresh extract that shows the removal			OK
TR-10	Contacts	Confirm, by a call or a message and not from a list, the contacts at the regulator, the CSIRT, the insurer, the responders and each critical supplier within [[30]] days of the start. Record the date of each confirmation.	13 Oct 2026	Not met	Within its date			Confirming the contacts by a call is not started (PI-05, due 2026-10-13).	Sam Okafor	OK
TR-11	Management body	Within [[60]] days of the start, tell the management body, through the executive sponsor, what NIS2 Article 20 asks of it: to approve the measures, to oversee their implementation and to follow training, and that it can be held liable. Counsel confirms what liability means.	12 Nov 2026	Not met	Within its date			Brief the board through the chief executive. Due 2026-10-30 (IR-02).	Sam Okafor	OK
9 of 10 groups interviewed. The requirements not yet met are still within their dates. TR-03 and TR-08 have no latest date, and TR-08 runs from the day the outgoing leader leaves. The other ten requirements are not in the example.

Lists

ActionState	ItemState
Not started	Met
In progress	Not met
Done	Not checked
Not applicable	Not applicable

Definitions

Definitions

Term	Meaning in this workbook
New security leader	The head of security, security manager or CISO who has just taken the role. They hold the role that the earlier packs call the Head of Information Security.
Outgoing security leader	The person who held the role before. They may still be at work, may be serving a notice period, or may already have gone.
Executive sponsor	The executive the new leader reports to, who agrees the arrangement and the plan, and who speaks for the leader to the management body.
Management body	The board, or the equivalent, that NIS2 Article 20 says approves the cybersecurity risk-management measures and oversees their implementation.
Handover	The passing of what the outgoing leader knows, holds and has promised to the new leader, in writing.
Discovery	The work of finding out what the inherited programme does, what it only says it does and what it does not do, by asking for a record, a test or a system view.
Inherited	Held, accepted or promised before the new leader started: an exception, a risk acceptance, a contract, a commitment to a customer or a regulator, or an open incident.
Baseline	The starting position, recorded as counts and as levels in words, with a reason wherever a value is unknown. It is never one score.
Listen (weeks 1 to 3)	Meet people, read what exists, and promise nothing. Learn who expects what.
Verify (weeks 4 to 7)	Check what you were told against a record, a test or a system. End with the first executive briefing.
Decide (weeks 8 to 10)	Choose the few priorities the findings support, agree the decision rights, and settle the plan.
Propose (weeks 11 to 13)	Take the plan, the reporting rhythm and the asks to the executives and the management body.
Week	Seven days, counted from the start date as day 1. Week 1 is days 1 to 7. The 13 weeks cover days 1 to 91.
Due	The last day of the action's week: day 7 for week 1, day 14 for week 2, and so on.
Overdue	The due date has passed and the action is not Done and not Not applicable. An action due today is not overdue.
Due this week	The as-at date falls in the action's own week, and the action is not yet done.
Week 1 must-do	One of the eight actions that cannot wait for discovery. They confirm your authority, the open incidents, the outgoing leader's access, what to read, the handover document, the contacts and the dates ahead.
Not started	Nothing has been done yet. A blank state counts as Not started.
In progress	Work has begun and is not finished.
Done	The action is finished and the record that shows it is kept. Say where, and enter the date.
Not applicable	The action cannot apply here. Say why in the note.
Met	You looked, and the evidence shows the requirement holds. Say where the evidence is.
Not met	The requirement does not hold yet. Say what is missing, and name who puts it right.
Not checked	Nobody has looked yet. The sheet counts it apart, and it is never counted as met.
WK-nn, TR-nn, RK-nn	One of the forty weekly actions, one of the sixteen requirements, and one of the ten risks the requirements answer.
Requirement limits	The days and working days a requirement allows, read from the settings at the top of the Requirements sheet. They are house defaults.
Hidden columns	The workings behind the counts and the lists. They stay hidden. Do not overwrite them.
EXAMPLE	An illustration: Kestrel Components B.V. (EXAMPLE), as at 2026-09-30. Every name and value is made up.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 4.1 — Understanding the organization and its context	90 Days sheet: the first weeks learn the organisation and the programme it inherits, from the people and the records, before anything changes
