CISO Succession: Deputy Planning and Key-Person Resilience

Many security functions depend on one or two people whose sudden absence would leave incident decisions, regulator relationships and critical credentials without an owner. CISOs leave, fall ill, take holidays during incidents and get promoted, and the risk is highest in exactly the moment an incident needs a decision. This guide covers how to plan CISO succession, how to design a deputy role that can actually step in, how to find and reduce key-person dependencies across the security team, and how to test that cover works. It is for CISOs, deputy CISOs, CIOs, HR business partners and board members with cyber oversight. Workforce sizing is covered in the Security Workforce Planning Guide, which this guide does not repeat.

Key takeaways

Plan for three scenarios. Planned departure, sudden absence and absence during an incident need different arrangements; most plans only cover the first.
Delegated authority must be written down. A deputy who cannot declare an incident, approve emergency spend or brief the board without the CISO is not cover.
Key-person risk goes beyond the CISO. Look for the one engineer who knows the PAM vault, the only holder of the registrar account, or the sole contact a regulator trusts.
Credentials are the hidden dependency. Break-glass accounts, signing keys and vendor admin logins tied to one person must have documented, tested alternate custodians.
Test it. Run exercises where the CISO is deliberately unavailable, and measure how quickly the deputy reaches each decision.

Why succession is a governance requirement

Succession is not just an HR courtesy. Several frameworks and rules expect security leadership to be clearly defined and resilient.

NIST CSF 2.0: GV.RR-02 expects roles, responsibilities and authorities for cybersecurity risk management to be established, communicated, understood and enforced, and GV.RR-04 expects cybersecurity to be included in human resources practices.
NIST SP 800-53 Rev. 5: PM-2 Information Security Program Leadership Role requires a senior official with the mission and resources to run the programme; PM-13 covers the security and privacy workforce.
UK Cyber Governance Code of Practice (8 April 2025): action E.1 asks boards to establish a governance structure with clear definition of roles and responsibilities, including cyber ownership at executive and non-executive level; E.3 asks for regular two-way dialogue with the CISO or equivalent; D.3 covers board responsibility for regulatory duties such as reporting during an incident.
US SEC rules: Regulation S-K Item 106 requires registrants to describe management's role and expertise in assessing and managing material cybersecurity risks, and Form 8-K Item 1.05 generally requires disclosure within four business days of determining an incident is material. Both assume someone with authority and knowledge is present when it counts. See the SEC Cybersecurity Disclosure Rules Guide.

Three scenarios to plan for

Scenario	What breaks	What the plan needs
Planned departure (resignation, retirement, promotion)	Strategy continuity, stakeholder trust, recruitment gap of several months	Named interim lead, handover pack, recruitment brief, board communication
Sudden absence (illness, emergency, dismissal)	Day-to-day decisions, approvals, access to systems and accounts held personally	Pre-agreed acting CISO, delegated authorities in force immediately, alternate credential custodians
Absence during a major incident	Incident declaration, regulator and law enforcement contact, materiality input, ransom and shutdown decisions	Incident commander role separate from the CISO, written decision rights, deputy rehearsed in exercises

The incident scenario is the one most often missed. A common arrangement is for the CISO to be both strategic owner and de facto incident commander, which means a single absence removes both roles at once.

Designing a deputy who can step in

A deputy CISO title is not succession. The deputy needs authority, exposure and access agreed in advance.

Element	What good looks like
Delegated authority	Written delegation covering incident declaration, emergency change approval, emergency spend up to a set limit, engagement of external incident response and legal counsel, and policy exceptions
Board and executive exposure	Presents to the risk or audit committee at least once a year and attends some executive risk meetings
Regulator and external relationships	Introduced to lead regulators, insurers, law enforcement contacts and key suppliers before they are needed
Decision rehearsal	Leads at least one exercise per year as acting CISO
Access	Own named accounts to security tooling and documented access to shared or break-glass credentials, never a borrowed login
Development plan	Gaps against the CISO role (finance, board communication, legal) covered through stretch assignments and mentoring; the NICE Framework gives a shared vocabulary for describing those skills

Smaller organisations may not have a deputy. Options include naming the head of IT or the CIO as acting security lead for defined decisions, a retained virtual CISO or incident response provider with written authority limits, or a shared arrangement within a group of companies. Whatever the model, the contract or delegation must say what the stand-in can decide. See the IT and Security RACI Template.

Finding key-person dependencies across the team

Key-person risk appears wherever one person is the only one who knows, holds or is trusted with something important. Run a short dependency review across the security function.

List critical services: incident response, detection, identity and PAM, vulnerability management, cloud security, third-party risk, regulatory reporting.
For each, ask four questions: who knows how it works, who holds the credentials, who owns the external relationships, and who can approve changes.
Score cover: zero alternates, one alternate who has not practised, or one or more alternates who have practised in the last year.
Prioritise: zero-alternate items on critical services first, then untested alternates.

