Stakeholder Interview Guide & Record
Interview questions per stakeholder group and a record format for expectations, concerns and commitments.
Available soon
- Format
- Word
- Size
- 66 KB
- Length
- 21 pages
- Version
- 1.0
- Updated
What's inside
- Purpose
- Legal note
- Scope
- Roles
- Who to interview, and when
- How an interview runs
- The four core questions
- Questions for each group
- The record format
- Interview record form
- Interview log and counts
- Sending back what you heard
- Keeping the records
- Common mistakes
- Worked example: nine interviews in three weeks
- Related documents
- Adapting this template
- Framework references
- Definitions
What changed
- 1.0
Published.
Preview
The document from section 1, as you will receive it. Highlighted [[text]] is for you to replace; shaded guidance boxes are for you to delete before approval. The cover and document control pages are in the file.
Purpose
This guide helps a new head of security to find out, in the first weeks, what the people around the security function expect, what worries them and what has been promised to them. It gives the questions for ten stakeholder groups and a format for recording each interview. The record becomes one of the sources of the 100-day plan.
It applies the First 90 Days Security Leader Checklist. Interviews are the main work of the Listen phase, which runs from week 1 to week 3. They give you statements. The Inherited Security Programme Discovery Workbook then checks them against a record, a test or a system view.
Learn before you promise. Find out what is real, not what is claimed. Decide who decides. Show the starting position, so that progress can be shown.
Guidance — delete before approval
Replace every value in [[double brackets]] before approval, and name roles, not people.
The groups, the core questions and the six record fields are shared with the other documents of the pack. Change them in one place and in all the documents together.
A completed interview record names people and holds their opinions. Keep the records in a store that only you, and those you name, can open. This document holds the blank forms and the guidance only.
Legal note
This document helps a new head of security, and the one who is leaving, to hand over and take over a security function. It is not legal advice and not advice on employment. It does not say that you comply with NIS2 or any standard. What liability means for a member of a management body, what an outgoing leader may be asked to hand over under their contract, and whether your organisation is an essential or an important entity are for counsel to confirm.
This pack does not say which document, record or practice meets a requirement of NIS2. Each reference says what its source asks of the management body or the organisation and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.
Directive (EU) 2022/2555 is addressed to the Member States, and binds essential and important entities through their national law. Article 20 asks the Member States to ensure that the management body approves the cybersecurity risk-management measures, oversees their implementation, can be held liable for infringements of Article 21, and is required to follow training. What liability means for a member of a management body depends on national law, and counsel confirms it. Whether your organisation is an essential or an important entity comes from its scope assessment and from counsel, and this pack does not decide it.
The NCSC's Code and toolkit and the ENISA skills framework are voluntary guidance. They are not law. They say what boards might expect and what roles typically do. They do not say what a new security leader must do, and no law named here says how a handover must be run. Following them is not a statement that your organisation complies with NIS2 or any standard.
Scope
A new security leader inherits a programme described by other people. Some of it is real, some of it is written down and not done, and some of it is a hope. The first months are for finding out which is which, and for saying little that cannot be kept. Listen first. Check what you hear against a record, a test or a system. Agree in writing who decides what while you learn. Then record where you started, in counts and in words, so that in a year you can show what changed. The result is a baseline and a plan. It is never one score.
This guide covers the interviews of the first weeks, with ten groups, the same four core questions for each and three questions for each group. It does not cover interviews with a supplier as part of a formal assessment, an audit interview, or a conversation about a person's pay, post or conduct.
TR-01 Change no policy, tool, team structure or priority until discovery ends at the close of week 7, except to stop harm, to act on a legal duty or to take a no-regret action. Spend the first three weeks listening.
An interview gives you a statement. What a person says is a source for the plan and a pointer to where to look. It is not a finding. Until you have seen proof, a statement is Described only.
TR-02 Every discovery finding states what was seen: a record, a test result or a system view. A statement alone is Described only. A finding is checked again after [[6]] months, or on a material change.
Three kinds of proof settle a statement: record, test and system view. Ask for one in every interview, and write down what the person offers to show you.
Decision rights are not settled in an interview. The transition arrangement is agreed in writing with the executive sponsor (Transition Decision Rights Matrix), and the earlier packs keep the rights they give. Incident roles, decision rights and clocks stay as the Security Incident Management pack (P09) and the Regulatory Incident Notification & Reporting pack (P18) set them.
