Transition Decision Rights Matrix
Clarifies which decisions the new leader owns, shares or escalates during the transition.
Available soon
- Format
- Excel
- Size
- 73 KB
- Length
- 12 sheets
- Version
- 1.0
- Updated
Follow this documentFree account. We can email you when it changes.
What's inside
What changed
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Read Decision Rights. Each row is one kind of decision, with the rule of an earlier pack that gives the right and who holds it under that rule. That wording is quoted and unchanged. This workbook never gives the new leader a right that the rule does not give. |
| 2 | For each decision type, choose Owns, Shares, Escalates for days 1 to 30, 31 to 60 and 61 to 90, and name who is asked or who receives the decision. The pack's defaults are filled in. Change them with the executive sponsor, where the organisation works differently. The Check column stops a mode that takes a right back from the new leader as the days pass, and it holds incident decisions as the incident plan sets them. |
| 3 | Fill every [[placeholder]] in the published rule: spending and hiring authority, and the regulator contact, are the organisation's own. No earlier pack sets them. |
| 4 | On Arrangement Check, enter the start date, the as-at date and the date the executive sponsor agreed the arrangement in writing. TR-05 asks for that within [[10]] working days of the start. Enter the date of each review at day 30, 60 and 90. |
| 5 | List every inherited exception and risk acceptance on Inherited Items. Each one is reviewed within [[30]] days of the start (TR-07). The approver is the one the band sets. Record the decision and its date. |
| 6 | On Responsibilities, keep exactly one A on every row. On Role Holders, name who holds each role and who deputises. Where the outgoing leader has gone, the new leader holds their duties from the records and says so. |
| 7 | Clear every line of Arrangement Check that says Action needed. Replace the EXAMPLE rows and holders before approval. Keep the signed arrangement and this workbook for [[3]] years (TR-16). |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
EXAMPLE: Kestrel Components B.V. (EXAMPLE), a manufacturer of industrial pumps and valves in an EU Member State, with about 600 staff and two plants, with a new head of security, as at 30 Sep 2026. Every date, name and band in a yellow cell or an EXAMPLE row is an example. The holders that are still [[placeholders]] show what you must still fill in.
Tailoring for a small organisation: one person may hold several roles, and the new leader may be the whole security function. Keep each activity's single A. The sponsor is usually the chief executive. Where there is no separate legal or HR role, name the person who does that work, or the outside adviser.
Tailoring for a regulated organisation: where a regulator, a customer or the law expects the management body to approve more than the earlier packs say, move the mode to Escalates for that decision type. Never move the right itself. Counsel confirms what a management body's duties and liability mean. This workbook is not advice on either.
Tailoring where a service provider runs your IT or security operations, or where the new leader is outsourced or part time: the provider can do the R work, and the written arrangement is with the organisation's own sponsor. Counsel confirms that the contract gives an outsourced leader the right to take each decision. The Head of Information Security of the earlier packs holds a right only where those packs give it.
Incident decisions (DE-04) are the incident plan's. The workbook names no clock and changes no decision right. P09 and P18 own both.
Delegation: a role holder may delegate the R work to a named person, and never the A. Record a standing delegation in the Deputy column.
Decision Rights
Owns · Shares · Escalates, for each window of the 90 days. The wording of the right is the earlier pack's and is never changed here. Yellow cells are yours to tailor.
