Security Function Handover Document
Structured handover from an outgoing leader covering open risks, incidents, commitments, suppliers and access.
Available soon
- Format
- Word
- Size
- 62 KB
- Length
- 18 pages
- Version
- 1.0
- Updated
What's inside
What changed
- 1.0
Published.
Preview
The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded guidance boxes are for you to delete before approval. The cover and document control pages are in the file.
How to use this form
Learn before you promise. Find out what is real, not what is claimed. Decide who decides. Show the starting position, so that progress can be shown.
This form passes a security function from the person who ran it to the person who now runs it. The outgoing leader completes it before they leave. The new leader checks each section against a record, a test or a system view, and adds what is missing. It holds twelve sections, HD-01 to HD-12. The other documents in the CISO Transition, Handover & First 90 Days pack cite them by those numbers.
The form is a record of what the outgoing leader believes, holds and has promised. It is not proof. The new leader treats each entry as Described only until they have seen something that shows it is so (TR-02).
Legal note. This document helps a new head of security, and the one who is leaving, to hand over and take over a security function. It is not legal advice and not advice on employment. It does not say that you comply with NIS2 or any standard. What liability means for a member of a management body, what an outgoing leader may be asked to hand over under their contract, and whether your organisation is an essential or an important entity are for counsel to confirm.
Who does what
- Outgoing security leader completes the handover document, lists what they hold and have promised, introduces the new leader to contacts and hands over access and accounts. Where they have gone, the new leader builds the handover from records.
- New security leader learns the programme, interviews the stakeholders, verifies what is claimed, keeps the discovery workbook, agrees the decision rights, proposes the plan and reports counts. Promises nothing until it is checked.
- Executive sponsor agrees the decision-rights arrangement and the plan in writing, opens doors to the other executives and the management body, and decides what only an executive may decide.
Rules the form puts into practice
TR-06 The outgoing leader completes the handover document (A05) before they leave. Where they have gone, the new leader builds it from records and writes down what is missing. A section with nothing in it says None, with a date, and who said so.
TR-08 Remove the outgoing leader's access on the day they leave: accounts, administrator rights, tokens, shared secrets, vendor portals and any personal account used for work. Confirm the removal against a fresh extract within [[2]] working days, as P07 AR-07 asks of any removal.
TR-09 In week 1, list every open incident and every open reporting duty, and confirm in writing who holds each incident role and who deputises (P09 IM-03). The roles, decision rights and clocks are P09's and P18's, unchanged.
TR-16 Keep the handover document, the interview records, the decision-rights arrangement and the plan for [[3]] years, the P22 records period, or longer where a contract or a law asks.
Filling in the form
- Complete every section. Where nothing exists, say so. A section with no entries is a gap, unless None is an acceptable answer and has a date and a name beside it (HD-03, HD-04, HD-05, HD-06, HD-07).
- None is not an acceptable answer for HD-01, HD-02, HD-08, HD-09, HD-10, HD-11, HD-12. Those sections always have something to say.
- Write where a secret is held and how it passes to the new leader. Never write a password, a token or a key in this document.
- Say when the outgoing leader expects more to follow. Mark that section Partial, with the date the rest is due.
- Keep this document at the classification you set on the cover. It lists accounts, contacts and open weaknesses.
Guidance — delete before approval
Allow the outgoing leader a few working days to complete it, and book a meeting of an hour or two to go through it with the new leader. A short, honest form with its gaps marked is worth more than a long one that hides them.
Where the outgoing leader has already gone, or will not complete the form, the new leader builds it from records and writes down what is missing (see Building the form from records).
The handover is one input to the Inherited Security Programme Discovery Workbook. Its gaps feed the 100-Day Security Plan, where each gap that needs work becomes an item with the section as its source.
The handover at a glance
Fill in this table last. It shows, for each section, how many entries it holds, the kind of gap if there is one, and the result of the new leader's check. Report it in counts: for example "8 of 12 sections complete; 4 gaps (2 missing, 1 partial, 0 access, 1 unsigned)". Never add it up into a score.
