Security Function Handover Document
Structured handover from an outgoing leader covering open risks, incidents, commitments, suppliers and access.
Available soon
- Format
- Word
- Size
- 66 KB
- Length
- 22 pages
- Version
- 1.2
- Updated
What's inside
Preview
The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded guidance boxes are for you to delete before approval. The cover and document control pages are in the file.
How to use this form
Learn before you promise. Find out what is real, not what is claimed. Decide who decides. Show the starting position, so that progress can be shown.
This form passes a security function from the person who ran it to the person who now runs it. The outgoing leader completes it before they leave. The new leader checks each section against a record, a test or a system view, and adds what is missing. It holds eighteen sections, HD-01 to HD-18. The other documents in the CISO Transition, Handover & First 90 Days pack cite them by those numbers. The sign-off section, HD-12, keeps its number and comes last, after HD-13 to HD-18.
The form is a record of what the outgoing leader believes, holds and has promised. It is not proof. The new leader treats each entry as Described only until they have seen something that shows it is so (TR-02).
Legal note. This document helps a new head of security, and the one who is leaving, to hand over and take over a security function. It is not legal advice and not advice on employment. It does not say that you comply with NIS2 or any standard. What liability means for a member of a management body, what an outgoing leader may be asked to hand over under their contract, and whether your organisation is an essential or an important entity are for counsel to confirm.
Who does what
- Outgoing security leader completes the handover document, lists what they hold and have promised, introduces the new leader to contacts and hands over access and accounts. Where they have gone, the new leader builds the handover from records.
- New security leader learns the programme, interviews the stakeholders, verifies what is claimed, keeps the discovery workbook, agrees the decision rights, proposes the plan and reports counts. Promises nothing until it is checked.
- Executive sponsor agrees the decision-rights arrangement and the plan in writing, opens doors to the other executives and the management body, and decides what only an executive may decide.
Rules the form puts into practice
TR-06 The outgoing leader completes the handover document (A05) before they leave. Where they have gone, the new leader builds it from records and writes down what is missing. A section with nothing in it says None, with a date, and who said so.
TR-08 Assume the outgoing leader's access was never removed. Unless the removal is already confirmed against a fresh extract, have IT disable it on your first day: accounts, administrator rights, tokens, shared secrets, vendor portals and any personal account used for work. Then confirm the removal against a fresh extract within [[2]] working days of the start, as P07 AR-07 asks of any removal.
TR-09 In week 1, list every open incident and every open reporting duty, and confirm in writing who holds each incident role and who deputises (P09 IM-03). For each open incident, ask the incident manager whether the reporting screen is recorded (P09 IM-06) and whether the notice condition of the cyber insurance policy has been checked (P09 RD-15). Where nobody has assessed either, ask for it now. The roles, decision rights and clocks are P09's and P18's, unchanged.
TR-16 Keep the handover document, the interview records, the decision-rights arrangement and the plan for [[3]] years, the P22 records period, or longer where a contract or a law asks.
Filling in the form
- Complete every section. Where nothing exists, say so. A section with no entries is a gap, unless None is an acceptable answer and has a date and a name beside it (HD-03, HD-04, HD-05, HD-06, HD-07, HD-13, HD-14, HD-15, HD-16, HD-17, HD-18).
- None is not an acceptable answer for HD-01, HD-02, HD-08, HD-09, HD-10, HD-11, HD-12. Those sections always have something to say.
- Write where a secret is held and how it passes to the new leader. Never write a password, a token or a key in this document.
- Say when the outgoing leader expects more to follow. Mark that section Partial, with the date the rest is due.
- Keep this document at the classification you set on the cover. It lists accounts, contacts and open weaknesses.
Guidance — delete before approval
Allow the outgoing leader a few working days to complete it, and book a meeting of an hour or two to go through it with the new leader. A short, honest form with its gaps marked is worth more than a long one that hides them.
Where the outgoing leader has already gone, or will not complete the form, the new leader builds it from records and writes down what is missing (see Building the form from records).
The handover is one input to the Inherited Security Programme Discovery Workbook. Its gaps feed the 100-Day Security Plan, where each gap that needs work becomes an item with the section as its source.
The handover at a glance
Fill in this table last. It shows, for each section, how many entries it holds, the kind of gap if there is one, and the result of the new leader's check. Report it in counts: for example "11 of 18 sections complete; 7 gaps (4 missing, 2 partial, 0 access, 1 unsigned)". Never add it up into a score.
