First-Year Security Operating Calendar
Schedules recurring reviews, reporting, audits and renewals for the first year in role.
Available soon
- Format
- Excel
- Size
- 73 KB
- Length
- 12 sheets
- Version
- 1.0
- Updated
What's inside
What changed
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | What this workbook is. It is the First-Year Security Operating Calendar of the CISO Transition, Handover & First 90 Days pack: the calendar the new head of security sets in week 13 (WK-40) for the first year in role. 24 items, CA-01 to CA-24, each in one of six areas: People, Risk, Controls, Incidents, Suppliers, Reporting. It schedules work that other documents set. It changes no interval, owner, decision right or clock that those documents set. |
| 2 | Start on the Start and Reviews sheet. Enter your start date: your first day in the role, which is day 1. Month 1 is the month it falls in. The sheet then dates the reviews that TR-15 asks for, the start of week 13 and day 100 of the plan. |
| 3 | Read the Calendar sheet. Each row is one item, with the document or rule that sets its timing, the interval it sets (Standard every, in months) and the month it first falls in (Standard first month). The twelve month columns show Due in each month the item falls in. The default timing already works. Change a month only where a date outside your control sets it. |
| 4 | To move an item, change the yellow Every (months) and First month cells. Every is 1, 3, 6 or 12. First month is a whole number from 1 up to Every. Keep the interval the source sets: a change to the interval is a change to that document or rule, and goes through its own approval. The Moved column says so, and the item needs a reason in its Notes (CK-05). |
| 5 | Name an owner for every item, by post. One person may own many items. An item with no owner is an item nobody will do (CK-03). |
| 6 | Add your own items in the 10 blank rows under the standard ones: an ID of your own, the area, what happens, the document or rule that sets it, the interval and the first month. Keep the six areas covered (CK-06). |
| 7 | On the Fixed Dates sheet, enter each date you cannot move and the item it belongs to. Take them from the handover (HD-11 lists "Every date due in the next 90 days: audits, reports, renewals, tests and regulator deadlines."), from the plan (PL-07: work due after day 100), from the board secretary (WK-17) and from your auditors and suppliers. The sheet says whether each date falls in a month its item is due. |
| 8 | Read the Month by Month sheet. For each month it counts the items due, in total and by area, counts the fixed dates and names the items. The busiest and the quietest month show where the year is crowded. Where a month is crowded, you may move an item's first month within its interval. Say why in the Notes (CK-05). A count is not a score: a month with more items is busier, not worse. |
| 9 | Read the Checks sheet. Each of the eight checks says Clear, Action needed or Nothing to check. Settle every Action needed before you take the calendar to the executive sponsor and, for the quarterly report, the management body. |
| 10 | Review the calendar at the first anniversary, with the baseline (TR-15). Keep each version with the plan for [[3]] years, the P22 records period (TR-16), or longer where a contract or a law asks. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Limitations: This document helps a new head of security, and the one who is leaving, to hand over and take over a security function. It is not legal advice and not advice on employment. It does not say that you comply with NIS2 or any standard. What liability means for a member of a management body, what an outgoing leader may be asked to hand over under their contract, and whether your organisation is an essential or an important entity are for counsel to confirm.
The calendar is a schedule. Doing an item on its date does not show that the item works. Testing, review and reporting are done by the documents each item names. Incident clocks belong to P09 and are held in no row here.
The months are defaults. They count from the month you start, so month 1 is not January unless you start in January. A date that must fall on a calendar date, such as a filing, goes on the Fixed Dates sheet.
EXAMPLE: Kestrel Components B.V. (EXAMPLE), a manufacturer of industrial pumps and valves in an EU Member State, with about 600 staff and two plants. Its new head of security, Sam Okafor, started on 14 Sep 2026, so month 1 is September 2026. Its calendar uses the standard timings. Each of its 24 items has an owner, a post of the example organisation, as if the calendar were set in week 13 (the plan reaches the calendar then, WK-40). The owner check therefore says Clear. The Fixed Dates sheet holds the date of the first executive briefing and three dated examples: two board meetings and one internal audit window, each in a month its item is due.