Section | None allowed | Entries | Gap, if any | New leader's check |
|---|---|---|---|---|
HD-01 Purpose and scope | No | |||
HD-02 Roles and authority held | No | |||
HD-03 Open risks | Yes | |||
HD-04 Exceptions and risk acceptances | Yes | |||
HD-05 Incidents | Yes | |||
HD-06 Commitments | Yes | |||
HD-07 Suppliers | Yes | |||
HD-08 Regulators and contacts | No | |||
HD-09 Access and accounts | No | |||
HD-10 Programme state | No | |||
HD-11 Calendar | No | |||
HD-12 Documents and sign-off | No |
The four kinds of gap. A section is complete when it lists entries, or says None with a date and a name where None is allowed. It has one of these gaps when it falls short.
Gap | What it means | What happens next |
|---|---|---|
Missing | No entries, and no dated None from a named person. Where None is not allowed: no entries. none is not an acceptable answer here. | Ask the outgoing leader, or build the section from records. If it stays empty, write what is missing and who was asked, with the date. Where None is allowed, a dated None from a named person closes the gap. |
Partial | The outgoing leader says more is to follow. | Ask for the date the rest will come. Record what has been received. Until the rest arrives, the section is not complete. |
Access not confirmed removed | The removal is not confirmed against a fresh extract (TR-08). | Take a fresh extract and compare it with the list. Remove what remains, and confirm again (TR-08). |
Not signed | The outgoing and the new leader have not both signed. | Both leaders sign when the gaps are listed and dated. Where the outgoing leader has gone, the new leader signs alone and writes that on the form. |
The four words for the new leader's check. Each section is checked, and the result is one of these. They are the same words the discovery workbook uses.
Word | What it means |
|---|---|
Evidenced | A record, a test result or a system view that you saw matches what you were told or what the document says. |
Described only | You were told, or a document claims it, and you have seen nothing that shows it is done. |
Not found | You asked for it, by a date, and nothing was produced and nothing could be found. |
Contradicted | What you saw differs from what you were told or what the document says. |
Evidenced is at least Seen in P19's words, and Described only is Told. A finding is not a maturity level. A level is set by P19's rules, from a sample of records.
The twelve sections
Each section has the same layout: what to list, the rule on None, a table for the entries, and how the new leader checks it. Add rows as you need them. If a table is too small, attach the list and write its location in the table.
HD-01 Purpose and scope
List: The date of the handover, the scope, who wrote it, and what it leaves out.
None: None is not an acceptable answer here. If the section is empty, say what is missing and who was asked.
Item | Entry |
|---|---|
Date of the handover | [[YYYY-MM-DD]] |
Outgoing leader | [[name and title]] |
Last working day, and the end of the notice period | [[YYYY-MM-DD]] |
New leader and start date | [[name, title, YYYY-MM-DD]] |
Completed by the outgoing leader, or built from records | [[Completed by the outgoing leader / Built by the new leader from records]] |
What this handover covers | [[the security function, its sites and systems]] |
What it leaves out, and why | [[or None, with a date and a name]] |
Written by, and on | [[name, YYYY-MM-DD]] |
New leader checks (TR-06): Read the scope against the twelve sections. Ask the outgoing leader, or whoever knows, what the document leaves out.
HD-02 Roles and authority held
List: Each role the outgoing leader held, each authority and delegation, and each committee seat.
None: None is not an acceptable answer here. If the section is empty, say what is missing and who was asked.
Role, authority or seat | Held under | Passes to | Open matter |
|---|---|---|---|
New leader checks (TR-05): Read the appointment letter, the role description and the delegation records. Ask the executive sponsor to confirm each authority in writing.
HD-03 Open risks
List: Each risk the outgoing leader tracks, its owner, its band and its next step.
None: None is an acceptable answer here. Write None, with the date and the name of the person who said so. A blank section is a gap.
Risk ID | Risk | Owner | Band | Next step and date |
|---|---|---|---|---|
Use the scales and bands set in P05-A02 Risk Assessment Methodology & Scoring Model. A risk the outgoing leader tracks but has not put on the register is listed here and marked so.
