Inherited Security Programme Discovery Workbook

Structured discovery of what exists, what works and what is only claimed in an inherited programme.

Available soon

See what to find out this week online: What should I check this week?About 2 minutes, no account needed.

Check one claim's proof online: Is this proof enough?About 2 minutes, no account needed.

Format: Excel
Size: 66 KB
Length: 11 sheets
Version: 1.0
Updated: 10 Oct 2026

Follow this documentFree account. We can email you when it changes.

What changed

1.010 Oct 2026
Published.

Changes across this pack

Preview

The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.

Instructions

How to use this workbook

Step	What to do
1	Read the Method sheet: the four phases, the four finding words and the rules this workbook applies (TR-01, TR-02, TR-14). Spend the first three weeks listening. Open this workbook when the interviews have raised the first areas.
2	On the Summary sheet, enter your start date and the day you are working on. Check how many months pass before a finding is checked again. The default comes from TR-02.
3	Read the Areas sheet. For each area it says what counts as proof (Record, Test, System view) and which published document to read first.
4	On the Discovery sheet, each row is one item to find out. Ask for the proof. Do not accept a statement as a finding.
5	Choose one finding word: Evidenced, Described only, Not found, Contradicted. Write what you saw, and the date you looked. A statement alone is Described only (TR-02).
6	Leave an item blank until you have looked. A blank row reads Not yet looked at. It is not a finding.
7	For a finding of Not found or Contradicted, name the follow-up in its column: an action, or an item of the 100-Day Security Plan. Every plan item traces to a finding (TR-14).
8	Clear every row in the Check column. A row with a check to clear is missing something the finding needs, such as what you saw.
9	Read the Summary sheet: the counts by finding and by area, the areas with a contradiction and the findings due for a second look. Close discovery at the end of week 7 (TR-01), and take the counts to the First Executive Briefing Deck for a New Security Leader.
10	Change nothing while you discover, except to stop harm, to act on a legal duty or to take a no-regret action (TR-01). A contradiction that is a live risk, such as a leaver's account still active, goes to its owner now.

Legend

Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.

EXAMPLE

Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval.

Limitations: This document helps a new head of security, and the one who is leaving, to hand over and take over a security function. It is not legal advice and not advice on employment. It does not say that you comply with NIS2 or any standard. What liability means for a member of a management body, what an outgoing leader may be asked to hand over under their contract, and whether your organisation is an essential or an important entity are for counsel to confirm.

The idea behind it. Learn before you promise. Find out what is real, not what is claimed. Decide who decides. Show the starting position, so that progress can be shown.

Counts, not a score. The result is the number of items in each finding and in each area. The workbook never adds them into a score. Evidenced is at least Seen in P19's words, and Described only is Told. A finding is not a maturity level. A level is set by P19's rules, from a sample of records.

EXAMPLE: Kestrel Components B.V. (EXAMPLE), a manufacturer of industrial pumps and valves in an EU Member State, with about 600 staff and two plants, as at 30 Sep 2026. Sam Okafor started on 14 Sep 2026. 14 of 20 items looked at: 6 Evidenced, 5 Described only, 2 Not found, 1 Contradicted; 6 not yet looked at.

Adapting this template

Small organisation: you may be the whole team. Keep all ten areas, but take the lightest proof for each: one test is worth more than three statements. An item you cannot look at by the end of week 7 stays Not yet looked at. Say why when you record the baseline.

Regulated organisation: ask Legal before you record a finding about a duty to a regulator. A finding may be read by a regulator or an auditor later, so write what you saw and leave out blame. Counsel confirms what a finding means for any duty to notify.

Service provider or outsourced IT: where an outsourced provider runs a control, ask for the provider's own evidence and read the contract. Record the evidence as the provider's. A statement from the provider's account manager is Described only.

This workbook is your own record. Keep it with the evidence it rests on, and share it only with those who need it.

Discovery

One row for each item to find out, two for each of the ten areas. Yellow columns are yours; the others are worked out. A blank finding means you have not yet looked. EXAMPLE: Kestrel as at 30 Sep 2026.

