The Fractional CISO's Introduction: Say What You Know and What You Have Not Seen

An incoming fractional CISO may know the language of the work while still learning the company. The first board conversation has to carry both facts: relevant experience and incomplete local knowledge.

The communication problem is familiar to anyone joining a project. How do you explain what you have learned without turning an early impression into a settled conclusion? A clear introduction can separate observations, questions and the intended subject of the next conversation.

TLDR

• An observation and an interpretation are different statements.

• Name the material behind a statement.

• Leave unanswered questions visibly unanswered.

• An introduction can establish shared language without claiming a complete assessment.

Give observations their own label

In a fictional introductory slide, "I have read two sample reports" describes an activity. "The reporting is effective" is a conclusion. The second does not follow automatically from the first.

A useful introduction lets the audience see the distinction: material seen, points understood and questions remaining. It need not imply that the material represents every part of the company.

The approach follows Google's audience principle of explaining what the reader needs rather than assuming shared knowledge. The board should not have to infer whether a statement is an observation, an opinion or a question.

Define the next conversation, not the whole engagement

The speaker can say "Next time, I would like to explain how the report is assembled" without promising an outcome before the relevant work is understood. That is a topic for a later conversation, not an operational plan.

A short example can make the introduction concrete. An invented chart with clearly marked sample data lets the presenter discuss labels and interpretation without presenting a client's history as evidence.

The introduction ends with a shared understanding of scope: what was explained today, what remains a question and which subject belongs in the next discussion. It does not need a maturity score or a claim that every gap has already been found.

Sources for the definitions and writing principles discussed here: Google, Technical Writing One: Audience, last updated March 28, 2025. The examples and suggested discussion formats are illustrative.

Frequently asked questions

Does the format tell a CISO what to assess?

No. It is about presenting the state of one's understanding, not defining an assessment or operational priorities.

Should uncertainty be hidden to sound confident?

A clearly named question is easier to discuss than an unsupported conclusion. The reader should be able to tell which is which.

How much background should the audience hear?

Enough to understand the words and scope of the presentation. Details that do not serve that purpose can remain in supporting material.

A practical next step

Before the first introduction, label each statement as observation, interpretation or open question. Rewrite any sentence whose category is unclear. Book a Decision-Clarity Call for help making technology work easier to explain.