Adapting this template:
• Small organisation: one person may own most items. Keep every area and every item you can run. If you cannot run an item at its interval, say so in its Notes and take the change through the document that sets the interval. Do not delete the row.
• Regulated organisation: add a row for each date that a regulator, a supervisor, an auditor or a customer's contract sets, and enter the date on the Fixed Dates sheet with its item. Counsel confirms whether a date binds you. This calendar holds no notification clock: those are in the incident documents (P09).
• Service provider or outsourced IT: where a managed service provider runs an item, such as an access review or a recovery test, the item stays on your calendar under your owner. Name the provider and the date it delivers in the Notes. The provider's report is evidence for your review. It does not replace it.
• Replace the [[placeholders]] with your own values. Keep the formulas.
This workbook is your own record. Keep a copy that can be reached when the main systems are down.
Start and Reviews
Start date and review dates
Enter your first day in the role. Everything on the other sheets counts from it: month 1 is the month it falls in, and day 1 is the day itself. Review this checklist, the discovery findings and the plan at day 30, day 60 and day 90, and the baseline and the calendar at the first anniversary. Record what changed and why.
| Start date (day 1) | 14 Sep 2026 | EXAMPLE: Sam Okafor started on 14 Sep 2026. Enter your own date. |
| Month 1 | 1 Sep 2026 | |
| Month 12 | 1 Aug 2027 |
Review dates
| Review | Day | Date (calc) | What is reviewed, or done | Rule |
|---|---|---|---|---|
| Review at day 30 | 30 | 13 Oct 2026 | This checklist, the discovery findings and the plan | TR-15 |
| Review at day 60 | 60 | 12 Nov 2026 | This checklist, the discovery findings and the plan | TR-15 |
| Review at day 90 | 90 | 12 Dec 2026 | This checklist, the discovery findings and the plan | TR-15 |
| Week 13 begins: set the calendar for the first year | 85 | 7 Dec 2026 | The calendar you are reading. Set it in week 13 | WK-40 |
| Day 100 of the plan: later work comes here | 100 | 22 Dec 2026 | Every plan item dropped or moved past day 100 and the reason, and the work due after it | PL-07 |
| First anniversary | 14 Sep 2027 | The baseline and this calendar | TR-15, TR-12 |
Day 1 is the start date, so day 30 is the start date plus 29 days. The first anniversary is the start date plus 12 calendar months.
Weeks run 1 to 13 from day 1. Week 13 begins on day 85. The plan runs to day 100; work that moves past it comes to this calendar.
Calendar
One row for each recurring item. Yellow cells are yours; the others calculate. The month columns show Due in each month the item falls in, counted from the month you start. Standard values come from the documents named in the Source column.
| Calendar month: | 1 Sep 2026 | 1 Oct 2026 | 1 Nov 2026 | 1 Dec 2026 | 1 Jan 2027 | 1 Feb 2027 | 1 Mar 2027 | 1 Apr 2027 | 1 May 2027 | 1 Jun 2027 | 1 Jul 2027 | 1 Aug 2027 | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Row | Item ID | Area | What happens | Source: the document or rule that sets the timing | Standard every (months) | Standard first month | Every (months) | First month | Timing (calc) | Moved from standard (calc) | Month 1 | Month 2 | Month 3 | Month 4 | Month 5 | Month 6 | Month 7 | Month 8 | Month 9 | Month 10 | Month 11 | Month 12 | Times in the year (calc) | Owner (a post) | Notes: the reason for a move, and any date |
| Standard | CA-01 | Reporting | Monthly metrics to the security and IT leadership team | P11 MR-10 | 1 | 1 | 1 | 1 | OK | Standard | Due | Due | Due | Due | Due | Due | Due | Due | Due | Due | Due | Due | 12 | Head of Information Security | |
| Standard | CA-02 | Reporting | Monthly security report to the executive committee | P11-A07 | 1 | 1 | 1 | 1 | OK | Standard | Due | Due | Due | Due | Due | Due | Due | Due | Due | Due | Due | Due | 12 | Head of Information Security | |