Example	Item	Area	What to find out	Read first	Finding	What was seen	Looked on	Follow-up: plan item or action	Check again on	Second look	Check	Contradicted so far (working)	Not found so far (working)
EXAMPLE	DS-01-1	DS-01 Governance	Who is accountable for security, and what authority do they hold in writing?	P12-A05 Management Body Cybersecurity Accountability Record	Evidenced	Role description and appointment letter seen, approved by the chief executive.	21 Sep 2026		21 Mar 2027	Not yet due	OK
EXAMPLE	DS-01-2	DS-01 Governance	Has the management body approved the cybersecurity risk-management measures, and is there a minute?	P12-A05 Management Body Cybersecurity Accountability Record	Described only	The board is said to have approved the measures in March. No minute seen yet.	21 Sep 2026	PI-11	21 Mar 2027	Not yet due	OK
EXAMPLE	DS-02-1	DS-02 Risk	Is there a risk register, with an owner and a review date for each risk?	P05-A05 Information Security Risk Register	Evidenced	A register of 31 risks, each with an owner. The register tool shows the edit history.	22 Sep 2026		22 Mar 2027	Not yet due	OK
EXAMPLE	DS-02-2	DS-02 Risk	Is residual risk compared with a stated appetite, and who decides on acceptance?	P05-A05 Information Security Risk Register	Not found	No appetite statement exists, so no comparison with appetite is made.	22 Sep 2026	PI-07	22 Mar 2027	Not yet due	OK		DS-02-2
EXAMPLE	DS-03-1	DS-03 Policy	Is there a register of policies, with owner, approval date and review date?	P04-A06 Policy Register & Review Schedule	Evidenced	A policy register with owner, approval date and review date. Seven documents are past review.	23 Sep 2026		23 Mar 2027	Not yet due	OK		DS-02-2
EXAMPLE	DS-03-2	DS-03 Policy	Do staff acknowledge the policies that apply to them?	P04-A06 Policy Register & Review Schedule	Described only	HR says staff acknowledge policies at joining. The tool report is not yet seen.	23 Sep 2026		23 Mar 2027	Not yet due	OK		DS-02-2
EXAMPLE	DS-04-1	DS-04 Access	Are leavers' accounts removed within the removal window?	P07-A04 Access Review Scope & System Inventory	Contradicted	Leavers are described as removed in the window. An extract compared with the HR list shows 11 leaver accounts still active.	24 Sep 2026	PI-01	24 Mar 2027	Not yet due	OK	DS-04-1	DS-02-2
EXAMPLE	DS-04-2	DS-04 Access	Are privileged accounts listed, owned and reviewed?	P07-A04 Access Review Scope & System Inventory	Evidenced	A privileged account list with owners, and the July review record.	24 Sep 2026		24 Mar 2027	Not yet due	OK	DS-04-1	DS-02-2
EXAMPLE	DS-05-1	DS-05 Vulnerabilities	Are systems scanned, and are findings fixed by a set deadline?	P01-A06 Vulnerability Remediation Tracker	Described only	A monthly patch cycle is described. No patch record yet seen.	25 Sep 2026		25 Mar 2027	Not yet due	OK	DS-04-1	DS-02-2
EXAMPLE	DS-05-2	DS-05 Vulnerabilities	Who owns patching for each system, and is there a maintenance window?	P01-A06 Vulnerability Remediation Tracker							OK	DS-04-1	DS-02-2
EXAMPLE	DS-06-1	DS-06 Incidents	Is there an incident plan with named roles, and was it exercised in the last 12 months?	P09-A09 Incident Case & Action Log	Evidenced	The incident plan, the log and the record of the March exercise.	25 Sep 2026		25 Mar 2027	Not yet due	OK	DS-04-1	DS-02-2
EXAMPLE	DS-06-2	DS-06 Incidents	Is every closed incident followed by a review with actions?	P09-A09 Incident Case & Action Log	Not found	No post-incident review exists for INC-2026-041, which is still open.	25 Sep 2026	PI-06	25 Mar 2027	Not yet due	OK	DS-04-1	DS-02-2, DS-06-2
EXAMPLE	DS-07-1	DS-07 Suppliers	Is there a register of suppliers, with a tier for each?	P06-A08 Supplier Security Risk Register	Evidenced	A supplier register with a tier for each of 31 suppliers.	28 Sep 2026		28 Mar 2027	Not yet due	OK	DS-04-1	DS-02-2, DS-06-2
EXAMPLE	DS-07-2	DS-07 Suppliers	Have the critical suppliers been assessed within their interval?	P06-A08 Supplier Security Risk Register	Described only	Critical suppliers are said to be assessed each year. Reports seen for some only.	28 Sep 2026	PI-09	28 Mar 2027	Not yet due	OK	DS-04-1	DS-02-2, DS-06-2
EXAMPLE	DS-08-1	DS-08 Resilience	Are backups taken for the critical systems, and are restores tested?	P23-A08 Restore Test Evidence Report Template	Described only	Restore tests are described. No test record seen yet.	29 Sep 2026	PI-08	29 Mar 2027	Not yet due	OK	DS-04-1	DS-02-2, DS-06-2
EXAMPLE	DS-08-2	DS-08 Resilience	Are recovery objectives set for the critical services?	P23-A08 Restore Test Evidence Report Template							OK	DS-04-1	DS-02-2, DS-06-2
EXAMPLE	DS-09-1	DS-09 Awareness	Do all staff complete the baseline security course in its interval?	P16-A07 Training Completion & Evidence Register							OK	DS-04-1	DS-02-2, DS-06-2
EXAMPLE	DS-09-2	DS-09 Awareness	Has the management body followed training in the last 12 months?	P16-A07 Training Completion & Evidence Register							OK	DS-04-1	DS-02-2, DS-06-2
EXAMPLE	DS-10-1	DS-10 Assurance	Are controls tested by someone other than their owner, with a plan?	P20-A09 Annual Control Testing Plan							OK	DS-04-1	DS-02-2, DS-06-2
EXAMPLE	DS-10-2	DS-10 Assurance	Are audit findings tracked to closure?	P20-A09 Annual Control Testing Plan							OK	DS-04-1	DS-02-2, DS-06-2

