Blog · Handover · Problem 94 of 93
Your security lead leaves in two weeks. Most of the program leaves with them.
· 3 min read · By Case Jones
Your head of security, CISO or the one engineer who “does compliance” has handed in their notice. An audit, a customer renewal or a regulatory filing is still on the calendar, and a replacement is months away.
What it costs to leave it
The day after they leave, nobody knows which vendor review is overdue, why a firewall rule was allowed to stay open, which audit finding was really fixed, or what management was last told. Deadlines don’t move for a hiring search, and a filing signed by someone who can’t answer for the program is a risk in itself.
What to capture before the last day
You can’t download a person, but you can get most of what matters written down in two weeks, if you ask for the right things in the right order.
- 1
Get the risk register and open findings off their laptop
Ask for every risk they track, every open audit or customer finding, and the real status of each: fixed with proof, in progress, or quietly forgotten. Put it somewhere the company owns, not a personal folder or a spreadsheet only they can open.
- 2
Write down every exception and who approved it
Each “we allowed this, just for now” needs a line: what it is, why it was allowed, who agreed, and when it should be looked at again. Undocumented exceptions are the first thing a new leader, or an auditor, trips over.
- 3
Turn their routines into procedures with roles, not names
Access reviews, vendor reviews, onboarding and offboarding checks, incident drills: if they happen because one person remembers, write each one as steps owned by a role (IT, HR, a manager) with the evidence each step should leave behind.
- 4
List vendors and systems with an owner each
For every vendor and system that matters, name an owner who stays, the next review date, and where its security documents are. “Which vendor actually answers the phone” should be in the record, not in someone’s memory.
- 5
Know who briefs management next
Find out what management or the board was last told, and decide now who gives the next update. If nobody else has done it in the past year, have them sit in on one before the handover ends.
- 6
Name the interim owner on day one
Whether it’s an internal person or outside help, someone must own the program from the day after the departure, with the authority to approve exceptions and sign what needs signing.
Example
One routine, before and after
Before: “Priya checks who has access to production every quarter.” After: a quarterly access review procedure, one step per system, owned by each system’s owner, each asking for the access export, the accounts removed and a sign-off, with a record kept of every run.
Or keep the program in 93 Compliance, not in one person
Policies have owners and every version is kept. Procedures become checklists whose steps go to roles and team queues, not to one person: overdue steps remind people, then go to the role’s leads or the manager, and every run’s record is kept with its evidence. When someone leaves, the work is still assigned and the history is still there.
The vendors and systems registers keep an owner and a review date for each, and quarterly access reviews can be set up in one click. Risks and requirements are tested against your documents, and problems found in a run are flagged and settled by an owner, so open issues don’t go quiet.
Scheduled reviews (procedures quarterly, policies yearly) come with an AI brief, and a monthly digest for management shows what changed. The audit package gathers it all for the next auditor. The policy builder, procedures, registers and audit package are free, with no card.
- Procedures owned by roles and team queues, not one person
- Vendors and systems with owners and review dates
- Every policy version and every run’s record kept
- Scheduled reviews and a monthly digest for management
Write the program down
The policies, the questionnaire check, procedures and audits are free. Training records are $10 per employee per year.
Start freeWritten by Case Jones, who built 93 Compliance. Former VP of Information Security who took doxy.me from zero to SOC 2 Type 2, through a SOC 2 Type 1 audit, two Type 2 audits and a positive HIPAA assessment. doxy.me is not affiliated with 93 Compliance and has not endorsed it.
Questions
How long does a proper handover take?
Two weeks is enough for the essentials if the departing person spends real time on it: the risk register, open findings, exceptions, routines and owners. Start on the day notice is given.
Should we hire an interim security leader?
If an audit, a renewal or a regulatory filing is close, often yes. Interim help works far better when the program is already written down, because they can pick it up instead of reconstructing it.
Who should own security until a replacement starts?
One named person with the authority to approve exceptions and answer for the program, even if day-to-day work is shared. “Everyone” owning it means nobody does.