| Decision ID | Decision type | Rule that sets the right | Who decides under that rule (unchanged) | Days 1 to 30 | Days 31 to 60 | Days 61 to 90 | Asked or escalated to | Mode today (calc) | Check (calc) | Note |
|---|---|---|---|---|---|---|---|---|---|---|
| DE-01 | Policy | P04 PF-03 | Executive management approves a Policy-tier document. The Head of Information Security approves a Standard and a Procedure. | Escalates | Shares | Owns | Executive sponsor | Escalates | OK | These modes are the new leader's rights over a Standard and a Procedure. A Policy-tier document stays with executive management in every window. |
| DE-02 | Exception | P02 EX-05 | The approver for the band: control owner (Low), Head of Information Security (Medium), Head of Information Security with the accountable executive (High), the board or its equivalent (Critical). Nobody approves an exception they requested or a risk they own. | Shares | Owns | Owns | Executive sponsor | Shares | OK | The first decision on an inherited exception is a review, not a new approval (TR-07). |
| DE-03 | Risk acceptance | P05 RM-08 | The approver for the band of the residual risk: risk owner, with the Head of Information Security from Medium, the accountable executive from High, the board or its equivalent at Critical. Outside tolerance only the board or its equivalent. | Escalates | Shares | Owns | Executive sponsor | Escalates | OK | The new leader accepts no new risk in the first 30 days. Each goes to the accountable executive and the sponsor. For a Low-band acceptance the approver is the risk owner (P05 RM-04), so the new leader is not an approver in any window. |
| DE-04 | Incident decision | P09 DECISION_RIGHTS | As P09's decision rights say: the incident manager, the executive incident lead, the communications lead and the board, by decision. | Owns | Owns | Owns | Executive sponsor | Owns | OK | Unchanged in every window. The new leader takes only what P09 gives the Head of Information Security, and confirms the role holders and deputies in week 1 (TR-09). |
| DE-05 | Supplier | P06 TP-05 | Each supplier assessment ends in a documented decision (Approve, Approve with conditions, Escalate, Reject); a supplier outside appetite goes to the risk register (P06 TP-06). | Escalates | Shares | Owns | Executive sponsor | Escalates | OK | Renewals already due are decided by the contract owner as before, with the new leader's view. |
| DE-06 | Spend | [[the organisation's own authority limits]] | [[who may commit money, up to what limit]]. No earlier pack sets spending authority. | Escalates | Shares | Owns | Executive sponsor | Escalates | OK | Owns means up to the limit the sponsor has set in writing. |
| DE-07 | Hiring | [[the organisation's own authority limits]] | [[who may open, fill or end a post]]. No earlier pack sets hiring authority. | Escalates | Escalates | Shares | Executive sponsor | Escalates | OK | Changes to the team structure wait for the Decide phase (TR-01). |
| DE-08 | Regulator contact | P12 NR-02 | Contact with the competent authority and the CSIRT as the organisation sets it [[named contact]]. A decision to report an incident to an authority stays with P09's executive incident lead, on the incident manager's screen. | Escalates | Shares | Owns | Legal | Escalates | OK | Owns covers routine contact. A reporting decision is P09's and P18's, unchanged. |
Inherited Items
Every exception and risk acceptance held, accepted or promised before the new leader started (TR-07). Nothing continues by default. The approver is the band's own, from the earlier packs.
| Item ID | Kind | What it is | Band | Approved on | Approved by | Review on | Past review (calc) | Days past (calc) | Who may renew, change or close it (calc) | Head of Information Security takes part (calc) | Your mode today (calc) | Latest review the band allows (calc) | Review date and the band's term (calc) | Decision | Decided on | Check (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| IE-1 | Exception | Legacy order-entry server without multi-factor sign-in | Medium | 4 Mar 2026 | Jonas Brandt | 31 Aug 2026 | Past review | 30 | Head of Information Security | Yes | Shares | 31 Aug 2026 | Within term | Open | Past review, decide now | |
| IE-2 | Exception | Shared engineering account on the plant network | High | 17 Jun 2026 | Jonas Brandt | 15 Sep 2026 | Past review | 15 | Head of Information Security and Accountable executive | Yes | Shares | 15 Sep 2026 | Within term | Open | Past review, decide now | |
| RA-1 | Risk acceptance | Unsupported operating system on one test rig | Low | 30 Nov 2026 | In date | Risk owner | No | Escalates | Open | In date | ||||||
| RA-2 | Risk acceptance | Shared inbox for supplier invoices | Medium | 29 Jan 2027 | In date | Risk owner and Head of Information Security | Yes | Escalates | Open | In date | ||||||
| RA-3 | Risk acceptance | No offline backup for one plant's design archive | High | 14 Dec 2026 | In date | Accountable executive and Head of Information Security | Yes | Escalates | Open | In date |
Responsibilities
R does it · A answers for it, exactly one per row · C is consulted before · I is told after. Yellow cells are yours to tailor. A blank cell means the role takes no part.