| Standard | CA-03 | Reporting | Quarterly report to the management body | P03 BR-01 | 3 | 3 | 3 | 3 | OK | Standard | Due | Due | Due | Due | 4 | Head of Information Security | Cadence as P03 sets it: quarterly. | ||||||||
| Standard | CA-04 | Risk | Risk owners review their risks | P05 RM-09 | 3 | 2 | 3 | 2 | OK | Standard | Due | Due | Due | Due | 4 | Head of Information Security | |||||||||
| Standard | CA-05 | Risk | Monthly review of open exceptions and acceptances | P02-A03 | 1 | 1 | 1 | 1 | OK | Standard | Due | Due | Due | Due | Due | Due | Due | Due | Due | Due | Due | Due | 12 | Head of Information Security | |
| Standard | CA-06 | Risk | Reassess the whole risk register | P05 RM-09 | 12 | 10 | 12 | 10 | OK | Standard | Due | 1 | Head of Information Security | ||||||||||||
| Standard | CA-07 | Controls | Review privileged and administrator access | P07 AR-02 | 3 | 2 | 3 | 2 | OK | Standard | Due | Due | Due | Due | 4 | Head of IT | |||||||||
| Standard | CA-08 | Controls | Review access to systems that support a critical service | P07 AR-02 | 6 | 4 | 6 | 4 | OK | Standard | Due | Due | 2 | Head of IT | |||||||||||
| Standard | CA-09 | Controls | Review access to all other in-scope systems | P07 AR-02 | 12 | 8 | 12 | 8 | OK | Standard | Due | 1 | Head of IT | ||||||||||||
| Standard | CA-10 | Controls | Review the Policy-tier documents and their register | P04 PF-06 | 12 | 6 | 12 | 6 | OK | Standard | Due | 1 | Head of Information Security | ||||||||||||
| Standard | CA-11 | Controls | Approve the annual control testing plan | P20-A09 | 12 | 3 | 12 | 3 | OK | Standard | Due | 1 | Head of Information Security | ||||||||||||
| Standard | CA-12 | Incidents | Exercise the incident response plan | P09 IM-12 | 12 | 5 | 12 | 5 | OK | Standard | Due | 1 | Head of Information Security | ||||||||||||
| Standard | CA-13 | Incidents | Check that every closed incident has had its review | P09 IM-11 | 1 | 1 | 1 | 1 | OK | Standard | Due | Due | Due | Due | Due | Due | Due | Due | Due | Due | Due | Due | 12 | Head of Information Security | |
| Standard | CA-14 | Incidents | Test recovery of the critical services | P22-A02 | 12 | 9 | 12 | 9 | OK | Standard | Due | 1 | Head of IT | ||||||||||||
| Standard | CA-15 | Suppliers | Reassess each Tier 1 supplier | P06 TP-09 | 12 | 4 | 12 | 4 | OK | Standard | Due | 1 | Head of Information Security | ||||||||||||
| Standard | CA-16 | Suppliers | Confirm critical supplier contacts and exit plans | P06 TP-10 | 6 | 6 | 6 | 6 | OK | Standard | Due | Due | 2 | Head of Information Security | |||||||||||
| Standard | CA-17 | Suppliers | Check the contract renewal dates for security suppliers | P06 TP-12 | 3 | 1 | 3 | 1 | OK | Standard | Due | Due | Due | Due | 4 | General counsel | |||||||||
| Standard | CA-18 | People | Training for the members of the management body | P12 NR-05 | 12 | 4 | 12 | 4 | OK | Standard | Due | 1 | Head of HR | ||||||||||||
| Standard | CA-19 | People | Agree the annual awareness plan | P16 AW-03 | 12 | 2 | 12 | 2 | OK | Standard | Due | 1 | Head of HR | ||||||||||||
| Standard | CA-20 | People | Report policy currency and acknowledgement to management | P04 PF-12 | 3 | 3 | 3 | 3 | OK | Standard | Due | Due | Due | Due | 4 | Head of Information Security | |||||||||
| Standard | CA-21 | Reporting | Self-assess readiness for NIS2 and report the gaps | P12 NR-08 | 6 | 5 | 6 | 5 | OK | Standard | Due | Due | 2 | Head of Information Security | |||||||||||
| Standard | CA-22 | Reporting | Run the maturity assessment | P19 MA-17 | 12 | 11 | 12 | 11 | OK | Standard | Due | 1 | Head of Information Security | ||||||||||||
| Standard | CA-23 | Reporting | Repeat the baseline and compare it with the first | P27-A10 | 12 | 12 | 12 | 12 | OK | Standard | Due | 1 | Head of Information Security | ||||||||||||
| Standard | CA-24 | Reporting | Management review of the information security management system, where one exists (ISO/IEC 27001 clause 9.3) | P08-A09 | 12 | 12 | 12 | 12 | OK | Standard | Due | 1 | Chief executive |
Month by Month
Month by month
For each month of the first year: the items due, in total and in each area, the fixed dates, and the items by ID. Counts only. A month with more items is busier. It is not worse.