Dependency type	Example	Mitigation
Knowledge	Only one engineer understands the SIEM parsing pipeline	Runbooks, paired on-call, rotation through the role
Credentials	CISO personally holds the domain registrar or certificate authority admin login	Move to a team-owned account in the PAM vault with named alternate custodians
Relationships	Regulator only deals with the CISO	Introduce the deputy and keep a contact list in the incident plan
Approval	Only the CISO can approve emergency firewall changes	Delegation to deputy and duty manager with after-the-fact review
Supplier	Managed service relies on one named contact on each side	Contracted escalation paths and named alternates

Where identity fits

The most damaging key-person dependencies are often credentials. Accounts and secrets that only one person can reach become inaccessible when that person leaves, and become orphaned identities if nobody notices. Typical examples are break-glass accounts whose second factor is on one phone, registrar and DNS provider accounts, cloud root accounts, code signing keys, and vendor admin consoles registered to a personal email. Move each into team ownership: a shared account in the PAM vault, at least two named custodians, hardware security keys held separately, and a documented, tested recovery path. Review custodians whenever a security leader changes role. See the Break-Glass Account Guide and Orphaned and Dormant Accounts.

Building the succession plan

Agree ownership: the CISO's line manager (often the CIO, COO or CEO) owns CISO succession with HR; the CISO owns succession for their direct reports.
Name successors by readiness: ready now (can act for up to three months), ready in one to two years, and emergency interim (may be external).
Write the delegation of authority: decision types, limits and when the delegation activates (absence over a set number of hours during an incident, or by instruction).
Prepare the handover pack: strategy and roadmap, risk register and appetite, open regulatory matters, board reporting calendar, budget position, top suppliers and contracts, incident plan and contact lists, and credential custodian register.
Build in the incident plan: separate incident commander from CISO, name alternates for each role, and list who can make materiality and notification inputs. See the Incident Response Plan Template.
Brief the board: the risk or audit committee should know the named interim lead and the delegation, consistent with Code of Practice action E.1.
Exercise and review: at least annually, and after any change of CISO or deputy.

Rolling back is rarely needed for documentation, but review delegations promptly when a named deputy leaves; an out-of-date delegation naming a departed person is worse than none.

Testing that cover works

Absent-CISO tabletop: run a scenario where the CISO is declared unavailable at the start. Time how long the deputy takes to declare the incident, engage counsel and brief executives. See the Cyber Incident Exercises Beyond Tabletop Guide.
Credential recovery drill: have an alternate custodian retrieve and use a break-glass or registrar credential under supervision.
Leave as a test: require the CISO and other key people to take a full block of leave without being contacted, and log what could not be done without them.
Board session led by the deputy: one committee update per year presented by the deputy.

Decision guidance

Internal successor or external hire: an internal successor keeps continuity and relationships; an external hire may be better when the function needs a change of direction. Many organisations name an internal interim and run an external search in parallel.
One deputy or several: a single deputy is simpler; large organisations may split operational and governance deputies, but the delegation must say who leads in an incident.
Virtual CISO as backstop: useful for small organisations, provided authority limits and response times are contracted and the provider has access to the plan and contact lists.
Retention: a named successor with no development or reward plan is a flight risk. Link succession to the retention measures in workforce planning.

Detection and measurement

Percentage of critical security services with at least one practised alternate.
Number of credentials and external accounts with a single custodian (target zero).
Time for the deputy to reach key decisions in the most recent absent-CISO exercise.
Date of last review of the delegation of authority and the handover pack.
Number of board or committee sessions led by the deputy in the last twelve months.

Common failure patterns

Title without authority: the deputy exists on the organisation chart but cannot approve anything in a crisis.
CISO as incident commander and only decision maker: one absence removes both strategic and operational leadership.
Personal credentials: registrar, cloud root or vendor accounts registered to one leader's phone or email.
Relationships not transferred: regulators, insurers and law enforcement contacts know only the CISO.
Stale plans: delegations and contact lists name people who have left.
Never tested: the plan has not been used in an exercise, so nobody knows if it works.

Framework mapping

Framework	Reference	Relevance
NIST CSF 2.0	GV.RR-01; GV.RR-02; GV.RR-03; GV.RR-04	Leadership accountability, defined authorities, resources, HR practices
NIST SP 800-53 Rev. 5	PM-2 Information Security Program Leadership Role; PM-13 Security and Privacy Workforce	Senior security leadership and workforce planning
NIST SP 800-53 Rev. 5	CP-2 Contingency Plan; CP-3 Contingency Training	Roles and alternates in contingency plans and training
UK Cyber Governance Code of Practice	A.2; D.1; D.2; D.3; E.1; E.3	Senior ownership, incident plan and exercises, defined roles, CISO dialogue
US SEC rules	Regulation S-K Item 106; Form 8-K Item 1.05	Management expertise disclosure and timely incident decisions

Practitioner checklist

Name a ready-now acting CISO and an emergency interim option.
Write and approve a delegation of authority covering incident and emergency decisions.
Separate the incident commander role from the CISO and name alternates.
Run a key-person dependency review across critical security services.
Move personally held credentials into team ownership with two or more custodians.
Introduce the deputy to regulators, insurers and key suppliers.
Keep a current handover pack and review it twice a year.
Run an absent-CISO exercise at least annually and after leadership changes.

Standards and references

Related NHI Mgmt Group resources: CISO Guide: First 90 Days · Path to CISO Career Guide · CISO Personal Liability Guide · Crisis Management Guide