| Activity ID | Activity | Rule | New security leader | Outgoing security leader | Executive sponsor | Management body | HR | Legal | Data Protection Officer | Head of IT | A (calc) | R (calc) | Check (calc) | What the rule says |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| TX-01 | Agree the appointment and the decision-rights arrangement | TR-05 | R | A | I | C | C | 1 | 1 | OK | Agree the transition arrangement for decision rights in writing with the executive sponsor within [[10]] working days of the start, and review it at day 30, day 60 and day 90. The arrangement gives no right that the packs which set each right do not give. | |||
| TX-02 | Complete the handover document | TR-06 | C | A | I | C | C | C | 1 | 0 | OK | The outgoing leader completes the handover document (A05) before they leave. Where they have gone, the new leader builds it from records and writes down what is missing. A section with nothing in it says None, with a date, and who said so. | ||
| TX-03 | Remove the outgoing leader's access and confirm it | TR-08 | A | I | C | R | 1 | 1 | OK | Remove the outgoing leader's access on the day they leave: accounts, administrator rights, tokens, shared secrets, vendor portals and any personal account used for work. Confirm the removal against a fresh extract within [[2]] working days, as P07 AR-07 asks of any removal. | ||||
| TX-04 | Interview the stakeholder groups | TR-03 | A | C | 1 | 0 | OK | Book an interview with every stakeholder group in A04 during the Listen phase and hold it by the end of week 4, with the same core questions, and record each interview in the record format: expectation, concern, commitment and follow-up. Interview before judging. | ||||||
| TX-05 | Look for the proof and record the findings | TR-02 | A | C | C | C | C | 1 | 0 | OK | Every discovery finding states what was seen: a record, a test result or a system view. A statement alone is Described only. A finding is checked again after [[6]] months, or on a material change. | |||
| TX-06 | Review the inherited exceptions and risk acceptances | TR-07 | A | C | I | C | 1 | 0 | OK | Review every inherited exception and risk acceptance within [[30]] days of the start. One that is past its review date is renewed, changed or closed by the approver its band sets (P02 EX-05, P05 RM-08). Nothing continues by default. | ||||
| TX-07 | Confirm the incident roles and list the open incidents and duties | TR-09 | A | C | I | C | C | 1 | 0 | OK | In week 1, list every open incident and every open reporting duty, and confirm in writing who holds each incident role and who deputises (P09 IM-03). The roles, decision rights and clocks are P09's and P18's, unchanged. | |||
| TX-08 | Confirm the regulator, responder and supplier contacts | TR-10 | A | C | R | 1 | 1 | OK | Confirm, by a call or a message and not from a list, the contacts at the regulator, the CSIRT, the insurer, the responders and each critical supplier within [[30]] days of the start. Record the date of each confirmation. | |||||
| TX-09 | Tell the management body what NIS2 Article 20 asks of it | TR-11 | R | A | I | C | 1 | 1 | OK | Within [[60]] days of the start, tell the management body, through the executive sponsor, what NIS2 Article 20 asks of it: to approve the measures, to oversee their implementation and to follow training, and that it can be held liable. Counsel confirms what liability means. | ||||
| TX-10 | Record the baseline | TR-12 | A | I | C | 1 | 0 | OK | Record the baseline within [[60]] days of the start, in counts and in levels in words. Record an unknown value as Unknown, with a reason and the plan item that will find it out. Repeat the baseline in month 12, so that the comparison is ready at the first anniversary. | |||||
| TX-11 | Give the first executive briefing | TR-13 | R | A | I | C | 1 | 1 | OK | Brief the executives at the end of discovery with the findings in the four words, the top risks, the baseline and the asks. Make each ask as P03 BR-06 sets out: options, a recommendation, the cost and the risk of not deciding. | ||||
| TX-12 | Agree the 100-day plan | TR-14 | R | A | C | C | C | 1 | 1 | OK | Every item in the 100-day plan traces to a finding, an interview record, a handover gap or an inherited exception. The plan lists what was dropped and why. A promise outside the organisation follows the plan, and never leads it. | |||
| TX-13 | Review the checklist, the findings and the plan at day 30, 60 and 90 | TR-15 | A | C | I | 1 | 0 | OK | Review this checklist, the discovery findings and the plan at day 30, day 60 and day 90, and the baseline and the calendar at the first anniversary. Record what changed and why. |
Role Holders
Each role in the matrix, what it does, who holds it and who deputises. The counts are the matrix's letters for the role. A deputy is bound by the same rules.