Roles
Role | What they do in the interviews |
|---|---|
New security leader [[name of the new Head of Information Security or CISO]] | Plans and runs every interview, writes each record the same working day, checks a commitment before making it, and sends each person a note of what they said. |
Executive sponsor [[e.g. chief executive or chief operating officer]] | Is the first interview (IV-01). Opens the doors to the other executives and the management body, and agrees what the new leader may say to each. |
Management body [[the board, or the equivalent]] | The chair, or the member who leads on risk, is interviewed (IV-02). The management body is told what it must approve later, and not in the interview. |
HR [[HR lead]] | Is interviewed (IV-05). Sends the leaver extract and confirms with counsel how records about staff are kept. |
Legal [[in-house or external counsel]] | Is interviewed (IV-04). Confirms what the new leader may promise about confidentiality, and which commitments to customers and regulators exist. |
Data Protection Officer [[or the privacy lead where no DPO is appointed]] | Is interviewed with Legal (IV-04). Says how the interview records, which name people, are kept as personal data. |
Head of IT [[Head of IT]] | Is interviewed (IV-03). Gives the new leader the system views and lists the interview names. |
Outgoing security leader [[name of the predecessor]] | Where still at work, introduces the new leader to each group and says what each was promised. Where they have gone, the new leader builds that picture from the records and the interviews. |
Who to interview, and when
TR-03 Book an interview with every stakeholder group in A04 during the Listen phase and hold it by the end of week 4, with the same core questions, and record each interview in the record format: expectation, concern, commitment and follow-up. Interview before judging.
Interview in the order of the table, which follows the weekly actions of the checklist. Interview the groups that know how the programme really runs, and not only the executives.
Group | Who | Why | When |
|---|---|---|---|
IV-01 Executive | The chief executive and the other executives | They decide, fund and answer for the programme. | Weeks 1 and 2 WK-01, WK-09 |
IV-02 Board or its chair | The chair of the management body, or the member who leads on risk | The management body approves the measures and oversees them (NIS2 Article 20). | Week 2 WK-09 |
IV-03 IT | The head of IT and the main system owners | They run the systems and make most of the changes that matter. | Week 2 WK-10 |
IV-04 Legal | The general counsel, and the data protection officer if there is one | They hold the legal duties, the contracts and the notices. | Week 2 WK-10 |
IV-05 HR | The head of HR | They hold the joiner, mover and leaver records, and the people terms. | Week 2 WK-10 |
IV-06 Finance | The chief financial officer | They set the budget, and see the cost of incidents and of tools. | Week 2 WK-10 |
IV-07 Business owners | The owners of the main services, sites or product lines | They own the risk and are the first to feel a control or an outage. | Week 3 WK-14 |
IV-08 Suppliers | The critical suppliers and the incident responders | They run parts of the service and know what they were told. | Week 4 WK-22 |
IV-09 Audit | Internal audit, and the external auditor if there is one | They know what was tested, what failed and what is still open. | Week 3 WK-14 |
IV-10 The team | The security team and the people who work with it daily | They know how the programme really runs, and what is missing. | Week 3 WK-14 |
The critical suppliers are booked in week 3 (WK-15) and met in week 4 (WK-22), so that every group is booked within the Listen phase. The count to keep is groups interviewed, out of 10. It is the first headline measure of the pack (TM-01, stakeholder groups interviewed).
How an interview runs
Every interview has three stages. The guidance is short because the skill is in listening.
Before the interview
- Book the interview. Say in the invitation that you are new, that you are listening, and that you will ask for the documents you need to see. Allow about [[45]] minutes.
- Read what the person's group has already sent you. Do not read the last leader's views of them first.
- Print the four core questions and the three questions for the group. Bring a copy of the record form.
- Tell the person how the record is kept and who may read it. Counsel confirms what you may promise about confidentiality.
During the interview
- Ask the four core questions first, in the same order each time. Then ask the group's three questions.
- Let the person finish. Write down their words. Ask what they mean before you write down what you think they mean.
- When they say something is done, ask where you can see it. Write down what they offer to show you, even if you cannot look today.
- When they ask you for something, say that you will note it and check whether it can be kept. Agree to nothing in the room.
- Close by saying what you will do next and when they will hear from you.
After the interview
- Write the record the same working day, while you still remember it. Use the six fields of the record format.
- Set the commitment status. A commitment is Committed only after you have checked that it can be kept. Say how you checked it.
- Send the person a short note of what you heard, so that they can correct it. Within [[2]] working days of the interview is a sensible target.
- Add the follow-up to your list with its owner and its due date. Open the proof you were offered, and enter what you see in the discovery workbook.