New leader checks (TR-02): Compare each entry with the risk register. Check the owner and the band. Note any risk held only in the outgoing leader's notes.
HD-04 Exceptions and risk acceptances
List: Each exception and acceptance in force, who approved it, its band and its review date.
None: None is an acceptable answer here. Write None, with the date and the name of the person who said so. A blank section is a gap.
ID | Exception or acceptance | Approved by, and on | Band | Review date | Past review |
|---|---|---|---|---|---|
Read each one before the new leader renews it. An exception is approved by the approver its band sets (P02 EX-05), and a risk acceptance by the approver its band sets (P05 RM-08). The new leader takes the decision only where the published rule names the Head of Information Security (Transition Decision Rights Matrix).
New leader checks (TR-07): Read each form. Check the approver against the band, and the review date. Renew, change or close each one that is past it. Nothing continues by default.
HD-05 Incidents
List: Each open incident, and each closed in the last 12 months with its review, and each reporting duty still open.
None: None is an acceptable answer here. Write None, with the date and the name of the person who said so. A blank section is a gap.
Incident or duty ID | What it is | Opened, and its status | Still open | Incident manager and deputy |
|---|---|---|---|---|
Roles, decision rights, severities and reporting clocks belong to the Security Incident Management pack and the Regulatory Incident Notification & Reporting pack. Do not restate them here. Name who holds each incident role and who deputises, and list what is open.
New leader checks (TR-09): Compare with the incident log for the last 12 months. Confirm in writing who holds each incident role and who deputises.
HD-06 Commitments
List: Each promise to a regulator, a customer, an auditor, an insurer or the management body, with its due date and owner.
None: None is an acceptable answer here. Write None, with the date and the name of the person who said so. A blank section is a gap.
ID | Promise | Made to, by whom, on | Due | Owner | Where written down |
|---|---|---|---|---|---|
A promise to a customer may also be in the questionnaire tracker (P26-A07 Questionnaire Request Tracker). List it here as well, so that nothing depends on one tracker.
New leader checks (TR-04): Look for each promise in writing: a contract, an email, a form or a minute. Add any you find that the list lacks. Check that a promise can be kept before you repeat it.
HD-07 Suppliers
List: Each critical supplier, its contact, its last assessment, and each open finding or renewal.
None: None is an acceptable answer here. Write None, with the date and the name of the person who said so. A blank section is a gap.
Supplier | Tier | Named contact | Last assessment | Open finding or renewal |
|---|---|---|---|---|
New leader checks (TR-10): Compare with the supplier register. Call each named contact and check the last assessment of each Tier 1 supplier.
HD-08 Regulators and contacts
List: The regulator, the CSIRT, the insurer and the responders, with the named contact and the registration details.
None: None is not an acceptable answer here. If the section is empty, say what is missing and who was asked.
Body or party | Named contact and deputy | Registration or account details | Confirmed by a call on |
|---|---|---|---|
Regulator or competent authority | [[name]] | [[registration details]] | |
CSIRT | [[name]] | [[registration details]] | |
Insurer | [[name]] | [[policy and claims line]] | |
Incident responders | [[name]] | [[retainer and call-out details]] | |
[[Other, e.g. the auditor or a sector body]] |
New leader checks (TR-10): Confirm each contact by a call or a message, never from the list. Record the date of each confirmation.
HD-09 Access and accounts
List: Each account, administrator right, token, shared secret and vendor portal login held by the outgoing leader or known only to them.
None: None is not an acceptable answer here. If the section is empty, say what is missing and who was asked.
Account, right, token, secret or portal | System and owner | Known only to the outgoing leader | Removed or handed over on | Confirmed on a fresh extract |
|---|---|---|---|---|
Include any personal account the outgoing leader used for work, any shared secret only they knew, and any vendor portal where they were the only administrator.
New leader checks (TR-08): Take a fresh extract of accounts and privileged rights, and compare it with this list and with the HR leaver record. Ask each system owner for any account only the outgoing leader knew.