| Role, as the matrix names it | What the role does | Held by | Deputy | R (calc) | A (calc) | C (calc) | I (calc) | Check (calc) |
|---|---|---|---|---|---|---|---|---|
| New security leader | Learns the programme, interviews the stakeholders, verifies what is claimed, keeps the discovery workbook, agrees the decision rights, proposes the plan and reports counts. Promises nothing until it is checked. | Sam Okafor, Head of Information Security | [[Deputy]] | 4 | 8 | 1 | 0 | OK |
| Outgoing security leader | Completes the handover document, lists what they hold and have promised, introduces the new leader to contacts and hands over access and accounts. Where they have gone, the new leader builds the handover from records. | Jonas Brandt, Head of Information Security (left 28 Aug 2026) | None: has left | 0 | 1 | 3 | 1 | OK |
| Executive sponsor | Agrees the decision-rights arrangement and the plan in writing, opens doors to the other executives and the management body, and decides what only an executive may decide. | Ines Moreau, Chief executive | [[Deputy]] | 0 | 4 | 3 | 3 | OK |
| Management body | Approves the cybersecurity risk-management measures and oversees their implementation (NIS2 Article 20), follows training, and receives the reports. | A board of five: the chair, the chief executive, the chief financial officer and two non-executive directors | [[Deputy]] | 0 | 0 | 0 | 4 | OK |
| HR | Confirms the leaver and joiner records, the outgoing leader's departure date and notice terms, and the new leader's training and onboarding. | [[HR lead]] | [[Deputy]] | 0 | 0 | 4 | 0 | Name who holds it |
| Legal | Confirms what the outgoing leader must hand over, what commitments to customers and regulators exist, and what the management body's liability means. | [[in-house or external counsel]] | [[Deputy]] | 1 | 0 | 7 | 1 | Name who holds it |
| Data Protection Officer | Gives the new leader the records of processing, breach decisions and open data protection matters. | [[or the privacy lead where no DPO is appointed]] | [[Deputy]] | 0 | 0 | 1 | 0 | Name who holds it |
| Head of IT | Gives the new leader system views, the account inventory and the change calendar, and removes access. | [[Head of IT]] | [[Deputy]] | 1 | 0 | 6 | 0 | Name who holds it |
Arrangement Check
Arrangement check
The dates, the checks and where every decision type stands today. Every check line should say 'Meets the check' before the arrangement is approved. Counts and words only.