The first 20 rows are the items of the ten areas and stay. The last 10 rows are for items of your own: write an ID, choose an area and say what to find out. The Summary counts the 20 items by area, and your own items on one line.

Summary

Summary

Where you are in the first 90 days, and counts of items by finding and by area, worked out from the Discovery sheet. Every figure is a count. There is no score.

EXAMPLE: Kestrel Components B.V. (EXAMPLE) as at 30 Sep 2026. Clear the EXAMPLE column and the yellow cells to use your own.

Settings

The day you are working on	30 Sep 2026	The day you are working on. Enter =TODAY() to follow the calendar. The EXAMPLE date is the last day of the worked example.
Your start date	14 Sep 2026	Your first day in the role. It is day 1, and week 1 runs for seven days from it.
Check a finding again after (months)	6	A finding is checked again after this many months (TR-02). The facts' default is shown. Change it only if your method says so.

Where you are in the first 90 days

Day	17	Your start date is day 1.
Week	3	Weeks run from 1 to 13, seven days each.
Phase	Listen	The phases are on the Method sheet.
Discovery ends on	1 Nov 2026	The close of week 7 (TR-01).

Items by finding

Finding	Items	What it means
Evidenced	6	A record, a test result or a system view that you saw matches what you were told or what the document says.
Described only	5	You were told, or a document claims it, and you have seen nothing that shows it is done.
Not found	2	You asked for it, by a date, and nothing was produced and nothing could be found.
Contradicted	1	What you saw differs from what you were told or what the document says.
Not yet looked at	6	You have not yet looked. This is not a finding.
Items on the list	20	The 20 items of the ten areas.

The discovery in numbers

In one line	14 of 20 items looked at: 6 Evidenced, 5 Described only, 2 Not found, 1 Contradicted; 6 not yet looked at
Items that are Contradicted	DS-04-1
Items that are Not found	DS-02-2, DS-06-2
Areas with a contradiction	DS-04
Findings due for a second look	0	Findings whose check-again date is on or before the day you are working on, your own items included.
Which are due	None
Your own items looked at	0	Items you added below the 20. They are not in the counts above.
Rows with a check to clear	0	See the Check column on the Discovery sheet.