The twelve months
| Month | Calendar month (calc) | Items due (calc) | People | Risk | Controls | Incidents | Suppliers | Reporting | Fixed dates | Items due, by ID (calc) |
|---|---|---|---|---|---|---|---|---|---|---|
| 1 | 1 Sep 2026 | 5 | 0 | 1 | 0 | 1 | 1 | 2 | 0 | CA-01 CA-02 CA-05 CA-13 CA-17 |
| 2 | 1 Oct 2026 | 7 | 1 | 2 | 1 | 1 | 0 | 2 | 1 | CA-01 CA-02 CA-04 CA-05 CA-07 CA-13 CA-19 |
| 3 | 1 Nov 2026 | 7 | 1 | 1 | 1 | 1 | 0 | 3 | 1 | CA-01 CA-02 CA-03 CA-05 CA-11 CA-13 CA-20 |
| 4 | 1 Dec 2026 | 8 | 1 | 1 | 1 | 1 | 2 | 2 | 0 | CA-01 CA-02 CA-05 CA-08 CA-13 CA-15 CA-17 CA-18 |
| 5 | 1 Jan 2027 | 8 | 0 | 2 | 1 | 2 | 0 | 3 | 0 | CA-01 CA-02 CA-04 CA-05 CA-07 CA-12 CA-13 CA-21 |
| 6 | 1 Feb 2027 | 8 | 1 | 1 | 1 | 1 | 1 | 3 | 1 | CA-01 CA-02 CA-03 CA-05 CA-10 CA-13 CA-16 CA-20 |
| 7 | 1 Mar 2027 | 5 | 0 | 1 | 0 | 1 | 1 | 2 | 0 | CA-01 CA-02 CA-05 CA-13 CA-17 |
| 8 | 1 Apr 2027 | 7 | 0 | 2 | 2 | 1 | 0 | 2 | 1 | CA-01 CA-02 CA-04 CA-05 CA-07 CA-09 CA-13 |
| 9 | 1 May 2027 | 7 | 1 | 1 | 0 | 2 | 0 | 3 | 0 | CA-01 CA-02 CA-03 CA-05 CA-13 CA-14 CA-20 |
| 10 | 1 Jun 2027 | 7 | 0 | 2 | 1 | 1 | 1 | 2 | 0 | CA-01 CA-02 CA-05 CA-06 CA-08 CA-13 CA-17 |
| 11 | 1 Jul 2027 | 8 | 0 | 2 | 1 | 1 | 0 | 4 | 0 | CA-01 CA-02 CA-04 CA-05 CA-07 CA-13 CA-21 CA-22 |
| 12 | 1 Aug 2027 | 9 | 1 | 1 | 0 | 1 | 1 | 5 | 0 | CA-01 CA-02 CA-03 CA-05 CA-13 CA-16 CA-20 CA-23 CA-24 |
Where the year is crowded
| Measure | Items | Month | Calendar month (calc) | |
|---|---|---|---|---|
| Busiest month | 9 | 12 | 1 Aug 2027 | |
| Quietest month | 5 | 1 | 1 Sep 2026 | |
| Items due in months 1 to 3 | 19 | |||
| Times an item falls due in the year | 86 | |||
Busiest and quietest give the first month where two are level. Months 1 to 3 are the months of the first 90 days, counted by calendar month, not by day.