HD-10 Programme state
List: Projects, budget, team, tools, licences and contracts, with their renewal dates.
None: None is not an acceptable answer here. If the section is empty, say what is missing and who was asked.
Project, budget line, post, tool, licence or contract | Owner | State | Renewal or end date |
|---|---|---|---|
New leader checks (TR-02): Compare the contracts and licences with the finance record. Ask the executive sponsor which budget lines are committed.
HD-11 Calendar
List: Every date due in the next 90 days: audits, reports, renewals, tests and regulator deadlines.
None: None is not an acceptable answer here. If the section is empty, say what is missing and who was asked.
Date | What is due | Owner | Source (audit plan, contract, regulator, customer) |
|---|---|---|---|
Look 90 days ahead from the start date of the new leader. The First-Year Security Operating Calendar takes the later dates.
New leader checks (TR-02): Compare with the board secretary's calendar, the audit plan, the contract renewals and the regulator dates. Add any date the list lacks.
HD-12 Documents and sign-off
List: Where the records are kept, and the signatures of the outgoing leader and the new leader with the date.
None: None is not an acceptable answer here. If the section is empty, say what is missing and who was asked.
Record | Where it is kept | Who holds it |
|---|---|---|
The handover document, with its evidence | [[location]] | [[role]] |
The risk register and the exception register | [[location]] | [[role]] |
The incident log and the commitments list | [[location]] | [[role]] |
The access and account inventory | [[location]] | [[role]] |
The outgoing leader's working files and notes | [[location]] | [[role]] |
Signatures. Each leader signs when the gaps above are listed and dated. Signing is a record that the form was handed over. It does not say that every entry is true.
Person | Role | Signature | Date |
|---|---|---|---|
[[outgoing leader]] | Outgoing security leader | ||
[[new leader]] | New security leader |
New leader checks (TR-06): Confirm that each record is where the list says. Do not sign until the gaps above are listed and dated.
Guidance — delete before approval
Keep the twelve section numbers. If you remove a section, keep its number and write "Not used", with the reason, so that records that cite it still point to the right place. The 100-Day Security Plan and the Security Posture Baseline Scorecard cite these numbers.
Add a row for anything the outgoing leader holds that the form does not ask about, such as a verbal promise, a role on an outside body, or a private arrangement with a supplier.
Building the form from records
TR-06 says that where the outgoing leader has gone, the new leader builds the document from records and writes down what is missing. Do not wait for it. Start in week 1.
Section area | Where to look |
|---|---|
Risks and exceptions | The risk register, the exception register and the approval forms. |
Incidents | The incident log, the post-incident reviews, the reporting records and the call-out records. |
Commitments | The customer, auditor and regulator correspondence, the contracts and the questionnaire tracker, and the sent folder of the outgoing leader's mailbox. |
Suppliers and contacts | The supplier register, the contract system, the finance record of payments and the outgoing leader's contacts. |
Access | The identity system's account and privilege lists, the vendor portal admin lists and the password manager's shared vaults. |
Programme state and dates | The project list, the contract and licence renewals, the audit plan and the board calendar. |
Mark each section Built from records on the cover table, and say who was asked for what the records do not show. Ask the outgoing leader's manager, their team and the people who worked with them. Many outgoing leaders will answer a short question after they have left, if they are asked politely and early.
Guidance — delete before approval
Whether an outgoing leader may be asked to help after their last day depends on their contract and on any agreement on leaving. Legal and HR confirm that, and Legal decides how to ask. Nothing in this form is advice on employment.