Guidance — delete before approval
Do not ask the outgoing leader or a predecessor's favourite to sit in. People speak more openly to a new leader alone, or with one colleague of their own choosing.
If someone is nervous, start with the fourth core question: who else should I talk to, and what should I read first? It lets them help you without judging anyone.
The four core questions
Ask every group the same four questions, in the same order. The same questions let you compare what different groups say, and show you who agrees and who does not.
Question | It goes into | |
|---|---|---|
Q1 | What do you expect from the security function, and how will you know it is doing well? | IF-02 Expectation |
Q2 | What worries you most about security today? | IF-03 Concern |
Q3 | What has been promised to you or to your area, and what is still open? | IF-03 Concern, and the commitments list if someone else made the promise (WK-26, HD-06) |
Q4 | Who else should I talk to, and what should I read first? | IF-05 Follow-up |
The third question finds the promises that nobody wrote down. Write each one in the person's words, and say who made it. You do not take over a promise because you heard of it. You take it onto the list, check it, and then decide (TR-04).
Questions for each group
Ask the three questions for the group after the four core questions. Use the other rows to prepare, and to see what each interview can lead to. The table of groups above says who each group is, why it matters and when to meet it.
IV-01 Executive
Part | For this group |
|---|---|
Questions | 1. What would a good first 90 days look like for you? 2. Which decisions about security do you expect to take yourself? 3. What went wrong in the past that you do not want repeated? |
Listen for | Any date, budget or result already promised in the leader's name, and what the executive would be embarrassed to hear in a year. |
Ask to see | The last board paper, and any email or letter in which a security target was set. |
Do not promise | A date, a budget or a result. |
It feeds | DS-01-1; DS-02-2 |
IV-02 Board or its chair
Part | For this group |
|---|---|
Questions | 1. What does the management body expect to approve, and how often? 2. What did the last report tell you, and what did it leave out? 3. What training has the management body had, and what would help? |
Listen for | Whether the chair can say, in their own words, what the management body approved and when. |
Ask to see | The minute of the approval and the record of the management body's training. |
Do not promise | That the management body will approve a plan or a budget. |
It feeds | DS-01-2; DS-09-2 |
TR-11 Within [[60]] days of the start, tell the management body, through the executive sponsor, what NIS2 Article 20 asks of it: to approve the measures, to oversee their implementation and to follow training, and that it can be held liable. Counsel confirms what liability means.
The interview is not the briefing. Listen to what the chair expects, and tell the chair when the briefing will be given. Counsel confirms what a member's liability means.
IV-03 IT
Part | For this group |
|---|---|
Questions | 1. Which systems are most at risk, and why? 2. What have you been told to do by security that you could not do? 3. Where do you hold the lists of systems, accounts and backups? |
Listen for | Where the lists of systems, accounts and backups really live, and who keeps each one up to date. |
Ask to see | The system list, the account list and the maintenance calendar. |
Do not promise | A change to a maintenance window or a request to stop a system. |
It feeds | DS-04-2; DS-05-2; DS-08-1 |
IV-04 Legal
Part | For this group |
|---|---|
Questions | 1. Which laws and contracts bind us on security, and who decides how? 2. What have we told a regulator, a customer or an insurer about our security? 3. Which open matters, claims or notifications should I know about? |
Listen for | Matters that nobody has told security about: claims, notices, letters from a regulator, clauses that bind the organisation on security. |
Ask to see | The list of commitments to regulators, customers and insurers, and the register of notices. |
Do not promise | A decision to notify anyone. Notification decisions and clocks are P09's and P18's, unchanged. |
It feeds | HD-06 commitments; DS-07-2 |
IV-05 HR
Part | For this group |
|---|---|
Questions | 1. How does a leaver reach security, and how fast? 2. Which roles hold access that needs special care? 3. How were security training and conduct handled in the past? |
Listen for | How long a leaver takes to reach security, and which roles hold access that needs special care. |
Ask to see | The latest leaver extract, and the joiner and mover process as HR runs it. |
Do not promise | A change to the leaver process before discovery ends (TR-01). |
It feeds | DS-04-1; DS-09-1 |
IV-06 Finance
Part | For this group |
|---|---|
Questions | 1. What do we spend on security, and what do we think it buys? 2. Which security contracts renew in the next year? 3. How are insurance and the cost of an incident handled? |
Listen for | What the finance team believes security spend has bought, and what they were told to expect next year. |
Ask to see | The list of security contracts with their renewal dates, and the budget lines for the last two years. |
Do not promise | A cut, a rise or a freeze in spend (NE-3). |
It feeds | HD-10 programme state; DS-07-1 |
IV-07 Business owners
Part | For this group |
|---|---|
Questions | 1. Which of your systems or processes could not stop for a day? 2. Which security rules get in your way, and what do you do about them? 3. Who do you call when something looks wrong? |
Listen for | Which rules people work around, and why. Which service could not stop for a day. |
Ask to see | The owner's list of critical services, and any workaround they use today. |
Do not promise | A change to a rule, or that a control will be relaxed. |
It feeds | DS-08-2; DS-06-1 |
IV-08 Suppliers
Part | For this group |
|---|---|
Questions | 1. Who is our contact, and who is yours? 2. What have we asked of you on security, and what have you given? 3. How do we reach you in an incident, and how fast do you answer? |
Listen for | Who the supplier thinks its contact is, and what it was told about the organisation's security. |
Ask to see | The contract, the last assessment and the contact page, and the way the supplier is reached in an incident. |
Do not promise | A change to the contract, a renewal or an end of the service. |
It feeds | DS-07-2; HD-07 suppliers; HD-08 regulators and contacts |
TR-10 Confirm, by a call or a message and not from a list, the contacts at the regulator, the CSIRT, the insurer, the responders and each critical supplier within [[30]] days of the start. Record the date of each confirmation.