Section | None allowed | Entries | Gap, if any | New leader's check |
|---|---|---|---|---|
HD-01 Purpose and scope | No | |||
HD-02 Roles and authority held | No | |||
HD-03 Open risks | Yes | |||
HD-04 Exceptions and risk acceptances | Yes | |||
HD-05 Incidents | Yes | |||
HD-06 Commitments | Yes | |||
HD-07 Suppliers | Yes | |||
HD-08 Regulators and contacts | No | |||
HD-09 Access and accounts | No | |||
HD-10 Programme state | No | |||
HD-11 Calendar | No | |||
HD-13 Legal matters and regulator correspondence | Yes | |||
HD-14 Audit findings, certificates and attestations | Yes | |||
HD-15 Insurance cover and its conditions | Yes | |||
HD-16 Known exposure and accepted weaknesses | Yes | |||
HD-17 Team, key people and personnel matters | Yes | |||
HD-18 Concerns the outgoing leader has not raised | Yes | |||
HD-12 Documents and sign-off | No |
The four kinds of gap. A section is complete when it lists entries, or says None with a date and a name where None is allowed. It has one of these gaps when it falls short.
Gap | What it means | What happens next |
|---|---|---|
Missing | No entries, and no dated None from a named person. Where None is not allowed: no entries. none is not an acceptable answer here. | Ask the outgoing leader, or build the section from records. If it stays empty, write what is missing and who was asked, with the date. Where None is allowed, a dated None from a named person closes the gap. |
Partial | The outgoing leader says more is to follow. | Ask for the date the rest will come. Record what has been received. Until the rest arrives, the section is not complete. |
Access not confirmed removed | The removal is not confirmed against a fresh extract (TR-08). | Take a fresh extract and compare it with the list. Remove what remains, and confirm again (TR-08). |
Not signed | The outgoing and the new leader have not both signed. | Both leaders sign when the gaps are listed and dated. Where the outgoing leader has gone, the new leader signs alone and writes that on the form. |
The four words for the new leader's check. Each section is checked, and the result is one of these. They are the same words the discovery workbook uses.
Word | What it means |
|---|---|
Evidenced | A record, a test result or a system view that you saw matches what you were told or what the document says. |
Described only | You were told, or a document claims it, and you have seen nothing that shows it is done. |
Not found | You asked for it, by a date, and nothing was produced and nothing could be found. |
Contradicted | What you saw differs from what you were told or what the document says. |
Evidenced is at least Seen in P19's words, and Described only is Told. A finding is not a maturity level. A level is set by P19's rules, from a sample of records.
The eighteen sections
Each section has the same layout: what to list, the rule on None, a table for the entries, and how the new leader checks it. Add rows as you need them. If a table is too small, attach the list and write its location in the table.
HD-01 Purpose and scope
List: The date of the handover, the scope, who wrote it, and what it leaves out.
None: None is not an acceptable answer here. If the section is empty, say what is missing and who was asked.
Item | Entry |
|---|---|
Date of the handover | [[YYYY-MM-DD]] |
Outgoing leader | [[name and title]] |
Last working day, and the end of the notice period | [[YYYY-MM-DD]] |
New leader and start date | [[name, title, YYYY-MM-DD]] |
Completed by the outgoing leader, or built from records | [[Completed by the outgoing leader / Built by the new leader from records]] |
What this handover covers | [[the security function, its sites and systems]] |
What it leaves out, and why | [[or None, with a date and a name]] |
Written by, and on | [[name, YYYY-MM-DD]] |
New leader checks (TR-06): Read the scope against the eighteen sections. Ask the outgoing leader, or whoever knows, what the document leaves out.
HD-02 Roles and authority held
List: Each role the outgoing leader held, each authority and delegation, and each committee seat.
None: None is not an acceptable answer here. If the section is empty, say what is missing and who was asked.
Role, authority or seat | Held under | Passes to | Open matter |
|---|---|---|---|
New leader checks (TR-05): Read the appointment letter, the role description and the delegation records. Ask the executive sponsor to confirm each authority in writing.
HD-03 Open risks
List: Each risk the outgoing leader tracks, its owner, its band and its next step.
None: None is an acceptable answer here. Write None, with the date and the name of the person who said so. A blank section is a gap.
Risk ID | Risk | Owner | Band | Next step and date |
|---|---|---|---|---|
Use the scales and bands set in P05-A02 Risk Assessment Methodology & Scoring Model. A risk the outgoing leader tracks but has not put on the register is listed here and marked so.