Common mistakes
Mistake | What to do instead |
|---|---|
Treating the handover document as the truth. | It is what the outgoing leader believed. Check each part against a record, a test or a system view (TR-02). |
Promising a date, a budget or a result in the first weeks. | Note it, check it can be kept, and say so before you commit (TR-04). |
Forgetting the outgoing leader's accounts, tokens and portal logins. | Remove them on the day they leave and confirm against a fresh extract (TR-08). |
Blaming the outgoing leader in front of others. | Record what you find, not who is to blame. The people who built it will tell you the most. |
Roles and responsibilities
Role | What they do in the handover |
|---|---|
Outgoing security leader [[name of the predecessor]] | Completes the handover document, lists what they hold and have promised, introduces the new leader to contacts and hands over access and accounts. Where they have gone, the new leader builds the handover from records. |
New security leader [[name of the new Head of Information Security or CISO]] | Learns the programme, interviews the stakeholders, verifies what is claimed, keeps the discovery workbook, agrees the decision rights, proposes the plan and reports counts. Promises nothing until it is checked. |
Executive sponsor [[e.g. chief executive or chief operating officer]] | Agrees the decision-rights arrangement and the plan in writing, opens doors to the other executives and the management body, and decides what only an executive may decide. |
HR [[HR lead]] | Confirms the leaver and joiner records, the outgoing leader's departure date and notice terms, and the new leader's training and onboarding. |
Legal [[in-house or external counsel]] | Confirms what the outgoing leader must hand over, what commitments to customers and regulators exist, and what the management body's liability means. |
Head of IT [[Head of IT]] | Gives the new leader system views, the account inventory and the change calendar, and removes access. |
Data Protection Officer [[or the privacy lead where no DPO is appointed]] | Gives the new leader the records of processing, breach decisions and open data protection matters. |
The matrix shows who is responsible (R), accountable (A), consulted (C) and informed (I). Columns, in order: New for new security leader; Out for outgoing security leader; Spons for executive sponsor; Body for management body; HR for HR; Legal for Legal; DPO for data Protection Officer; IT for Head of IT.
Activity | New | Out | Spons | Body | HR | Legal | DPO | IT |
|---|---|---|---|---|---|---|---|---|
TX-02 Complete the handover document | C | A | I | C | C | C | ||
TX-03 Remove the outgoing leader's access and confirm it | A | I | C | R | ||||
TX-05 Look for the proof and record the findings | A | C | C | C | C | |||
TX-07 Confirm the incident roles and list the open incidents and duties | A | C | I | C | C | |||
TX-08 Confirm the regulator, responder and supplier contacts | A | C | R |
The rules of the Security Policy Management pack on who approves a document apply to this form. Nobody approves a form they completed.
Related documents
Document | Relationship |
|---|---|
First 90 Days Security Leader Checklist | Week 1 asks for this form, and the checklist says what to do with its gaps |
Inherited Security Programme Discovery Workbook | Each section is checked against a record, a test or a system view, and the result recorded in the four words |
Stakeholder Interview Guide & Record | The interviews ask what was promised to each group, which the commitments section should hold |
Transition Decision Rights Matrix | Sets who decides what in the first 90 days, so that the new leader does not assume every right the outgoing leader held |
100-Day Security Plan | Each gap that needs work becomes a plan item, with the section as its source |
First-Year Security Operating Calendar | Takes the dates in the calendar section forward for the first year |
P02-A02 Security Exception & Waiver Standard | An exception is approved by the approver its band sets. The new leader reviews inherited exceptions with it. |
P05-A02 Risk Assessment Methodology & Scoring Model | The scales and bands that rate a risk, and who may accept it. |
P05-A08 Risk Acceptance Form & Approval Record | The record of an accepted risk and its review date. |
P06-A03 Supplier Security Assessment Procedure | How a supplier is assessed, and when it is assessed again. |
P07-A02 Access Review Methodology | How often access is reviewed, and how fast a removal must happen. |
P09-A03 Incident Response Plan | The incident response plan, its roles and its decision rights. P27 changes none of them. |
P26-A07 Questionnaire Request Tracker | The tracker of customer questionnaires and the commitments made in them. |
[[Information Security Policy; leaver and joiner procedure; your own contract with the outgoing leader]] | [[Parent policy; how access is removed; what the outgoing leader may be asked to hand over]] |
Definitions
Term | Meaning in this form |
|---|---|
Handover | The passing of what the outgoing leader knows, holds and has promised to the new leader, in writing. |
New security leader | The head of security, security manager or CISO who has just taken the role. They hold the role that the earlier packs call the Head of Information Security. |
Outgoing security leader | The person who held the role before. They may still be at work, may be serving a notice period, or may already have gone. |
Inherited | Held, accepted or promised before the new leader started: an exception, a risk acceptance, a contract, a commitment to a customer or a regulator, or an open incident. |
Finding | What discovery found about one item, in one of four words: Evidenced, Described only, Not found or Contradicted. |
Executive sponsor | The executive the new leader reports to, who agrees the arrangement and the plan, and who speaks for the leader to the management body. |
Worked example: Kestrel on 30 Sep 2026
EXAMPLE, not part of the form. Kestrel Components B.V. (EXAMPLE) is a manufacturer of industrial pumps and valves in an EU Member State, with about 600 staff and two plants, treated as an important entity under NIS2 (manufacturing), on its own scope assessment, which counsel has not yet re-checked. It is not the organisation used in the other packs. Replace it with your own, or delete this section before approval.