Dates
| Item | Value | What it means |
|---|---|---|
| Start date (day 1) | 14 Sep 2026 | The new leader's first day. EXAMPLE value. Type a date. |
| As-at date | 30 Sep 2026 | The day the arrangement is read at. Type a date. |
| Day number (calc) | 17 | The as-at date counted from the start date as day 1. |
| Week (calc) | 3 | Weeks run 1 to 13 from the first day. |
| Phase (calc) | Listen | Listen, Verify, Decide, Propose (First 90 Days Security Leader Checklist). |
| Window (calc) | Days 1 to 30 | The window whose mode is 'today' on Decision Rights. |
| Arrangement agreed in writing on | 23 Sep 2026 | The date the executive sponsor agreed this arrangement. Leave empty until they have. EXAMPLE value. |
| Working days allowed (TR-05) | 10 | The house default is 10. Change it if the sponsor agrees a different limit. |
| Working days from the start to the agreement (calc) | 7 | Monday to Friday, counted after the start date. Public holidays are not taken out. |
| Agreed within the working days allowed (calc) | Yes | Yes, No, or not yet agreed. |
Reviews of the arrangement (TR-05, TR-15)
| Review | Due on (calc) | Reviewed on | Status (calc) |
|---|---|---|---|
| Review at day 30 | 13 Oct 2026 | Not yet due | |
| Review at day 60 | 12 Nov 2026 | Not yet due | |
| Review at day 90 | 12 Dec 2026 | Not yet due |
Each review looks at this arrangement, the findings and the plan. Day 30 is the date 29 days after the start date, because the start date is day 1.
Checks
| Check | Result | Status | What it means |
|---|---|---|---|
| Decision types in the arrangement | 8 | Meets the check | The 8 decision types DE-01 to DE-08, and any you add. |
| Decision types whose check says OK | 8 | Meets the check | A mode for each window, a person or role to ask, and no right taken back. |
| Types where the new leader's right falls as the days pass | 0 | Meets the check | A right may be held back early and given over time. It is never taken back once given. |
| Incident decisions that are not Owns in every window | 0 | Meets the check | Incident decisions are the incident plan's (P09) and stay as it sets them in every window. |
| Types with no one named to ask | 0 | Meets the check | Every mode needs a person or role who is asked, or who receives the decision. |
| Types whose rule or approver is still a [[placeholder]] | 3 | Action needed | The organisation's own authority limits and contacts. In the example: DE-06, DE-07, DE-08. |
| Activities with exactly one accountable role | 13 | Meets the check | One A on every row of Responsibilities. An activity with two accountable roles has none. |
| Activities with a letter other than R, A, C or I | 0 | Meets the check | Only the four letters are allowed. |
| Roles that take part but have no named holder | 4 | Action needed | A role with letters in the matrix needs a name on Role Holders. A [[placeholder]] is not a name. |
| Roles listed that are not in the matrix | 0 | Meets the check | Each role on Role Holders must match a column heading of the matrix. |
| Arrangement agreed within the working days allowed | Yes | Meets the check | TR-05. Agreed in writing with the executive sponsor within 10 working days of the start unless you changed the limit above. |
| Reviews overdue | 0 | Meets the check | A review is overdue when the as-at date is after its due date and no review date is entered. |
| Inherited items past their review date, still open | 2 | Action needed | TR-07. Renew, change or close each, by the approver its band sets, within 30 days of the start. |
| Inherited exceptions whose review date is beyond the band's term | 0 | Meets the check | An exception runs no longer than the term its band allows. Check an inherited date that does not. |
| Overall | 3 | Not ready | The number of checks above that do not yet say 'Meets the check'. |
Where each decision type stands today
Days 1 to 30: Owns 1 of 8, Shares 1 of 8, Escalates 6 of 8
| Decision type | Mode today | Asked or escalated to | Rule that sets the right |
|---|---|---|---|
| DE-01 Policy | Escalates | Executive sponsor | P04 PF-03 |
| DE-02 Exception | Shares | Executive sponsor | P02 EX-05 |
| DE-03 Risk acceptance | Escalates | Executive sponsor | P05 RM-08 |
| DE-04 Incident decision | Owns | Executive sponsor | P09 DECISION_RIGHTS |
| DE-05 Supplier | Escalates | Executive sponsor | P06 TP-05 |
| DE-06 Spend | Escalates | Executive sponsor | [[the organisation's own authority limits]] |
| DE-07 Hiring | Escalates | Executive sponsor | [[the organisation's own authority limits]] |
| DE-08 Regulator contact | Escalates | Legal | P12 NR-02 |
Incident decisions, in the incident plan's own words (unchanged)
The incident plan holds these (P09-A03 Incident Response Plan). This workbook changes none of them and states no clock. Read the plan for the full text.
