The CISO just resigned. What do we do in the next 30 days?

Today: name an interim owner of security risk, in writing, and tell the board. This week: get the departing CISO's knowledge out of their head and into a document, secure every credential and vendor relationship they held, and check which regulatory designations named them. This month: stabilise the team, decide what the role should be before you advertise it, and put interim senior cover in place if nobody inside can carry it. Don't rush the hire. A bad CISO appointment made in panic costs you two years. A well-run gap costs you a quarter.

Day one: ownership and the board

Security risk doesn't pause for a vacancy. Someone has to be the person who's called at 2 a.m., who approves exceptions, and who answers to the board. Name them today, even if it's the CIO or COO as a stopgap, and say what they can and can't decide. Then tell the board or its risk committee, because they'll want to know how oversight continues, and because several regimes expect it. New York's financial regulation requires a designated CISO at all times, and the role can be filled by a third party if needed (New York State Department of Financial Services, n.d.). The FTC's Safeguards Rule similarly requires a "qualified individual" to be in place and allows that to be a service provider (Federal Trade Commission, n.d.). If your CISO's name is on a regulatory filing, a customer contract, or a cyber insurance application, the designation needs a replacement, not just the duties.

Week one: knowledge, keys, and relationships

Most of what a CISO knows isn't written anywhere. Spend the notice period getting it out. The list I'd want, in this order:

• Open incidents and investigations, including anything the CISO was handling quietly.
• Risk acceptances and exceptions, with who signed and when they expire.
• Vendor relationships: the incident response retainer, the MSSP, the pen-test firm, the broker. Who the contacts are and what's been promised.
• Regulatory and customer commitments in flight: audits, questionnaires, remediation plans with dates.
• Credentials and access the CISO personally held: admin accounts, break-glass credentials, password-manager vaults, signing keys, the insurer's portal. Rotate what they held and document the rest.
• The real state of the programme, as opposed to the board deck. Ask what they were most worried about and believe the answer.

Treat the departure itself as a privileged-access event. NIST's incident response guidance expects organisations to maintain their response capability continuously, including the people and authorities that make it work, and a departing security leader is the clearest case of that capability changing overnight (Nelson et al., 2025).

Month one: the team and the decision about the role

The security team will be watching to see whether the organisation treats this as a crisis or a nuisance. Talk to them in the first week. Find out who is actually running what, who's a flight risk, and what they think the departure means. Then decide what the role should be before you post it. The common mistake is to copy the old job description. The useful question is what the organisation needs for the next three years: a builder, an operator, a regulatory face, a product-security leader. Those are different people. NIST's workforce framework is a decent tool for breaking the job into the work it actually involves before you decide who should do it (Petersen et al., 2020).

If nobody inside can hold the interim role credibly, and especially if a board meeting, an audit, or a major customer review is in the next quarter, bring in senior cover on a short engagement. A fractional or interim security leader for ninety days buys you the time to hire well, and often leaves you with a clearer job description than you started with (I've written about when fractional makes sense).

What to tell customers and regulators

Usually nothing proactively, unless a contract or a regulator requires notice of a change in the designated person, in which case counsel handles it. If asked, the honest answer is that the role is covered on an interim basis and a search is under way. Customers care that someone's accountable, not that the title is filled.

What not to do

Don't let the departing CISO's last month become a silent one; the gap in attention is when things go wrong. Don't let the CIO absorb the role permanently by default. Don't hire the first candidate who can start Monday. And don't treat the resignation as a verdict on the person without asking why they left; the reasons often point at exactly the problems the next CISO will face.

What I'd do next

If this is happening now, write the day-one list above into an email to your executive team today and name the interim owner in it. If you'd like senior interim cover or help scoping the role before you hire, that's work I do; request a briefing. More on this cluster is in Executive leadership.