New leader checks (TR-02): Compare each entry with the risk register. Check the owner and the band. Note any risk held only in the outgoing leader's notes.
HD-04 Exceptions and risk acceptances
List: Each exception and acceptance in force, who approved it, its band and its review date.
None: None is an acceptable answer here. Write None, with the date and the name of the person who said so. A blank section is a gap.
ID | Exception or acceptance | Approved by, and on | Band | Review date | Past review |
|---|---|---|---|---|---|
Read each one before the new leader renews it. An exception is approved by the approver its band sets (P02 EX-05), and a risk acceptance by the approver its band sets (P05 RM-08). Outside appetite, executive management signs as well, outside tolerance only the board or its equivalent, and a Severe residual impact adds approvers (P05 RM-13). The new leader takes the decision only where the published rule names the Head of Information Security (Transition Decision Rights Matrix).
New leader checks (TR-07): Read each form. Check the approver against the band, and the review date. Renew, change or close each one that is past it. Nothing continues by default.
HD-05 Incidents
List: Each open incident, and each closed in the last 12 months with its review, and each reporting duty still open.
None: None is an acceptable answer here. Write None, with the date and the name of the person who said so. A blank section is a gap.
Incident or duty ID | What it is | Opened, and its status | Still open | Incident manager and deputy |
|---|---|---|---|---|
Roles, decision rights, severities and reporting clocks belong to the Security Incident Management pack and the Regulatory Incident Notification & Reporting pack. Do not restate them here. Name who holds each incident role and who deputises, and list what is open.
New leader checks (TR-09): Compare with the incident log for the last 12 months. Confirm in writing who holds each incident role and who deputises. For each open incident, ask the incident manager for the recorded outcome of the reporting screen (P09 IM-06).
HD-06 Commitments
List: Each promise to a regulator, a customer, an auditor, an insurer or the management body, with its due date and owner.
None: None is an acceptable answer here. Write None, with the date and the name of the person who said so. A blank section is a gap.
ID | Promise | Made to, by whom, on | Due | Owner | Where written down |
|---|---|---|---|---|---|
A promise to a customer may also be in the questionnaire tracker (P26-A07 Questionnaire Request Tracker). List it here as well, so that nothing depends on one tracker.
New leader checks (TR-04): Look for each promise in writing: a contract, an email, a form or a minute. Add any you find that the list lacks. Check that a promise can be kept before you repeat it.
HD-07 Suppliers
List: Each critical supplier, its contact, its last assessment, and each open finding or renewal.
None: None is an acceptable answer here. Write None, with the date and the name of the person who said so. A blank section is a gap.
Supplier | Tier | Named contact | Last assessment | Open finding or renewal |
|---|---|---|---|---|
New leader checks (TR-10): Compare with the supplier register. Call each named contact and check the last assessment of each Tier 1 supplier.
HD-08 Regulators and contacts
List: The regulator, the CSIRT, the insurer and the responders, with the named contact and the registration details.
None: None is not an acceptable answer here. If the section is empty, say what is missing and who was asked.
Body or party | Named contact and deputy | Registration or account details | Confirmed by a call on |
|---|---|---|---|
Regulator or competent authority | [[name]] | [[registration details]] | |
CSIRT | [[name]] | [[registration details]] | |
Insurer | [[name]] | [[policy and claims line]] | |
Incident responders | [[name]] | [[retainer and call-out details]] | |
[[Other, e.g. the auditor or a sector body]] |
New leader checks (TR-10): Confirm each contact by a call or a message, never from the list. Record the date of each confirmation.
HD-09 Access and accounts
List: Each account, administrator right, token, shared secret and vendor portal login held by the outgoing leader or known only to them.
None: None is not an acceptable answer here. If the section is empty, say what is missing and who was asked.
Account, right, token, secret or portal | System and owner | Known only to the outgoing leader | Removed or handed over on | Confirmed on a fresh extract |
|---|---|---|---|---|
Include any personal account the outgoing leader used for work, any shared secret only they knew, and any vendor portal where they were the only administrator.
New leader checks (TR-08): Take a fresh extract of accounts and privileged rights, and compare it with this list and with the HR leaver record. Ask each system owner for any account only the outgoing leader knew.
HD-10 Programme state
List: Projects, budget, team, tools, licences and contracts, with their renewal dates.
None: None is not an acceptable answer here. If the section is empty, say what is missing and who was asked.
Project, budget line, post, tool, licence or contract | Owner | State | Renewal or end date |
|---|---|---|---|
New leader checks (TR-02): Compare the contracts and licences with the finance record. Ask the executive sponsor which budget lines are committed.