| Decision | Who decides | ||
|---|---|---|---|
| Isolate a system, site or account | Incident manager | ||
| Stop a customer-facing service | Executive incident lead | ||
| Report to an authority | Executive incident lead, on the incident manager's reporting screen | ||
| Say anything outside the organisation | Communications lead, with the executive incident lead's approval | ||
| Engage outside responders or the insurer's panel | Incident manager, within the [[retainer]]; above it the executive incident lead | ||
| Pay a ransom or extortion demand | Only the board or its equivalent | ||
Lists
| Modes | RoleNames | RACI | InhKind | Bands | InhDecision | ApproverKey | ApproverText | ApproverDays |
|---|---|---|---|---|---|---|---|---|
| Owns | New security leader | R | Exception | Low | Open | Exception|Low | Control owner | 365 |
| Shares | Outgoing security leader | A | Risk acceptance | Medium | Renewed | Exception|Medium | Head of Information Security | 180 |
| Escalates | Executive sponsor | C | High | Changed | Exception|High | Head of Information Security and Accountable executive | 90 | |
| Management body | I | Critical | Closed | Exception|Critical | Board or its equivalent | 30 | ||
| HR | Risk acceptance|Low | Risk owner | ||||||
| Legal | Risk acceptance|Medium | Risk owner and Head of Information Security | ||||||
| Data Protection Officer | Risk acceptance|High | Accountable executive and Head of Information Security | ||||||
| Head of IT | Risk acceptance|Critical | The board, or a board risk committee it has delegated this to; in a two-tier structure, the management board; where there is no board, such as in an owner-managed company, executive management |
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| R: responsible | Does the work. Several roles may share it. |
| A: accountable | Answers for the outcome and signs it off. Exactly one per activity. The A may also do the work. |
| C: consulted | Asked for advice before the activity is done or decided. |
| I: informed | Told after the activity is done or decided. |
| Owns | The new leader takes the decision where the published rule names the Head of Information Security, and tells the named person afterwards. |
| Shares | The new leader takes the decision after asking the named person for a view, in writing. The published approvers are unchanged. |
| Escalates | The new leader does not take the decision alone. They bring it to the named person, who may take it only where the published rule gives them the right, and who otherwise gives a view. |
| Decision right | The power to take a kind of decision. Earlier packs give each right to a named role. The transition arrangement never gives a right that those packs do not give. |
| Transition arrangement | What the new leader does with a decision right in the first 30, 60 and 90 days: Owns it, Shares it, or Escalates it. It is agreed in writing with the executive sponsor. |
| Executive sponsor | The executive the new leader reports to, who agrees the arrangement and the plan, and who speaks for the leader to the management body. |
| Management body | The board, or the equivalent, that NIS2 Article 20 says approves the cybersecurity risk-management measures and oversees their implementation. |
| Inherited | Held, accepted or promised before the new leader started: an exception, a risk acceptance, a contract, a commitment to a customer or a regulator, or an open incident. |
| New security leader | Learns the programme, interviews the stakeholders, verifies what is claimed, keeps the discovery workbook, agrees the decision rights, proposes the plan and reports counts. Promises nothing until it is checked. |
| Outgoing security leader | Completes the handover document, lists what they hold and have promised, introduces the new leader to contacts and hands over access and accounts. Where they have gone, the new leader builds the handover from records. |
| Executive sponsor | Agrees the decision-rights arrangement and the plan in writing, opens doors to the other executives and the management body, and decides what only an executive may decide. |
| Management body | Approves the cybersecurity risk-management measures and oversees their implementation (NIS2 Article 20), follows training, and receives the reports. |
| HR | Confirms the leaver and joiner records, the outgoing leader's departure date and notice terms, and the new leader's training and onboarding. |
