The First 10 Questions an Interim CISO Should Ask Your Team

When an interim security leader starts, executives often wait for a plan. A better early signal is the questions they ask. Good questions show where the real risk sits, who owns it and what the organization already knows about itself.

The same questions also work in reverse. If your team cannot answer them, you have learned something useful in week one, not month six.

This guide lists ten questions to expect, and what strong and weak answers tend to sound like.

Key takeaways

• The questions a new leader asks in week one show how they think.

• Strong answers are specific, owned and backed by a record. Weak answers are general or depend on one person's memory.

• Ten questions cover assets, incidents, access, vendors, ownership and decisions.

• Gaps in the answers are findings, not failures.

• Write the answers down, because they become the starting baseline.

Step 1: Ask about the business and its crown jewels

Question 1: What does the company make money from, and what would stop it?

Question 2: Which systems and data matter most?

A strong answer names specific systems and data and says who owns each one. A weak answer is a general list of everything or "all of it".

Step 2: Ask about incidents and exposure

Question 3: What incidents have happened in the last two years, and what changed afterwards?

Question 4: What do you know is broken but have not fixed?

Strong answers come with a record and a list of known issues with owners. Weak answers rely on memory or insist there is nothing to report. Every organization has known issues.

Step 3: Ask about access and vendors

Question 5: Who has the most powerful access, and when was it last reviewed?

Question 6: Which vendors hold our data or can reach our systems?

Strong answers give names and dates. Weak answers say access is "controlled" without a review date, or cannot list the vendors.

Step 4: Ask about people and decisions

Question 7: Who decides when a security risk is accepted?

Question 8: Who do you rely on that nobody else could replace?

Question 9: What does the board currently see about security?

Strong answers name a decision-maker and show an example of a recorded decision. Weak answers describe a decision that "just gets made". For the questions directors should ask in return, see questions every director should ask the CISO. NIST's Cybersecurity Framework 2.0 treats governance, meaning roles, responsibilities and oversight, as a core function for this reason.

Step 5: Close with the question that matters most

Question 10: If you were me, what would worry you?

This one often produces the best answer in the room, because the team knows more than any document does. Write down every answer in a simple table. The entries below are illustrative.

Question area (illustrative)	Strong answer sounds like	Weak answer sounds like
Crown jewels	Named systems with owners	"Everything matters"
Incidents	Dated record with lessons	"We have not had any"
Access	Named admins, review date	"It is locked down"
Vendors	A current list with data held	"IT would know"
Risk decisions	A named decider and an example	"It just gets decided"

Frequently asked questions

Why judge a new leader by their questions?

Questions show how they prioritize and what they think matters. They also expose what the organization does and does not know about itself.

What if the team cannot answer most of the questions?

That is a useful result. It shows where the baseline is missing, and it gives the new leader a clear starting list.

Should executives sit in on these conversations?

At least some of them. Hearing the answers directly helps executives understand the real state of risk, rather than a summary.

How soon should the questions be asked?

In the first week. Early answers are the most candid, and they set the baseline for everything that follows.

A Defensible Next Step

Take the ten questions and try to answer them yourself before the new leader starts. Where you stall is where the first conversation should go. Book a Decision-Clarity Call if you would like a second pair of eyes on the answers.