The Handover Memo: What Your Fractional CISO Should Leave Behind

A fractional CISO is, by design, not in the building most of the time. That is the model's strength until the day the engagement changes or ends, and the company discovers how much of its security program lived in one person's head and outbox.

The fix is a standing artifact: a handover memo maintained throughout the engagement, not written in the last week. Year-end is the right moment to ask for it, while updating it is still easy.

Key takeaways

• Fractional leadership works when the knowledge stays in the building.

• The handover memo is maintained continuously, not written at the exit.

• It names the state of the program, the open decisions, the relationships and the landmines.

• Asking for it is not a signal of distrust; it is how both sides stay honest.

• The memo is also the onboarding document for whoever comes next, internal or external.

Step 1: Ask for the state of the program, in writing

The memo opens with where things stand: the risk register's current shape, the open items and their owners, the policies in force and the ones in draft, the vendors and systems that matter.

Most of this should already exist as the program's normal artifacts. The memo's job is to point at them and say what state they are actually in, which is the part that usually lives only in the leader's head.

Step 2: Record the open decisions and their context

Every program has five to ten decisions mid-flight: the tool under evaluation, the policy waiting on an answer, the risk someone was about to accept. Each needs two lines: what is being decided and where it stands.

Without this section, the next leader reopens every settled question and re-litigates every half-made decision. With it, the program survives the transition.

Step 3: Map the relationships and the landmines

Who the board actually listens to on risk. Which vendor contact answers at night. The system that must never be rebooted in business hours. The executive who needs the bad news first.

This fictional example shows the memo's shape. It is an illustration, not a prescription.

The landmines section is the one nobody writes down and everybody needs.

Step 4: Review it twice a year, together

The memo stays alive through a standing ritual: the company and the fractional leader walk it twice a year, updating what changed. The review doubles as the engagement's honesty check, because a memo that cannot be kept current is telling you the program itself is outrunning its documentation.

Sizing the engagement covers the day-count question, and the decisions that cannot wait for the next CISO is what happens when the handover never happened.

Frequently asked questions

Isn't asking for a handover memo a signal we plan to end the engagement?

No more than a will is a plan to die. It is standard stewardship of company knowledge, and good fractional leaders offer it before being asked, because it makes their work durable.

What if the memo reveals how thin the documentation is?

That is the memo working. Thin documentation is a finding about the program, and the memo is the first artifact that fixes it. Start with the open decisions and landmines; those two sections carry the most risk.

Who should be able to read it?

The executive sponsor and one deputy at minimum, stored where the company controls it. A memo only the fractional leader can access is not a handover document.

How long should it be?

Short enough to maintain: five to ten pages pointing at the real artifacts. The memo is a map, not the territory.

A Defensible Next Step

Before the holidays, ask your fractional leader for the handover memo's first draft and book the twice-yearly review. Book a Decision-Clarity Call if you want the template that starts it.