Fixed Dates
The dates you cannot move: a board meeting, an audit window, a renewal, a regulator's date. Name the calendar item each one belongs to. The check says whether the date falls in a month the item is due.
| Row | Date | What happens on this date | Where the date came from | Calendar item it belongs to | Month of the year (calc) | Calendar month (calc) | Check (calc) | Notes |
|---|---|---|---|---|---|---|---|---|
| EXAMPLE | 30 Oct 2026 | First executive briefing, at the end of discovery | TR-13, IR-01 | 2 | 1 Oct 2026 | No calendar item | A date in the plan. It is not a recurring item, so it names no calendar item. | |
| EXAMPLE | 18 Nov 2026 | First quarterly report to the management body: the November board meeting | WK-17, the board secretary | CA-03 | 3 | 1 Nov 2026 | Due in that month | Date given by the board secretary (EXAMPLE). |
| EXAMPLE | 17 Feb 2027 | Second quarterly report to the management body: the February board meeting | WK-17, the board secretary | CA-03 | 6 | 1 Feb 2027 | Due in that month | Date given by the board secretary (EXAMPLE). |
| EXAMPLE | 14 Apr 2027 | Internal audit fieldwork on access reviews for the in-scope systems | IR-08, the internal audit lead | CA-09 | 8 | 1 Apr 2027 | Due in that month | Date in the internal audit plan (EXAMPLE). The access review is set to run just before it. |
Checks
Checks
Eight checks on the calendar as typed. Each says Clear, Action needed or Nothing to check. Settle every Action needed before you take the calendar to the executive sponsor. Counts only.
The checks
| Check | What it looks at | Result | Of | Status (calc) |
|---|---|---|---|---|
| CK-01 | The start date is entered on the Start and Reviews sheet. | 1 | 1 | Clear |
| CK-02 | Every calendar item has a timing that works: an interval of 1, 3, 6 or 12 months and a first month within its first interval. | 24 | 24 | Clear |
| CK-03 | Every calendar item has an owner named. A [[placeholder]] does not count. | 24 | 24 | Clear |
| CK-04 | Every calendar item names the document or rule that sets its timing. A [[placeholder]] does not count. | 24 | 24 | Clear |
| CK-05 | Every item moved from its standard timing has a reason in its Notes. | 0 | 0 | Nothing to check |
| CK-06 | Each of the six areas has at least one item. | 6 | 6 | Clear |
| CK-07 | Every fixed date that names a calendar item falls in a month in which the item is due. | 3 | 3 | Clear |
| CK-08 | The repeat of the baseline (CA-23) is due once a year, in month 12. | 1 | 1 | Clear |
| Needing action | 0 | 8 | checks | |
The number of checks that need action is a count of work left. It is not a score. A calendar with none still needs your review.