HD-11 Calendar
List: Every date due in the next 90 days: audits, reports, renewals, tests and regulator deadlines.
None: None is not an acceptable answer here. If the section is empty, say what is missing and who was asked.
Date | What is due | Owner | Source (audit plan, contract, regulator, customer) |
|---|---|---|---|
Look 90 days ahead from the start date of the new leader. The First-Year Security Operating Calendar takes the later dates.
New leader checks (TR-02): Compare with the board secretary's calendar, the audit plan, the contract renewals and the regulator dates. Add any date the list lacks.
HD-13 Legal matters and regulator correspondence
List: Each open claim, legal hold, investigation, regulator inquiry or letter, with who holds it and its next date.
None: None is an acceptable answer here. Write None, with the date and the name of the person who said so. A blank section is a gap.
Matter | Kind: claim, legal hold, investigation, inquiry or letter | Held by | Next date | Where the file is |
|---|---|---|---|---|
New leader checks (TR-02): Ask Legal for its own list and compare it with this one. Ask whether anything you now hold is covered by a legal hold. Ask Legal, HR and the data protection officer before anyone searches a mailbox for matters.
HD-14 Audit findings, certificates and attestations
List: Each open finding from an internal or external audit, and each certificate, attestation or report the organisation holds, with its scope and its expiry date.
None: None is an acceptable answer here. Write None, with the date and the name of the person who said so. A blank section is a gap.
Finding, certificate or attestation | Audit or scope | Owner | Due or expiry date | Status |
|---|---|---|---|---|
New leader checks (TR-02): Compare with the internal audit tracker, the last external audit reports and the files of each certificate or attestation. Check each expiry date against the calendar section.
HD-15 Insurance cover and its conditions
List: Each cyber or related insurance policy: the insurer and broker, the cover, the exclusions, the notice conditions and the renewal date.
None: None is an acceptable answer here. Write None, with the date and the name of the person who said so. A blank section is a gap.
Policy | Insurer and broker | Cover and exclusions | Notice conditions | Renewal date |
|---|---|---|---|---|
A policy's notice conditions may start a clock for the organisation. The new leader reads them with the incident manager. The incident pack sets the roles and the clocks (P09 RD-15), and this form restates none of them.
New leader checks (TR-09): Ask the broker for the policy and its schedule. Read the notice conditions and the exclusions, and check them against each open incident (P09 RD-15).
HD-16 Known exposure and accepted weaknesses
List: Each weakness the outgoing leader knows of and has not fixed or put on a register: unpatched systems, exposed services, unsupported software and workarounds.
None: None is an acceptable answer here. Write None, with the date and the name of the person who said so. A blank section is a gap.
Weakness or workaround | System and owner | Why it is not fixed | Known to | Next step and date |
|---|---|---|---|---|
New leader checks (TR-02): Compare with the scan results, the exception register and the asset list. Add what they show that the outgoing leader did not list.
HD-17 Team, key people and personnel matters
List: Each team member and what they own, each person the programme depends on, open personnel matters, notice dates and promises made to the team.
None: None is an acceptable answer here. Write None, with the date and the name of the person who said so. A blank section is a gap.
Person or role | What they own | What depends on them | Notice, leave or retention matter | Promise made to them |
|---|---|---|---|---|
New leader checks (TR-03): Meet each person one to one. Ask HR, and not the team, about notice and leave. Treat a personnel matter as confidential, and share it only with those who need it.
HD-18 Concerns the outgoing leader has not raised
List: Anything the outgoing leader worries about, regrets or has not told the executives, in their own words: a weakness, a person, a decision or a promise.
None: None is an acceptable answer here. Write None, with the date and the name of the person who said so. A blank section is a gap.
Concern | Why it matters | Told to | Date |
|---|---|---|---|
Ask the outgoing leader to write this section last, and in their own words. It is a place for what the other sections have no room for.
New leader checks (TR-02): Read it, and talk it through with the outgoing leader if you can. It is what they believe. Treat it as Described only until you have seen a record, a test or a system view.
HD-12 Documents and sign-off
List: Where the records are kept, and the signatures of the outgoing leader and the new leader with the date.
None: None is not an acceptable answer here. If the section is empty, say what is missing and who was asked.