Jonas Brandt, the Head of Information Security, left on 28 Aug 2026 after a three-week notice period and a partial handover. Sam Okafor started on 14 Sep 2026. By 30 Sep 2026 it was day 17 of the first 90 days. The new leader checked the form and recorded this.
Section | Entries | Result |
|---|---|---|
HD-01 Purpose and scope | 1 | Complete |
HD-02 Roles and authority held | 3 | Complete |
HD-03 Open risks | 12 | Complete |
HD-04 Exceptions and risk acceptances | 5 | Complete |
HD-05 Incidents | 1 | Complete |
HD-06 Commitments | 0 | Missing No entries, and no dated None from a named person. |
HD-07 Suppliers | 4 | Complete |
HD-08 Regulators and contacts | 2 | Partial The outgoing leader says more is to follow. |
HD-09 Access and accounts | 6 | Complete |
HD-10 Programme state | 6 | Complete |
HD-11 Calendar | 0 | Missing No entries. None is not an acceptable answer here. |
HD-12 Documents and sign-off | 1 | Not signed The outgoing and the new leader have not both signed. |
The position: 8 of 12 sections complete; 4 gaps (2 missing, 1 partial, 0 access, 1 unsigned). The new leader listed the 4 gaps, asked for the missing sections, and put each one in the plan with its section as its source (100-Day Security Plan).
Section HD-04 as found
The handover lists 5 entries. Two exceptions were approved by Jonas Brandt and were past their review dates by 2026-09-30. The three acceptances were in date. The new leader reviews the two exceptions, and the approvers below are the ones each band sets, from the earlier packs.
ID | What | Approved by, and on | Band | Review date | Past review |
|---|---|---|---|---|---|
IE-1 Exception | Legacy order-entry server without multi-factor sign-in | Jonas Brandt, 4 Mar 2026 | Medium | 31 Aug 2026 | Yes, by 30 days |
IE-2 Exception | Shared engineering account on the plant network | Jonas Brandt, 17 Jun 2026 | High | 15 Sep 2026 | Yes, by 15 days |
RA-1 Acceptance | Unsupported operating system on one test rig | [[as the form says]] | Low | 30 Nov 2026 | No |
RA-2 Acceptance | Shared inbox for supplier invoices | [[as the form says]] | Medium | 29 Jan 2027 | No |
RA-3 Acceptance | No offline backup for one plant's design archive | [[as the form says]] | High | 14 Dec 2026 | No |
Approver for the review, by band: IE-1 (Medium): Head of Information Security; IE-2 (High): Head of Information Security and Accountable executive.
Section HD-05 as found
One incident was open at the handover: INC-2026-041, Severity 2, opened 24 Aug 2026. A phishing-led mailbox compromise in the finance team. Status: contained, not closed. What stays open: The recovery criteria (P09 IM-10) are not recorded as met. The post-incident review (P09 IM-11) has not been held. The reporting screen (P09 IM-06) is recorded by the incident manager. Its outcome is [[to confirm with the incident manager]].