Use the interview to confirm the contact. Ask the supplier to name its own contact and say how it is reached in an incident. The incident roles, decisions and clocks belong to the incident response plan (P09) and are not restated here.
IV-09 Audit
Part | For this group |
|---|---|
Questions | 1. Which findings are open, and which are overdue? 2. Which controls have you tested, and which would you not rely on? 3. Where do you think the programme is weakest? |
Listen for | Which controls audit would not rely on, and which findings audit thinks are closed too easily. |
Ask to see | The findings tracker and the last audit report, as received. |
Do not promise | To close, re-date or accept a finding. |
It feeds | DS-10-1; DS-10-2 |
IV-10 The team
Part | For this group |
|---|---|
Questions | 1. What do you do each week that nobody sees? 2. What would you stop doing, and what would you start? 3. What did the last leader promise you? |
Listen for | The work nobody sees, the fear of change, and the promises the last leader made and nobody wrote down. |
Ask to see | The rotas, tickets and runbooks the team uses each week. |
Do not promise | A post, a grade, a pay change, a new structure, or that nothing will change. Nothing here is advice on employment. |
It feeds | DS-05-1; DS-06-2; HD-10 programme state |
The record format
Record every interview in the same six fields, the same working day. The format keeps what each person said apart from what you make of it.
ID | Field | What goes in it |
|---|---|---|
IF-01 | Who and when | Name, role, group (IV ID), date and who was in the room |
IF-02 | Expectation | What they expect from the security function, in their words |
IF-03 | Concern | What worries them most, in their words |
IF-04 | Commitment | What you said you would do. One of Committed, Noted not committed, or Declined, with how you checked it can be kept |
IF-05 | Follow-up | The action, its owner and its due date |
IF-06 | Sent back | The date you sent them a note of what you heard, so that they could correct it |
The three commitment words
TR-04 Promise nothing until it is checked. A commitment is recorded as Committed only after the new leader has checked that it can be kept, and says how. Anything else is recorded as Noted, not committed, or Declined, with the reason.
Word | When you use it |
|---|---|
Committed | You have checked that you can keep it, and you say how. Nothing else is Committed. |
Noted, not committed | You heard the request, and you have not yet checked whether it can be kept. Say what you will check, and when you will answer. |
Declined | You have decided that you cannot or will not do it now. Write the reason, and say when you will look again, if you will. |
People will ask you to agree on the spot. These answers keep the promise to yourself first.
If you are asked | Word | You might say |
|---|---|---|
Can you promise a date or a result? | Noted, not committed | I have noted it. I will check whether it can be kept, and tell you once I know. |
Can you promise to change a rule or a process now? | Noted, not committed | I will look at it after I have seen how the programme works. I will not change anything before then. |
Can you take a task that is clearly needed and small, and that carries little risk? | Committed | Yes. I have checked that it can be done by the date, and this is how. |
Can you cut or raise spend? | Declined | Not yet. I cannot say what is used until discovery shows it. I will come back to you with the list. |
Can you keep what I said to yourself? | Noted, not committed | I will keep the record where only those named in it can read it. I cannot promise to hide a legal duty. Counsel confirms what I may promise. |
Guidance — delete before approval
A small task that is clearly needed and carries little risk can be Committed in the room, once you have checked that you have the time. The first example record below shows one.