Record | Where it is kept | Who holds it |
|---|---|---|
The handover document, with its evidence | [[location]] | [[role]] |
The risk register and the exception register | [[location]] | [[role]] |
The incident log and the commitments list | [[location]] | [[role]] |
The access and account inventory | [[location]] | [[role]] |
The outgoing leader's working files and notes | [[location]] | [[role]] |
Signatures. Each leader signs when the gaps above are listed and dated. Signing is a record that the form was handed over. It does not say that every entry is true.
Before the new leader signs. Signing the form records the handover. It does not repeat any statement inside it. Before you sign any other statement in your name, ask counsel what you are signing and whether you have cover (NE-5).
Person | Role | Signature | Date |
|---|---|---|---|
[[outgoing leader]] | Outgoing security leader | ||
[[new leader]] | New security leader |
New leader checks (TR-06): Confirm that each record is where the list says. Do not sign until the gaps above are listed and dated.
Guidance — delete before approval
Keep the eighteen section numbers. If you remove a section, keep its number and write "Not used", with the reason, so that records that cite it still point to the right place. The 100-Day Security Plan and the Security Posture Baseline Scorecard cite these numbers.
Add a row for anything the outgoing leader holds that the form does not ask about, such as a verbal promise, a role on an outside body, or a private arrangement with a supplier.
Building the form from records
TR-06 says that where the outgoing leader has gone, the new leader builds the document from records and writes down what is missing. Do not wait for it. Start in week 1.
Section area | Where to look |
|---|---|
Risks and exceptions | The risk register, the exception register and the approval forms. |
Incidents | The incident log, the post-incident reviews, the reporting records and the call-out records. |
Commitments | The customer, auditor and regulator correspondence, the contracts and the questionnaire tracker. Ask Legal, HR and the data protection officer before anyone searches the sent folder of the outgoing leader's mailbox. |
Legal matters and audit | Legal's own list of open matters, the internal audit tracker and the files of each certificate or attestation. |
Insurance | The policy and its schedule, from the broker or the finance record. |
People | The HR record of the team, notice and leave, and a one to one with each person. |
Suppliers and contacts | The supplier register, the contract system, the finance record of payments and the outgoing leader's contacts. |
Access | The identity system's account and privilege lists, the vendor portal admin lists and the password manager's shared vaults. |
Programme state and dates | The project list, the contract and licence renewals, the audit plan and the board calendar. |
Mark each section Built from records on the cover table, and say who was asked for what the records do not show. Ask the outgoing leader's manager, their team and the people who worked with them. Many outgoing leaders will answer a short question after they have left, if they are asked politely and early.
A mailbox holds personal data and private messages. Before anyone searches the outgoing leader's mailbox, ask Legal, HR and the data protection officer how a search may be done, who may do it and what is kept. If the search is part of a legal matter, ask counsel who should direct it.
Guidance — delete before approval
Whether an outgoing leader may be asked to help after their last day depends on their contract and on any agreement on leaving. Legal and HR confirm that, and Legal decides how to ask. Nothing in this form is advice on employment.
Common mistakes
Mistake | What to do instead |
|---|---|
Treating the handover document as the truth. | It is what the outgoing leader believed. Check each part against a record, a test or a system view (TR-02). |
Promising a date, a budget or a result in the first weeks. | Note it, check it can be kept, and say so before you commit (TR-04). |
Forgetting the outgoing leader's accounts, tokens and portal logins. | Assume they were never removed. Have IT disable them on your first day unless removal is confirmed, and confirm against a fresh extract (TR-08). |
Blaming the outgoing leader in front of others. | Record what you find, not who is to blame. The people who built it will tell you the most. |
Roles and responsibilities
Role | What they do in the handover |
|---|---|
Outgoing security leader [[name of the predecessor]] | Completes the handover document, lists what they hold and have promised, introduces the new leader to contacts and hands over access and accounts. Where they have gone, the new leader builds the handover from records. |
New security leader [[name of the new Head of Information Security or CISO]] | Learns the programme, interviews the stakeholders, verifies what is claimed, keeps the discovery workbook, agrees the decision rights, proposes the plan and reports counts. Promises nothing until it is checked. |
Executive sponsor [[e.g. chief executive or chief operating officer]] | Agrees the decision-rights arrangement and the plan in writing, opens doors to the other executives and the management body, and decides what only an executive may decide. |
HR [[HR lead]] | Confirms the leaver and joiner records, the outgoing leader's departure date and notice terms, and the new leader's training and onboarding. |
Legal [[in-house or external counsel]] | Confirms what the outgoing leader must hand over, what commitments to customers and regulators exist, and what the management body's liability means. |
Head of IT [[Head of IT]] | Gives the new leader system views, the account inventory and the change calendar, and removes access. |
Data Protection Officer [[or the privacy lead where no DPO is appointed]] | Gives the new leader the records of processing, breach decisions and open data protection matters. |
The matrix shows who is responsible (R), accountable (A), consulted (C) and informed (I). Columns, in order: New for new security leader; Out for outgoing security leader; Spons for executive sponsor; Body for management body; HR for HR; Legal for Legal; DPO for data Protection Officer; IT for Head of IT.
