Chapter 2 of 14 · Weeks 1–3
The Facts That Matter: Mandate, Budget, Risk Owner
- What exactly was I hired to do?
- How much money do I really control?
- Who owns the risk: me or the business?
- What did someone promise before I arrived?
Most CISO trouble in year one comes from a gap between what you think the job is and what others think it is. You close that gap by finding four facts and writing them down where your boss can see them.
1. Your mandate
What are you accountable for, and what are you only advising on? The two are very different. If you own the outcome but cannot change the systems, you have responsibility without authority. Find out which parts of security sit with you, which sit with IT, engineering, privacy or a parent company, and who settles a disagreement between you.
2. Your budget line
Find the actual number in the actual ledger. Ask what is already committed: licences that renew, contracts with notice periods, salaries. What is left is the money you can move this year, and it is usually much smaller than the headline. Also ask who can spend on security outside your budget. Engineering teams often buy security tools you will later be asked to run.
3. Who owns risk
You do not own the business's risk. You help the people who own it understand it and decide. A product leader who chooses to ship with a known weakness owns that choice. Your job is to make sure the choice was informed, written down and made by someone with the authority to make it.
The question you might not ask out loud
If something goes wrong, won't they blame me anyway?
Sometimes, yes. That is why the written record matters. A risk that was explained, accepted by the right person and dated is very different from a risk nobody wrote down. The record protects the organisation's memory, and it also protects you.
4. What was promised before you came
Ask your boss, the auditors and the sales team what has been promised in your name. Look for audit findings with due dates, customer contracts with security clauses, a certification someone told a big client was coming, and board minutes that mention security. These promises are now yours, whether or not you agree with them.
| Fact | Who to ask | Where it should end up |
|---|---|---|
| Mandate | Your boss | A one-page role statement you both sign off |
| Budget | Finance | A sheet of committed vs movable spend |
| Risk owner | Legal, your boss | A risk acceptance process with named owners |
| Promises | Audit, sales, board secretary | A list with owners and dates |
Rule of thumb:If two people give you different answers to the same fact, you have found your first real piece of work.