Never agree to hide something. If a person tells you of a legal duty, a safety matter or an open incident, take it to the right route the same day. The incident route is the incident response plan.
Interview record form
Copy this form for each interview, and keep the copies in the interview log. Fill in the first six rows during the interview and the rest the same working day.
Field | Record |
|---|---|
IF-01 Who and when | Name, role, group (IV ID), date and who was in the room Name and role: [[name and role]] Group: [[IV-nn and name of group]] Date: [[YYYY-MM-DD]] In the room: [[names]] |
Q1 | What do you expect from the security function, and how will you know it is doing well? [[their answer, in their words]] |
Q2 | What worries you most about security today? [[their answer, in their words]] |
Q3 | What has been promised to you or to your area, and what is still open? [[what was promised, by whom, and what is still open]] |
Q4 | Who else should I talk to, and what should I read first? [[names and documents]] |
Group questions | 1. [[question from the group's table]] [[answer]] 2. [[question]] [[answer]] 3. [[question]] [[answer]] |
IF-02 Expectation | What they expect from the security function, in their words [[expectation]] |
IF-03 Concern | What worries them most, in their words [[concern]] |
Proof offered | Kind of proof: Record, Test, System view [[what they offered to show you, and by when]] |
IF-04 Commitment | What you said you would do. One of Committed, Noted not committed, or Declined, with how you checked it can be kept What you said: [[the words]] Word: [[Committed / Noted, not committed / Declined]] How you checked: [[how]] |
IF-05 Follow-up | The action, its owner and its due date Action: [[action]] Owner: [[role]] Due: [[YYYY-MM-DD]] |
IF-06 Sent back | The date you sent them a note of what you heard, so that they could correct it [[YYYY-MM-DD]] |
Your reading | [[Your own view, marked as yours. Keep it apart from their words.]] |
Interview log and counts
Keep one line for each interview. The log is where you see the groups that are not yet interviewed and the follow-ups that are late.
Record | Group | Date | Commitment status | Follow-up and owner | Due | Done | Sent back |
|---|---|---|---|---|---|---|---|
[[IR-nn]] | [[IV-nn]] | [[YYYY-MM-DD]] | [[Committed]] | [[action, owner]] | [[YYYY-MM-DD]] | [[Yes / No]] | [[YYYY-MM-DD]] |
Report the log as counts. Never write a share of the groups, and never add the counts together into one number.
- Groups interviewed: the groups with at least one interview record, out of ten.
- Commitments: how many are Committed, how many Noted, not committed, and how many Declined.
- Follow-ups: how many are open, and how many of those are overdue. A follow-up due today is not overdue.
One line gives all of it:
[[n]] of 10 groups interviewed; [[n]] committed, [[n]] noted and not committed, [[n]] declined; [[n]] follow-ups open, [[n]] overdue
Sending back what you heard
Within [[2]] working days of each interview, send the person a short note (IF-06). Say what you heard, and ask them to correct it. Tell each group what you heard once the interviews end (WK-32). Promise nothing new in the note.
Part | Wording to adapt |
|---|---|
Opening | Thank you for your time on [[date]]. This is what I heard. Please tell me what I have got wrong. |
What I heard | You expect [[expectation]]. You are worried about [[concern]]. |
What I will do | I will [[commitment, only if Committed]]. I have noted [[the other requests]], and I will tell you when I know whether I can do them. |
What happens next | I will [[follow-up]] by [[date]]. Please tell me by [[date]] if anything here is wrong. |
Guidance — delete before approval
The note is a record of what you heard and nothing more. Do not use it to thank a person for a promise you did not make. If you could not check a request, say so in one plain sentence.
Keeping the records
The interview records name people, and they hold what those people said about their colleagues and their managers. Treat them as personal data. Keep them where only you and those you name can open them, and say so to each person at the start. The Data Protection Officer confirms how they are kept, and counsel confirms what you may promise.
TR-16 Keep the handover document, the interview records, the decision-rights arrangement and the plan for [[3]] years, the P22 records period, or longer where a contract or a law asks.
The records period is that of the Cyber Resilience & Recovery pack (P22). The records are the sources of the plan (PL-01 in the 100-Day Security Plan), so keep them for as long as the plan.