Activity | New | Out | Spons | Body | HR | Legal | DPO | IT |
|---|---|---|---|---|---|---|---|---|
TX-02 Complete the handover document | C | A | I | C | C | C | ||
TX-03 Remove the outgoing leader's access and confirm it | A | I | C | R | ||||
TX-05 Look for the proof and record the findings | A | C | C | C | C | |||
TX-07 Confirm the incident roles and list the open incidents and duties | A | C | I | C | C | |||
TX-08 Confirm the regulator, responder and supplier contacts | A | C | R |
The rules of the Security Policy Management pack on who approves a document apply to this form. Nobody approves a form they completed.
Related documents
Document | Relationship |
|---|---|
First 90 Days Security Leader Checklist | Week 1 asks for this form, and the checklist says what to do with its gaps |
Inherited Security Programme Discovery Workbook | Each section is checked against a record, a test or a system view, and the result recorded in the four words |
Stakeholder Interview Guide & Record | The interviews ask what was promised to each group, which the commitments section should hold |
Transition Decision Rights Matrix | Sets who decides what in the first 90 days, so that the new leader does not assume every right the outgoing leader held |
100-Day Security Plan | Each gap that needs work becomes a plan item, with the section as its source |
First-Year Security Operating Calendar | Takes the dates in the calendar section forward for the first year |
P02-A02 Security Exception & Waiver Standard | An exception is approved by the approver its band sets. The new leader reviews inherited exceptions with it. |
P05-A02 Risk Assessment Methodology & Scoring Model | The scales and bands that rate a risk, and who may accept it. |
P05-A08 Risk Acceptance Form & Approval Record | The record of an accepted risk and its review date. |
P06-A03 Supplier Security Assessment Procedure | How a supplier is assessed, and when it is assessed again. |
P07-A02 Access Review Methodology | How often access is reviewed, and how fast a removal must happen. |
P09-A03 Incident Response Plan | The incident response plan, its roles and its decision rights. P27 changes none of them. |
P26-A07 Questionnaire Request Tracker | The tracker of customer questionnaires and the commitments made in them. |
[[Information Security Policy; leaver and joiner procedure; your own contract with the outgoing leader]] | [[Parent policy; how access is removed; what the outgoing leader may be asked to hand over]] |
Definitions
Term | Meaning in this form |
|---|---|
Handover | The passing of what the outgoing leader knows, holds and has promised to the new leader, in writing. |
New security leader | The head of security, security manager or CISO who has just taken the role. They hold the role that the earlier packs call the Head of Information Security. |
Outgoing security leader | The person who held the role before. They may still be at work, may be serving a notice period, or may already have gone. |
Inherited | Held, accepted or promised before the new leader started: an exception, a risk acceptance, a contract, a commitment to a customer or a regulator, or an open incident. |
Finding | What discovery found about one item, in one of four words: Evidenced, Described only, Not found or Contradicted. |
Executive sponsor | The executive the new leader reports to, who agrees the arrangement and the plan, and who speaks for the leader to the management body. |
Worked example: Kestrel on 30 Sep 2026
EXAMPLE, not part of the form. Kestrel Components B.V. (EXAMPLE) is a manufacturer of industrial pumps and valves in an EU Member State, with about 600 staff and two plants, treated as an important entity under NIS2 (manufacturing), on its own scope assessment, which counsel has not yet re-checked. It is not the organisation used in the other packs. Replace it with your own, or delete this section before approval.
Jonas Brandt, the Head of Information Security, left on 28 Aug 2026 after a three-week notice period and a partial handover. Sam Okafor started on 14 Sep 2026. By 30 Sep 2026 it was day 17 of the first 90 days. The new leader checked the form and recorded this.