ISO/IEC 27001:2022	Clause 5.3 — Organizational roles, responsibilities and authorities	Who Does What sheet and Requirements sheet, TR-05: roles, responsibilities and authorities are written down and agreed with the executive sponsor
NIST CSF 2.0	GV.RR-02 — “Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced”	Who Does What sheet and Requirements sheet, TR-05: who holds which role in the transition is set out, agreed in writing and reviewed at day 30, 60 and 90
NIS2 — Directive (EU) 2022/2555	Article 20(1) — Member States “shall ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21, oversee its implementation and can be held liable for infringements by the entities of that Article”. The paragraph is “without prejudice to national law as regards the liability rules applicable to public institutions, as well as the liability of public servants and elected or appointed officials”	Requirements sheet, TR-11, and 90 Days sheet, WK-36: Article 20 asks that the management body approves the measures and oversees their implementation, so the new leader tells it so within the set limit. Counsel confirms what liability means
NIS2 — Directive (EU) 2022/2555	Article 21(2)(a) — “policies on risk analysis and information system security”	90 Days sheet, WK-11, WK-28 and WK-34: the new leader reads the risk register and the policy register before changing either
NIS2 — Directive (EU) 2022/2555	Article 21(2)(b) — the cybersecurity risk-management measures include “incident handling”	90 Days sheet, WK-03, WK-13 and WK-21, and Requirements sheet, TR-09: open incidents are listed and the incident roles confirmed in the first week. The roles and decisions stay with the incident plan
NIS2 — Directive (EU) 2022/2555	Article 21(2)(d) — “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers”	90 Days sheet, WK-07, WK-15, WK-22 and WK-30, and Requirements sheet, TR-10: the critical suppliers and their contacts are listed, called and checked against the register
NIS2 — Directive (EU) 2022/2555	Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures”	90 Days sheet, WK-27, WK-29 and WK-31: two controls are tested, the baseline is recorded and each finding says what was seen
NIS2 — Directive (EU) 2022/2555	Article 21(2)(g) — “basic cyber hygiene practices and cybersecurity training”	90 Days sheet, WK-25: the awareness completion records and the training records of the management body are checked
NIS2 — Directive (EU) 2022/2555	Article 21(2)(i) — “human resources security, access control policies and asset management”	90 Days sheet, WK-04 and WK-19, and Requirements sheet, TR-08: the outgoing leader's access is removed and confirmed, and leaver accounts are compared with the HR record

Editions referenced: Directive (EU) 2022/2555 (NIS2); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); UK NCSC board guidance and the ENISA skills framework, as their publishers state them; as published and read on 10 October 2026

Directive (EU) 2022/2555 is addressed to the Member States, and binds essential and important entities through their national law. Article 20 asks the Member States to ensure that the management body approves the cybersecurity risk-management measures, oversees their implementation, can be held liable for infringements of Article 21, and is required to follow training. What liability means for a member of a management body depends on national law, and counsel confirms it. Whether your organisation is an essential or an important entity comes from its scope assessment and from counsel, and this pack does not decide it.

The NCSC's Code and toolkit and the ENISA skills framework are voluntary guidance. They are not law. They say what boards might expect and what roles typically do. They do not say what a new security leader must do, and no law named here says how a handover must be run. Following them is not a statement that your organisation complies with NIS2 or any standard.

This pack does not say which document, record or practice meets a requirement of NIS2. Each reference says what its source asks of the management body or the organisation and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.

A reference says what its source asks of the management body or the organisation, and which CISO Times document helps with that work. It does not say that a document from this pack meets a requirement of NIS2.

ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of NIS2, or that your organisation holds a certificate.

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.