Common mistakes
ID | Mistake | What to do |
|---|---|---|
NP-2 | Promising a date, a budget or a result in the first weeks. | Note it, check it can be kept, and say so before you commit (TR-04). |
NP-3 | Interviewing only the executives. | The team, IT, audit and the business owners know how the programme really runs (TR-03). |
NP-8 | Blaming the outgoing leader in front of others. | Record what you find, not who is to blame. The people who built it will tell you the most. |
IM-1 | Asking leading questions, such as whether the incident plan is tested each year. | Ask what happened at the last exercise. Then ask where the record is. |
IM-2 | Writing down your own view of what was said. | Write their words. Put your reading in a separate line, marked as yours. |
IM-3 | Treating a statement as a finding. | A statement is Described only until you have seen a record, a test result or a system view (TR-02). |
IM-4 | Settling a disagreement between two groups in the room. | Record both accounts. The discovery workbook settles it from proof. |
IM-5 | Leaving the record in a notebook. | Write it in the format the same working day, and store it where the handover and the plan can trace to it (TR-16). |
IM-6 | Never sending the note back. | The note is how a person corrects you. It also tells them you listened (IF-06). |
Three of the things the checklist says not to do early matter most in an interview.
ID | Do not | Until |
|---|---|---|
NE-3 | Promise a date, a budget or a result to the executives, a customer, an auditor or a regulator. | The plan is agreed (week 11) |
NE-5 | Sign a statement or a form to a regulator or an auditor that you have not checked. | You have seen the evidence |
NE-7 | Criticise the outgoing leader or the earlier programme in front of others. | Never |
Worked example: nine interviews in three weeks
EXAMPLE, not part of the guide. Kestrel Components B.V. (EXAMPLE) is a manufacturer of industrial pumps and valves in an EU Member State, with about 600 staff and two plants. The new Head of Information Security, Sam Okafor, started on 14 Sep 2026, which is day 1. The predecessor, Jonas Brandt, left on 28 Aug 2026 after a notice period of 3 weeks and a partial handover. The organisation is treated as an important entity under NIS2 (manufacturing), on its own scope assessment, which counsel has not yet re-checked. Values are as at 30 Sep 2026, day 17, week 3, in the Listen phase.
Record | Group | Who | Date | Commitment | Follow-up due |
|---|---|---|---|---|---|
IR-01 | IV-01 Executive | Chief executive | 16 Sep 2026 Day 3 | Committed | 23 Sep 2026 Done |
IR-02 | IV-02 Board or its chair | Chair of the board | 17 Sep 2026 Day 4 | Committed | 30 Oct 2026 Open |
IR-03 | IV-03 IT | Head of IT | 18 Sep 2026 Day 5 | Committed | 9 Oct 2026 Open |
IR-04 | IV-04 Legal | General counsel | 21 Sep 2026 Day 8 | Noted, not committed | 2 Oct 2026 Open |
IR-05 | IV-05 HR | Head of HR | 22 Sep 2026 Day 9 | Noted, not committed | 29 Sep 2026 Open, overdue |
IR-06 | IV-06 Finance | Chief financial officer | 22 Sep 2026 Day 9 | Declined | 16 Oct 2026 Open |
IR-07 | IV-07 Business owners | Plant director | 24 Sep 2026 Day 11 | Noted, not committed | 7 Oct 2026 Open |
IR-08 | IV-09 Audit | Internal audit lead | 28 Sep 2026 Day 15 | Noted, not committed | 9 Oct 2026 Open |
IR-09 | IV-10 The team | Security team | 29 Sep 2026 Day 16 | Noted, not committed | 2 Oct 2026 Open |
The count for the day: 9 of 10 groups interviewed; 3 committed, 5 noted and not committed, 1 declined; 8 follow-ups open, 1 overdue.
Nine of the ten stakeholder groups are interviewed. The critical suppliers are booked for 6 Oct. The suppliers are the one group left, and WK-22 puts them in week 4, so nothing is late.
Two records in full
The chief executive's record shows a commitment that was checked. The chief financial officer's shows a request that was declined with a reason.