Section | Entries | Result |
|---|---|---|
HD-01 Purpose and scope | 1 | Complete |
HD-02 Roles and authority held | 3 | Complete |
HD-03 Open risks | 12 | Complete |
HD-04 Exceptions and risk acceptances | 5 | Complete |
HD-05 Incidents | 1 | Complete |
HD-06 Commitments | 0 | Missing No entries, and no dated None from a named person. |
HD-07 Suppliers | 4 | Complete |
HD-08 Regulators and contacts | 2 | Partial The outgoing leader says more is to follow. |
HD-09 Access and accounts | 6 | Complete |
HD-10 Programme state | 6 | Complete |
HD-11 Calendar | 0 | Missing No entries. None is not an acceptable answer here. |
HD-12 Documents and sign-off | 1 | Not signed The outgoing and the new leader have not both signed. |
HD-13 Legal matters and regulator correspondence | 0 | Missing No entries, and no dated None from a named person. |
HD-14 Audit findings, certificates and attestations | 3 | Complete |
HD-15 Insurance cover and its conditions | 0 | Missing No entries, and no dated None from a named person. |
HD-16 Known exposure and accepted weaknesses | 2 | Complete |
HD-17 Team, key people and personnel matters | 1 | Partial The outgoing leader says more is to follow. |
HD-18 Concerns the outgoing leader has not raised | 0 | Complete |
The position: 11 of 18 sections complete; 7 gaps (4 missing, 2 partial, 0 access, 1 unsigned). The new leader listed the 7 gaps, asked for the missing sections, and put each one in the plan with its section as its source (100-Day Security Plan).
Section HD-04 as found
The handover lists 5 entries. Two exceptions were approved by Jonas Brandt and were past their review dates by 2026-09-30. The three acceptances were in date. The new leader reviews the two exceptions, and the approvers below are the ones each band sets, from the earlier packs.
ID | What | Approved by, and on | Band | Review date | Past review |
|---|---|---|---|---|---|
IE-1 Exception | Legacy order-entry server without multi-factor sign-in | Jonas Brandt, 4 Mar 2026 | Medium | 31 Aug 2026 | Yes, by 30 days |
IE-2 Exception | Shared engineering account on the plant network | Jonas Brandt, 17 Jun 2026 | High | 15 Sep 2026 | Yes, by 15 days |
RA-1 Acceptance | Unsupported operating system on one test rig | [[as the form says]] | Low | 30 Nov 2026 | No |
RA-2 Acceptance | Shared inbox for supplier invoices | [[as the form says]] | Medium | 29 Jan 2027 | No |
RA-3 Acceptance | No offline backup for one plant's design archive | [[as the form says]] | High | 14 Dec 2026 | No |
Approver for the review, by band: IE-1 (Medium): Head of Information Security; IE-2 (High): Head of Information Security and Accountable executive.
Section HD-05 as found
One incident was open at the handover: INC-2026-041, Severity 2, opened 24 Aug 2026. A phishing-led mailbox compromise in the finance team. Status: contained, not closed. What stays open: The recovery criteria (P09 IM-10) are not recorded as met. The post-incident review (P09 IM-11) has not been held. The reporting screen (P09 IM-06) is recorded by the incident manager. Its outcome is [[to confirm with the incident manager]], and so is whether the insurer's notice condition (P09 RD-15) was checked.
Section HD-09 listed 6 accounts, rights and portal logins. The leaver process should have removed them when Jonas Brandt left on 28 Aug 2026. The first fresh extract is dated 16 Sep 2026, day 3, and it confirms the removal from that day. Nothing shows the state of the accounts between 28 Aug 2026 and 16 Sep 2026, so the new leader asked IT for the sign-in log for that period.
Guidance — delete before approval
The values above are the example's. Replace them with yours. Nothing in the example says how your handover will look.
Adapting this template
Small organisation
Guidance — delete before approval
In a small organisation the outgoing leader may also have been the only person in the security function, so the form may hold most of what anyone knows. Ask them to complete HD-09 first, because access is the section that cannot wait. Keep all eighteen sections, and write short entries. Where the outgoing leader and the executive sponsor were the same person, ask a colleague or an adviser to read the form with the new leader.
A short form is enough: one line per risk, supplier and promise, and a pointer to where the detail is kept.
