The Seat Is Empty: Six Decisions That Cannot Wait for the Next CISO

The CISO resigns, and the search begins. It will take four to six months if it goes well. Meanwhile, vendors renew, exceptions expire, incidents happen, and the board still expects answers.

The instinct is to put security decisions on hold "until the new leader starts." Risk does not respect the recruiting timeline. Six categories of decision arrive on schedule whether or not anyone is in the seat, and each needs a named owner while it is empty.

Assigning them takes one executive meeting. Skipping it costs a quarter of drift that the new CISO will spend their first months untangling.

Key takeaways

• A vacancy is a decision-assignment problem, not a reason to pause.

• Name an owner for each decision category, with limits on what they may accept.

• Interim external help covers judgment gaps, not just headcount.

• Keep a decision log; the incoming CISO inherits it as their first briefing.

• Tell the board who holds each decision until the seat is filled.

The six decisions that cannot wait

Risk acceptances and exceptions

Exceptions expire on their own schedule. Somebody must decide whether each renewal is justified - and somebody must be authorized to say no.

Assign it to a senior operator - the CTO or COO - with a written limit: routine renewals within existing thresholds, anything larger held for the interim advisor or the board.

Incident declaration and response

Incidents will not wait for the org chart. The vacancy is exactly when the response plan's authority matrix gets tested.

Confirm who declares an incident, who leads the first hours, and which external firm is engaged. If the departed CISO was the answer to any of these, fix it this week.

Vendor and renewal decisions

Security vendors renew on their own calendar. Auto-renewing everything by default is a decision - just an unexamined one, often worth five or six figures.

Assign each upcoming renewal to an owner with a simple test: is it used, is it overlapping, is it still the right tool. Renewals that pass get signed; the rest get a decision, not a default.

Customer and audit commitments

Questionnaires, audit responses and customer security reviews have deadlines that ignore your recruiting process. Missing them costs deals and credibility.

Name who answers, and have outside help review the consequential ones. An overpromised answer written under pressure becomes a liability that outlives the vacancy.

The security team's direction and morale

The remaining team is watching. A vacancy without visible leadership is when good people update their resumes and urgent work quietly stops.

Give the team an interim lead they trust, a clear statement of priorities, and a realistic account of the search timeline. Retaining the team is the single best gift to the incoming CISO.

What gets escalated to the board

The board's cyber reporting cannot pause for a quarter and resume with a shrug. Decide what reaches the board during the vacancy - incidents, material exceptions, and the state of the search itself.

A short written update on a standing schedule keeps oversight real and prevents the new CISO's first board meeting from doubling as an archaeology dig.

The related discussion of the benefits of an interim CISO is worth your time alongside this one.

Frequently asked questions

Should we rush the hire to close the gap?

No. A rushed security leader is a multi-year mistake; a well-covered vacancy is a two-quarter inconvenience. Cover the decisions deliberately and run the search properly.

Is an interim or fractional CISO worth it for a few months?

Usually yes, if the vacancy will exceed a quarter. The value is not hands on keyboards; it is senior judgment on the six decision categories and continuity for the board and the team.

What should the incoming CISO receive on day one?

The decision log from the vacancy: every exception renewed, vendor decision, incident and customer commitment, with reasons. It is the fastest honest picture of the environment they have joined.

A Defensible Next Step

If your security seat is empty - or might be this year - spend one executive meeting assigning these six decisions to named people with limits. Book a Decision-Clarity Call if you want interim coverage while you search.