IR-01: Chief executive
Field | IR-01 (EXAMPLE) |
|---|---|
IF-01 Who and when | Chief executive, group IV-01 Executive 16 Sep 2026, day 3, week 1 |
IF-02 Expectation | No surprises, and a clear view of the risk to the plants within three months. |
IF-03 Concern | The last leader left quickly, and nobody can say what was promised to customers. |
IF-04 Commitment | Brief the executives at the end of discovery. Committed. How it was checked: The date fits the executive calendar. |
IF-05 Follow-up | Agree the decision-rights arrangement. Owner: New security leader. Due 23 Sep 2026. Done. |
IF-06 Sent back | 17 Sep 2026 |
IR-06: Chief financial officer
Field | IR-06 (EXAMPLE) |
|---|---|
IF-01 Who and when | Chief financial officer, group IV-06 Finance 22 Sep 2026, day 9, week 2 |
IF-02 Expectation | A clear account of what security spend buys. |
IF-03 Concern | Spend rose in each of the last two years with no clear result. |
IF-04 Commitment | Cut licence spend this quarter, as asked. Declined. How it was checked: Not until discovery shows which licences are used. |
IF-05 Follow-up | List security contracts and their renewal dates. Owner: New security leader. Due 16 Oct 2026. Open. |
IF-06 Sent back | 24 Sep 2026 |
The request was to cut licence spend this quarter. The new leader did not agree in the room. The record says why. The note went back on 24 Sep 2026, and the follow-up that answers the concern about spend is due on 16 Oct 2026.
The record of the head of IT (IR-03, 18 Sep 2026) shows a concern that points to proof. The head of IT named two legacy systems that cannot take multi-factor sign-in. The commitment was Committed because the new leader had checked the register: both exceptions are there, and both are past their review dates (IE-1 and IE-2). The follow-up is a review, as the checklist asks (TR-07), and not a new approval.
From a statement to a finding or a plan item
A statement from an interview is only the first step. These five led to proof or to a plan item, each traced in the plan (PL-01).
Interview | What was said | What followed |
|---|---|---|
IR-05 Head of HR | "Leavers who kept access after they left." | DS-04-1 found Contradicted on 24 Sep 2026: Leavers are described as removed in the window. An extract compared with the HR list shows 11 leaver accounts still active. PI-01: Disable the 11 leaver accounts found active and confirm against a new extract. |
IR-03 Head of IT | "Two legacy systems cannot take multi-factor sign-in." | IE-1 is past its review date IE-2 is past its review date PI-02: Review the two inherited exceptions and renew, change or close each. PI-13: Decide to replace, isolate or accept the two legacy systems that cannot take multi-factor sign-in. |
IR-02 Chair of the board | "Whether the board has approved the measures that NIS2 Article 20 asks it to approve." | PI-14: Agree the first-year calendar and the reporting rhythm with the management body. |
IR-08 Internal audit lead | "Three audit findings are open past their due dates." | PI-10: Close or re-date the three audit findings that are past due. |
IR-09 Security team | "Promises made to the team by the last leader that nobody wrote down." | PI-12: Decide the shape of the security team and the one post to fill. |
Of the 9 records, 5 are Noted, not committed: the new leader heard each request and did not yet know whether it could be kept. One follow-up is overdue: IR-05, the leaver extract that the Head of HR was to send on 29 Sep 2026. The new leader reads that as a reason to ask again, and not as a finding.
Guidance — delete before approval
The worked example shows the form working. It is not a standard for how many interviews to hold in a week, or how many commitments to make. Hold as many interviews as your calendar and the people allow, and keep the order.
Related documents
Document | Relationship |
|---|---|
First 90 Days Security Leader Checklist | The requirements TR-01 to TR-16 this guide applies, and the weekly actions that put each interview in its week |
Inherited Security Programme Discovery Workbook | Where each statement from an interview is checked and given one of four finding words |
Security Function Handover Document | The handover from the outgoing leader. Q3 of every interview feeds the commitments section |
Transition Decision Rights Matrix | The transition arrangement for decision rights, agreed with the executive sponsor. No interview settles a right |
100-Day Security Plan | The plan, whose items each trace to an interview record, a finding or a handover gap |
First Executive Briefing Deck for a New Security Leader | The first executive briefing, which reports the groups interviewed as a count |
Security Posture Baseline Scorecard | The baseline, recorded after the interviews and the first findings |
P03-A03 Board Cybersecurity Report Deck Template | The quarterly report to the management body, and the format of the papers the chair will mention |
P09-A03 Incident Response Plan | The incident response plan: its roles, decision rights and clocks. No interview changes them |
P12-A05 Management Body Cybersecurity Accountability Record | The record of what the management body approved and oversaw, which the chair's interview points to |
P16-A02 Annual Security Awareness Plan | The training of the management body, which IV-02 asks about |
P26-A07 Questionnaire Request Tracker | The tracker of customer questionnaires and the commitments in them, which the legal interview asks for |
P04-A02 Policy Framework Standard | Who approves a document, and how often it is reviewed (PF-03) |
Cyber Resilience & Recovery pack (P22) | How long records are kept |
Adapting this template
Guidance — delete before approval
Small organisation: keep all ten groups and let one person stand for several. The managing director may be the executive group, the chair and the sponsor in one. The same person may run IT and hold the system lists. Still ask the four core questions of each hat, and write one record for each. Interview the team on its own. If the team is one or two people, interview them one at a time.