Lists
| ListArea | ListEvery | ListItemID |
|---|---|---|
| People | 1 | CA-01 |
| Risk | 3 | CA-02 |
| Controls | 6 | CA-03 |
| Incidents | 12 | CA-04 |
| Suppliers | CA-05 | |
| Reporting | CA-06 |
CA-07
CA-08
CA-09
CA-10
CA-11
CA-12
CA-13
CA-14
CA-15
CA-16
CA-17
CA-18
CA-19
CA-20
CA-21
CA-22
CA-23
CA-24
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Calendar item | One recurring piece of work with an ID, an area, a source and a timing. CA-01 to CA-24 are the pack's. Add your own below them. |
| Standard timing | The interval and first month the source document or rule sets, as the pack records them. Shown in grey on the Calendar sheet. The workbook compares your timing with it. |
| Every (months) | The interval between two occurrences of an item: 1 (monthly), 3 (quarterly), 6 (twice a year) or 12 (once a year). |
| First month | The month of the year, counted from month 1, in which the item first falls. It is a whole number from 1 up to Every. An item that runs every 3 months and first falls in month 2 also falls in months 5, 8 and 11. |
| Month 1 | The calendar month of your start date, whichever day you start. Month 12 is eleven months later. |
| Due | The word a month column shows for an item that falls in that month. The word is the status. Colour only repeats it. |
| Moved | An item whose Every or First month differs from the standard. A moved item needs a reason in its Notes. |
| Fixed date | A date you cannot move, such as a board meeting, an audit, a renewal or a date a regulator sets. It belongs to a calendar item, and falls in a month in which that item is due. |
| Owner | The post that sees that the item is done. One person may own many items. |
| Source | The document or rule that sets the timing, by ID, such as P07 AR-02. The calendar copies it and never rewords it. |
| Start date and day 1 | The first day in the role. Day 1 is the start date itself, and every count of days and months in this workbook runs from it. |
| Executive sponsor | The executive the new leader reports to, who agrees the arrangement and the plan, and who speaks for the leader to the management body. |
| Management body | The board, or the equivalent, that NIS2 Article 20 says approves the cybersecurity risk-management measures and oversees their implementation. |
| Area | One of six: People, Risk, Controls, Incidents, Suppliers, Reporting. |
| First anniversary | The start date plus 12 calendar months. The baseline and this calendar are reviewed then (TR-15). |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| CA-nn, CK-nn | CA-nn are the items of this calendar. CK-nn are its checks. TR-nn, WK-nn, HD-nn and PL-nn are the requirements, weekly actions, handover sections and plan rules of the First 90 Days Security Leader Checklist, the Security Function Handover Document and the 100-Day Security Plan. IDs such as P07 AR-02 are rules of the earlier pack named. |
| EXAMPLE | A worked example: Kestrel Components B.V. (EXAMPLE), with a new head of security who started on 14 Sep 2026. Every name and value is made up. Delete before use. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Clause 9.1 — Monitoring, measurement, analysis and evaluation | Calendar and Month by Month sheets: when the programme is monitored and measured, and when the results are analysed and evaluated, across the first year |
| ISO/IEC 27001:2022 | Clause 9.3 — Management review | Calendar sheet, row CA-24: the date of the management review, where an information security management system exists |
| NIST CSF 2.0 | GV.OV-03 — “Organizational cybersecurity risk management performance is evaluated and reviewed for adjustments needed” | Calendar and Checks sheets: the dates on which the performance of the cybersecurity programme is evaluated and reviewed, and what adjusts |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures” | Calendar sheet, rows CA-04 to CA-06, CA-11, CA-14 and CA-21 to CA-23: the dates on which the effectiveness of the measures is assessed, tested and reported, each with an owner |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(g) — “basic cyber hygiene practices and cybersecurity training” | Calendar sheet, rows CA-18 to CA-20: the dates of training for the management body, of the awareness plan and of the report on policy acknowledgement |
Editions referenced: Directive (EU) 2022/2555 (NIS2); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); UK NCSC board guidance and the ENISA skills framework, as their publishers state them; as published and read on 10 October 2026
ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of NIS2, or that your organisation holds a certificate.
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.
A reference says what its source asks of the management body or the organisation, and which CISO Times document helps with that work. It does not say that a document from this pack meets a requirement of NIS2.
Directive (EU) 2022/2555 is addressed to the Member States, and binds essential and important entities through their national law. Article 20 asks the Member States to ensure that the management body approves the cybersecurity risk-management measures, oversees their implementation, can be held liable for infringements of Article 21, and is required to follow training. What liability means for a member of a management body depends on national law, and counsel confirms it. Whether your organisation is an essential or an important entity comes from its scope assessment and from counsel, and this pack does not decide it.