| Legal | Confirms what the outgoing leader must hand over, what commitments to customers and regulators exist, and what the management body's liability means. |
| Data Protection Officer | Gives the new leader the records of processing, breach decisions and open data protection matters. |
| Head of IT | Gives the new leader system views, the account inventory and the change calendar, and removes access. |
| Window | A period of the 90 days, counted from the start date as day 1: Days 1 to 30, Days 31 to 60, Days 61 to 90. The mode today is the mode of the window the as-at date falls in. |
| Phase | The four phases of the 90 days: Listen (weeks 1 to 3), Verify (weeks 4 to 7), Decide (weeks 8 to 10), Propose (weeks 11 to 13). |
| DE-nn, TX-nn, TR-nn | The decision types of this matrix, its activities, and the requirements of the First 90 Days Security Leader Checklist they serve. |
| (calc) | A cell or column the workbook calculates. Do not type or paste over it. |
| EXAMPLE | A worked example: Kestrel Components B.V. (EXAMPLE), as at 30 Sep 2026. Replace the rows and holders before approval. |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Annex A 5.2 — Information security roles and responsibilities | Decision Rights, Responsibilities and Role Holders: security roles and responsibilities allocated for the transition, with one accountable role for each activity |
| NIST CSF 2.0 | GV.RR-02 — “Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced” | Decision Rights and Responsibilities: the decision rights of each role are established, communicated and understood, and held at the level the earlier packs give them |
| NIS2 — Directive (EU) 2022/2555 | Article 20(1) — Member States “shall ensure that the management bodies of essential and important entities approve the cybersecurity risk-management measures taken by those entities in order to comply with Article 21, oversee its implementation and can be held liable for infringements by the entities of that Article”. The paragraph is “without prejudice to national law as regards the liability rules applicable to public institutions, as well as the liability of public servants and elected or appointed officials” | Decision Rights (DE-02 and DE-03) and Arrangement Check: the management body approves and oversees. The matrix leaves the board or its equivalent as the approver the earlier rules name for a Critical band, and the sponsor tells it what Article 20 asks of it (TR-11). Counsel confirms what liability means |
| NIS2 — Directive (EU) 2022/2555 | Article 21(1) — essential and important entities take “appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems”, and “to prevent or minimise the impact of incidents on recipients of their services and on other services” | Responsibilities: the activities of the transition each have one accountable role, so that the measures the entity has taken keep an owner while its security leader changes |
| NIS2 — Directive (EU) 2022/2555 | Article 23(1) — notify the CSIRT or competent authority, without undue delay, of any significant incident; where appropriate, notify the recipients of the services of significant incidents likely to adversely affect those services | Decision Rights (DE-04 and DE-08): a decision to report an incident to an authority stays with the incident plan's executive incident lead. This workbook states no clock |
Editions referenced: Directive (EU) 2022/2555 (NIS2); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); UK NCSC board guidance and the ENISA skills framework, as their publishers state them; as published and read on 10 October 2026
ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of NIS2, or that your organisation holds a certificate.
This workbook does not say which document, record or practice meets a requirement of NIS2. Each reference says what its source asks of the management body or the organisation and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.
Directive (EU) 2022/2555 is addressed to the Member States, and binds essential and important entities through their national law. Article 20 asks the Member States to ensure that the management body approves the cybersecurity risk-management measures, oversees their implementation, can be held liable for infringements of Article 21, and is required to follow training. What liability means for a member of a management body depends on national law, and counsel confirms it. Whether your organisation is an essential or an important entity comes from its scope assessment and from counsel, and this pack does not decide it.