Items by area

Area	Items	Looked at	Evidenced	Described only	Not found	Contradicted	Contradicted so far (working)
DS-01 Governance	2	2	1	1	0	0
DS-02 Risk	2	2	1	0	1	0
DS-03 Policy	2	2	1	1	0	0
DS-04 Access	2	2	1	0	0	1	DS-04
DS-05 Vulnerabilities	2	1	0	1	0	0	DS-04
DS-06 Incidents	2	2	1	0	1	0	DS-04
DS-07 Suppliers	2	2	1	1	0	0	DS-04
DS-08 Resilience	2	1	0	1	0	0	DS-04
DS-09 Awareness	2	0	0	0	0	0	DS-04
DS-10 Assurance	2	0	0	0	0	0	DS-04

Limitations

A finding says what you saw. It does not say that a control is good, or that the programme is. It says whether proof of what was described exists.

The counts are counts of items. They never add up to a score. Do not turn them into a percentage or a traffic-light total.

The workbook cannot read your notes. Tell the owner of an item what you found before it goes into a briefing, so that nobody learns of it in a meeting.

An item you have not yet looked at is not a finding. The twenty items are a floor. Add your own for what the interviews raise.

A finding goes out of date. Check it again after the number of months set above, or at once if something material changes.

Evidenced is at least Seen in P19's words, and Described only is Told. A finding is not a maturity level. A level is set by P19's rules, from a sample of records.

Areas

The ten areas and what counts as proof

For each area: the domain it feeds in the P19-A04 Security Programme Maturity Assessment, the published document to read first, and what counts as proof. Ask for one kind of proof for each item. A statement is never proof.

Area	Assessment domain	Read first	Proof: Record	Proof: Test	Proof: System view
DS-01 Governance	DM-01 Governance and accountability	P12-A05 Management Body Cybersecurity Accountability Record	The role description, the appointment letter and the minute of the approval.	Ask two members of the management body to say what they approved.	The board portal or minute book, with the dates.
DS-02 Risk	DM-03 Risk management and exceptions	P05-A05 Information Security Risk Register	The register, the appetite statement and the acceptance forms.	Trace two risks from the register to a treatment action and its status.	The register tool, with its edit history.
DS-03 Policy	DM-02 Policy	P04-A06 Policy Register & Review Schedule	The policy register and the signed-off documents.	Pick three policies and find the approval of each.	The acknowledgement tool, with completion dates.
DS-04 Access	DM-09 Identity and access	P07-A04 Access Review Scope & System Inventory	The last access review campaign file.	Compare an extract of active accounts with the HR leaver list.	The identity system's account and privilege lists.
DS-05 Vulnerabilities	DM-08 Vulnerabilities and patching	P01-A06 Vulnerability Remediation Tracker	The scan reports and the remediation tracker.	Pick five open findings and check each against the deadline.	The scanner console, with its coverage and last run date.
DS-06 Incidents	DM-13 Incident response and notification	P09-A09 Incident Case & Action Log	The plan, the exercise report and the post-incident reviews.	Follow the latest incident from report to review.	The incident log or ticket queue.
DS-07 Suppliers	DM-04 Third-party security	P06-A08 Supplier Security Risk Register	The supplier register and the assessment reports.	Pick two critical suppliers and find the contract clauses and the last assessment.	The procurement or contract system.
DS-08 Resilience	DM-14 Recovery and continuity	P23-A08 Restore Test Evidence Report Template	The restore test reports and the recovery objectives.	Ask for a restore of one file or one system, and watch it.	The backup console, with job results.
DS-09 Awareness	DM-10 Awareness and training	P16-A07 Training Completion & Evidence Register	The completion register and the training attendance.	Pick five staff and find each completion.	The learning platform's completion report.
DS-10 Assurance	DM-06 Measurement and assessment	P20-A09 Annual Control Testing Plan	The test plan, the workpapers and the audit findings tracker.	Pick two audit findings and check each closure.	The findings tracker, with dates.