Regulated entity
Guidance — delete before approval
If you are an essential or an important entity under NIS2, the management body approves the cybersecurity risk-management measures and oversees their implementation (NIS2 Article 20). Tell it, through the executive sponsor, that the head of security has changed and what has been handed over. Counsel confirms what that means for the liability of the management body, and what an outgoing leader may be asked to hand over. NIS2 Article 32(6) asks Member States to ensure that any natural person responsible for, or acting as a legal representative of, an essential entity on the basis of the power to represent it, the authority to take decisions on its behalf or the authority to exercise control of it has the power to ensure its compliance. It also asks Member States to ensure that it is possible to hold such persons liable for breach of their duties to ensure compliance. Article 33(5) applies that paragraph to important entities. For an essential entity, Article 32(5)(b) goes further. Where enforcement measures prove ineffective and a deadline set by the competent authority passes, the authority may request that the relevant bodies, courts or tribunals, in accordance with national law, temporarily prohibit a natural person responsible for managerial responsibilities at chief executive officer or legal representative level from exercising managerial functions in that entity. Whether a head of security is one of these persons depends on national law and on the role. Counsel confirms. Read on 24 October 2026 from the Publications Office text of Directive (EU) 2022/2555. If the organisation files reports with the US Securities and Exchange Commission, two rules touch the head of security. Regulation S-K Item 106 (17 CFR 229.106) asks the company to describe its processes for assessing, identifying and managing material risks from cybersecurity threats. It also asks for the board's oversight of those risks and for management's role in assessing and managing them, including which management positions or committees are responsible and the relevant expertise of the people in them. Form 8-K Item 1.05 asks the company, where it experiences a cybersecurity incident that it determines to be material, to describe the material aspects of the nature, scope and timing of the incident and its material impact or reasonably likely material impact on the company. A foreign private issuer reports the equivalent on Form 20-F and Form 6-K. Ask counsel what the company has said under Item 106 about your role, and who makes the materiality determination. The earlier incident pack sets the Form 8-K duty and its clock. Source: SEC Release No. 33-11216 and 17 CFR 229.106, read on 24 October 2026. A regulated entity also hands over its registration with the authority and its open notifications in HD-05 and HD-08. The notification duties, roles and clocks stay with the Security Incident Management pack and the Regulatory Incident Notification & Reporting pack.
IT and services run by suppliers
Guidance — delete before approval
If your managed IT provider, your security service provider or another outsourced service provider runs part of the security function, list it in HD-07 and HD-10, with its named contact and its contract renewal date. Ask it to confirm what it holds for the outgoing leader: accounts, alert routing, escalation contacts and any shared secrets. Where the outgoing leader was an external adviser or an interim, the contract says what they must hand over, and Legal confirms that.
Delete this section before approval.
Framework references
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. Editions referenced: Directive (EU) 2022/2555 (NIS2); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); UK NCSC board guidance and the ENISA skills framework, as their publishers state them; as published and read on 10 October 2026.
Framework | Reference | Supported by |
|---|---|---|
ISO/IEC 27001:2022 | Annex A 5.2 — Information security roles and responsibilities | Roles and responsibilities: the form states each role and authority the outgoing leader held, and who takes it |
NIST CSF 2.0 | GV.RR-02 — “Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced” | Roles and authorities: the form records which are established, communicated and handed on, in writing |
NIS2 — Directive (EU) 2022/2555 | Article 21(2)(b) — the cybersecurity risk-management measures include “incident handling” | Incident handling: section HD-05 hands over each incident still open, and the roles that run it |
NIS2 — Directive (EU) 2022/2555 | Article 21(2)(d) — “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers” | Supply chain security: section HD-07 hands over each critical supplier, its contact and its last assessment |
NIS2 — Directive (EU) 2022/2555 | Article 21(2)(i) — “human resources security, access control policies and asset management” | Access control and asset management: section HD-09 hands over the accounts and rights, and section HD-10 the contracts and licences |
NIS2 — Directive (EU) 2022/2555 | Article 23(1) — notify the CSIRT or competent authority, without undue delay, of any significant incident; where appropriate, notify the recipients of the services of significant incidents likely to adversely affect those services | Notification duties: section HD-05 lists any reporting duty still open. The duty, its roles and its clock stay with the incident and reporting packs |
Directive (EU) 2022/2555 is addressed to the Member States, and binds essential and important entities through their national law. Article 20 asks the Member States to ensure that the management body approves the cybersecurity risk-management measures, oversees their implementation, can be held liable for infringements of Article 21, and is required to follow training. What liability means for a member of a management body depends on national law, and counsel confirms it. Whether your organisation is an essential or an important entity comes from its scope assessment and from counsel, and this pack does not decide it.
ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of NIS2, or that your organisation holds a certificate.
A reference says what its source asks of the management body or the organisation, and which CISO Times document helps with that work. It does not say that a document from this pack meets a requirement of NIS2.
This pack does not say which document, record or practice meets a requirement of NIS2. Each reference says what its source asks of the management body or the organisation and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.