Section HD-09 listed 6 accounts, rights and portal logins. The new leader confirmed their removal against a fresh extract on 16 Sep 2026, day 3.
Guidance — delete before approval
The values above are the example's. Replace them with yours. Nothing in the example says how your handover will look.
Adapting this template
Small organisation
Guidance — delete before approval
In a small organisation the outgoing leader may also have been the only person in the security function, so the form may hold most of what anyone knows. Ask them to complete HD-09 first, because access is the section that cannot wait. Keep all twelve sections, and write short entries. Where the outgoing leader and the executive sponsor were the same person, ask a colleague or an adviser to read the form with the new leader.
A short form is enough: one line per risk, supplier and promise, and a pointer to where the detail is kept.
Regulated entity
Guidance — delete before approval
If you are an essential or an important entity under NIS2, the management body approves the cybersecurity risk-management measures and oversees their implementation (NIS2 Article 20). Tell it, through the executive sponsor, that the head of security has changed and what has been handed over. Counsel confirms what that means for the liability of the management body, and what an outgoing leader may be asked to hand over. A regulated entity also hands over its registration with the authority and its open notifications in HD-05 and HD-08. The notification duties, roles and clocks stay with the Security Incident Management pack and the Regulatory Incident Notification & Reporting pack.
IT and services run by suppliers
Guidance — delete before approval
If your managed IT provider, your security service provider or another outsourced service provider runs part of the security function, list it in HD-07 and HD-10, with its named contact and its contract renewal date. Ask it to confirm what it holds for the outgoing leader: accounts, alert routing, escalation contacts and any shared secrets. Where the outgoing leader was an external adviser or an interim, the contract says what they must hand over, and Legal confirms that.
Delete this section before approval.
Framework references
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. Editions referenced: Directive (EU) 2022/2555 (NIS2); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); UK NCSC board guidance and the ENISA skills framework, as their publishers state them; as published and read on 10 October 2026.
Framework | Reference | Supported by |
|---|---|---|
ISO/IEC 27001:2022 | Annex A 5.2 — Information security roles and responsibilities | Roles and responsibilities: the form states each role and authority the outgoing leader held, and who takes it |
NIST CSF 2.0 | GV.RR-02 — “Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced” | Roles and authorities: the form records which are established, communicated and handed on, in writing |
NIS2 — Directive (EU) 2022/2555 | Article 21(2)(b) — the cybersecurity risk-management measures include “incident handling” | Incident handling: section HD-05 hands over each incident still open, and the roles that run it |
NIS2 — Directive (EU) 2022/2555 | Article 21(2)(d) — “supply chain security, including security-related aspects concerning the relationships between each entity and its direct suppliers or service providers” | Supply chain security: section HD-07 hands over each critical supplier, its contact and its last assessment |
NIS2 — Directive (EU) 2022/2555 | Article 21(2)(i) — “human resources security, access control policies and asset management” | Access control and asset management: section HD-09 hands over the accounts and rights, and section HD-10 the contracts and licences |
NIS2 — Directive (EU) 2022/2555 | Article 23(1) — notify the CSIRT or competent authority, without undue delay, of any significant incident; where appropriate, notify the recipients of the services of significant incidents likely to adversely affect those services | Notification duties: section HD-05 lists any reporting duty still open. The duty, its roles and its clock stay with the incident and reporting packs |
Directive (EU) 2022/2555 is addressed to the Member States, and binds essential and important entities through their national law. Article 20 asks the Member States to ensure that the management body approves the cybersecurity risk-management measures, oversees their implementation, can be held liable for infringements of Article 21, and is required to follow training. What liability means for a member of a management body depends on national law, and counsel confirms it. Whether your organisation is an essential or an important entity comes from its scope assessment and from counsel, and this pack does not decide it.
ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of NIS2, or that your organisation holds a certificate.
A reference says what its source asks of the management body or the organisation, and which CISO Times document helps with that work. It does not say that a document from this pack meets a requirement of NIS2.
This pack does not say which document, record or practice meets a requirement of NIS2. Each reference says what its source asks of the management body or the organisation and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.