A Record is a document or a file you read. A Test is something you do or check yourself, on a sample. A System view is what the system shows you, on screen, with its dates. The two items of each area are on the Discovery sheet.

Method

How discovery works

The four phases of the first 90 days, the four findings, and the rules and cautions this workbook applies. The rules come from the First 90 Days Security Leader Checklist.

Phases

Phase	From week	To week	What it is for
Listen	1	3	Meet people, read what exists, and promise nothing. Learn who expects what.
Verify	4	7	Check what you were told against a record, a test or a system. End with the first executive briefing.
Decide	8	10	Choose the few priorities the findings support, agree the decision rights, and settle the plan.
Propose	11	13	Take the plan, the reporting rhythm and the asks to the executives and the management body.

The four findings

Finding	What it means
Evidenced	A record, a test result or a system view that you saw matches what you were told or what the document says.
Described only	You were told, or a document claims it, and you have seen nothing that shows it is done.
Not found	You asked for it, by a date, and nothing was produced and nothing could be found.
Contradicted	What you saw differs from what you were told or what the document says.
Evidenced is at least Seen in P19's words, and Described only is Told. A finding is not a maturity level. A level is set by P19's rules, from a sample of records.

Rules this workbook applies

Rule	What it says
TR-01	Change no policy, tool, team structure or priority until discovery ends at the close of week 7, except to stop harm, to act on a legal duty or to take a no-regret action. Spend the first three weeks listening.
TR-02	Every discovery finding states what was seen: a record, a test result or a system view. A statement alone is Described only. A finding is checked again after [[6]] months, or on a material change.
TR-14	Every item in the 100-day plan traces to a finding, an interview record, a handover gap or an inherited exception. The plan lists what was dropped and why. A promise outside the organisation follows the plan, and never leads it.

What not to do early

Caution	Do not, and until when
NE-1	Announce a reorganisation, a new strategy or a new tool. Not before: The Decide phase (week 8). You do not yet know what works, who does it, or what it cost to get there.
NE-3	Promise a date, a budget or a result to the executives, a customer, an auditor or a regulator. Not before: The plan is agreed (week 11). Learn before you promise. A promise made in week 2 rests on what you were told.
NE-5	Sign a statement or a form to a regulator or an auditor that you have not checked. Not before: You have seen the evidence. A statement is held against the organisation and against you.
NE-8	Buy a tool to fix a problem you have not yet shown to exist. Not before: The Decide phase (week 8). The finding comes first, then the choice, then the money.
NE-9	Treat what you were told as a finding. Not before: You have seen a record, a test or a system view. A statement alone is Described only (TR-02).

Lists

FindingList	AreaList
Evidenced	DS-01 Governance
Described only	DS-02 Risk
Not found	DS-03 Policy
Contradicted	DS-04 Access

DS-05 Vulnerabilities

DS-06 Incidents

DS-07 Suppliers

DS-08 Resilience

DS-09 Awareness

DS-10 Assurance

Definitions

Definitions

Term	Meaning in this workbook
Discovery	The work of finding out what the inherited programme does, what it only says it does and what it does not do, by asking for a record, a test or a system view.
Finding	What discovery found about one item, in one of four words: Evidenced, Described only, Not found or Contradicted.
Evidenced	A record, a test result or a system view that you saw matches what you were told or what the document says.
Described only	You were told, or a document claims it, and you have seen nothing that shows it is done.
Not found	You asked for it, by a date, and nothing was produced and nothing could be found.
Contradicted	What you saw differs from what you were told or what the document says.
Proof	A record, a test or a system view. What counts for each area is on the Areas sheet.
Second look	A finding is checked again after the number of months set on the Summary sheet, or on a material change (TR-02). A finding is Due when the check-again date is on or before the day you are working on.
New security leader	The head of security, security manager or CISO who has just taken the role. They hold the role that the earlier packs call the Head of Information Security.
Outgoing security leader	The person who held the role before. They may still be at work, may be serving a notice period, or may already have gone.
Baseline	The starting position, recorded as counts and as levels in words, with a reason wherever a value is unknown. It is never one score.
No-regret action	An action that is needed whatever the plan turns out to be, such as removing the leaver's access. It may be done before discovery ends.
DS-nn	An area of discovery. The 10 areas are listed on the Areas sheet.
DS-nn-n	An item to find out. Each area has two. The 20 items are on the Discovery sheet.
TR-nn	A requirement of the First 90 Days Security Leader Checklist, listed there and quoted on the Method sheet where this workbook applies it.
NE-n	A caution about what not to do early, from the First 90 Days Security Leader Checklist.
PI-nn	An item of the 100-Day Security Plan. In the EXAMPLE, a follow-up names the plan item that follows from a finding.
EXAMPLE	A worked example: Kestrel Components B.V. (EXAMPLE), as at 30 Sep 2026. Clear the EXAMPLE values and the yellow cells before use.