Managed service provider or outsourced IT: if an outsourced service provider runs your systems, interview its account lead as the IT group (IV-03) and as a supplier (IV-08), and ask to see its service reports and its contact for an incident. If you are yourself the service provider, add your own customers' security contacts as a group, and add a line to the log for each.
Regulated entity: a financial entity, a provider under NIS2 or a processor of personal data may have a regulator, an insurer or a contract that names the head of security. Ask Legal at the start whether any does, and note the answer in the first record. Do not change a reporting duty, an incident role or a decision right in an interview. Whether your organisation is essential, important or neither is for counsel.
Interviewing an executive who is also your manager: write the record as for any group, and keep the follow-ups in the same log.
Delete this section before approval.
Framework references
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard. Editions referenced: Directive (EU) 2022/2555 (NIS2); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); UK NCSC board guidance and the ENISA skills framework, as their publishers state them; as published and read on 10 October 2026.
A reference says what its source asks of the management body or the organisation, and which CISO Times document helps with that work. It does not say that a document from this pack meets a requirement of NIS2.
Framework | Reference | Supported by |
|---|---|---|
ISO/IEC 27001:2022 | Clause 4.2 — Understanding the needs and expectations of interested parties | The whole guide: the ten groups are interested parties of the security function, and their expectations are recorded in one format |
NIST CSF 2.0 | GV.OC-02 — “Internal and external stakeholders are understood, and their needs and expectations regarding cybersecurity risk management are understood and considered” | The groups and the record format: stakeholders are determined, and their expectations and concerns about security are written down (IF-02, IF-03) |
NIS2 — Directive (EU) 2022/2555 | Article 20(1) — Member States “shall ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21, oversee its implementation and can be held liable for infringements by the entities of that Article”. The paragraph is “without prejudice to national law as regards the liability rules applicable to public institutions, as well as the liability of public servants and elected or appointed officials” | The board interview (IV-02): the management body approves the measures and oversees them, so the chair is asked what it expects to approve. Counsel confirms what liability means |
NIS2 — Directive (EU) 2022/2555 | Article 21(1) — essential and important entities take “appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems”, and “to prevent or minimise the impact of incidents on recipients of their services and on other services” | The IT, supplier and audit interviews: they say which measures run in practice. The discovery workbook then checks them |
UK NCSC, Cyber Governance Code of Practice and Cyber Security Toolkit for Boards | Cyber Security Toolkit for Boards (version 3.0, published and reviewed 8 April 2025): resources that help boards implement the actions of the Cyber Governance Code of Practice, aimed at board members in medium to large organisations. Security practitioners may also find its essential activities useful. The page does not list the Code's principles | The board interview (IV-02): the chair may use this voluntary toolkit, which is written for boards of medium and large organisations. It is not law |
ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of NIS2, or that your organisation holds a certificate.
Definitions
Term | Meaning in this guide |
|---|---|
New security leader | The head of security, security manager or CISO who has just taken the role. They hold the role that the earlier packs call the Head of Information Security. |
Outgoing security leader | The person who held the role before. They may still be at work, may be serving a notice period, or may already have gone. |
Executive sponsor | The executive the new leader reports to, who agrees the arrangement and the plan, and who speaks for the leader to the management body. |
Management body | The board, or the equivalent, that NIS2 Article 20 says approves the cybersecurity risk-management measures and oversees their implementation. |
Discovery | The work of finding out what the inherited programme does, what it only says it does and what it does not do, by asking for a record, a test or a system view. |
Finding | What discovery found about one item, in one of four words: Evidenced, Described only, Not found or Contradicted. |
Inherited | Held, accepted or promised before the new leader started: an exception, a risk acceptance, a contract, a commitment to a customer or a regulator, or an open incident. |
Stakeholder group | One of the ten groups of people who expect something of the security function or who know how it runs. Each has an ID, IV-01 to IV-10. |
Interview record | The record of one interview, in the six fields IF-01 to IF-06. |
Commitment | What you said you would do in an interview. It carries one of three words: Committed, Noted, not committed, or Declined. |
Follow-up | An action that comes out of an interview, with an owner and a due date. |
Proof | A record, a test result or a system view that shows what a person described. |