Framework References

Framework references

These references indicate relevance only and do not reproduce the text of any standard.

Framework	Reference	Supported by
ISO/IEC 27001:2022	Clause 4.1 — Understanding the organization and its context	The workbook as a whole: understanding the organisation and its context starts with finding out what the inherited programme does
NIST CSF 2.0	GV.OC-03 — “Legal, regulatory, and contractual requirements regarding cybersecurity - including privacy and civil liberties obligations - are understood and managed”	Governance area (DS-01) and the follow-up column: what is said to be understood and managed is checked against a record, a test or a system view
NIS2 — Directive (EU) 2022/2555	Article 21(1) — essential and important entities take “appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems”, and “to prevent or minimise the impact of incidents on recipients of their services and on other services”	The workbook as a whole: discovery finds out which measures the inherited programme applies and which it only describes. The Article binds the entity, and this workbook does not say whether a measure is appropriate or proportionate
NIS2 — Directive (EU) 2022/2555	Article 21(2)(a) — “policies on risk analysis and information system security”	Risk and Policy areas (DS-02 and DS-03): the risk register, the appetite statement, the policy register and the approvals that discovery asks to see
NIS2 — Directive (EU) 2022/2555	Article 21(2)(b) — the cybersecurity risk-management measures include “incident handling”	Incidents area (DS-06): the incident plan, the exercise and the reviews that follow an incident
NIS2 — Directive (EU) 2022/2555	Article 21(2)(d) — “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers”	Suppliers area (DS-07): the supplier register and the assessments of the critical suppliers
NIS2 — Directive (EU) 2022/2555	Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures”	Assurance area (DS-10): whether controls are tested by someone other than their owner, and whether audit findings are closed. Findings are also checked again after a set time
NIS2 — Directive (EU) 2022/2555	Article 21(2)(g) — “basic cyber hygiene practices and cybersecurity training”	Awareness area (DS-09): completion of the baseline course and the training of the management body
NIS2 — Directive (EU) 2022/2555	Article 21(2)(i) — “human resources security, access control policies and asset management”	Access area (DS-04): leavers' accounts and privileged accounts, checked against the human resources record

Editions referenced: Directive (EU) 2022/2555 (NIS2); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); UK NCSC board guidance and the ENISA skills framework, as their publishers state them; as published and read on 10 October 2026

ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of NIS2, or that your organisation holds a certificate.

These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.

Directive (EU) 2022/2555 is addressed to the Member States, and binds essential and important entities through their national law. Article 20 asks the Member States to ensure that the management body approves the cybersecurity risk-management measures, oversees their implementation, can be held liable for infringements of Article 21, and is required to follow training. What liability means for a member of a management body depends on national law, and counsel confirms it. Whether your organisation is an essential or an important entity comes from its scope assessment and from counsel, and this pack does not decide it.

The NCSC's Code and toolkit and the ENISA skills framework are voluntary guidance. They are not law. They say what boards might expect and what roles typically do. They do not say what a new security leader must do, and no law named here says how a handover must be run. Following them is not a statement that your organisation complies with NIS2 or any standard.

This pack does not say which document, record or practice meets a requirement of NIS2. Each reference says what its source asks of the management body or the organisation and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.