Every external CISO mandate ends at some point. That is the normal case, and it rarely comes up in the sales conversation.
When a client does raise it, the question usually sounds like this: are we making ourselves dependent? What follows is almost always a contract clause. Documentation obligation, handover period, release of work results. A provider will put all three into the contract without an argument.
In our experience, none of them determines what is left at the end. That depends on a habit which starts in the first month: whether your security decisions end up in a place you can open without the external CISO.
What is missing when a mandate ends
We have taken over mandates that someone else ran before us. The gap tends to look similar every time, and it is not where the company expects it.
Technical knowledge is rarely missing for long. How mail protection is configured and who holds administrative rights on the server is recorded in the systems. Unpleasant to read up on, but a matter of days.
What is missing is the reasoning. Why is that one server still running an old operating system when it sits at the top of every risk list? Because a machine in production depends on it, the manufacturer will not deliver the new controller until next year, and the management team knowingly carried the residual risk until then. Nobody wrote that sentence into a system. It sits in the head of the external CISO, and it leaves with him.
The second thing missing is the context that does not live in documents: which two processes earn the money, and who to call at the plant when a line stops at 10 at night.
The third is the open items with their status. The list itself usually turns up. The note that item seven has been with the supplier since June and was chased three times without result does not.
The successor finds the list. He does not find the history behind it, which is why he starts with an inventory. You pay for that a second time.
Why the exit clause does not solve this
A documentation obligation in a contract describes an obligation. Nobody has written anything yet.
The core problem with a handover that only happens at the end: at that moment nobody can say any more which decision mattered. The departing mandate holder writes up what he considers relevant, and that is an honest but subjective selection. The company taking over has nothing to compare it against. It notices the gap six months later, when someone has to justify a decision that was taken two years ago.
Then there is the timing. Mandates rarely end calmly. Usually one ends because someone cuts the budget or because both sides are unhappy. In those situations, few people sit down voluntarily and write up context.
Keep the clauses anyway. We write them into our own contracts, and they help when a working relationship ends badly. Which clauses towards IT suppliers are worth having is something we wrote up in contract clauses for IT suppliers. The clauses are the second line of defence. The first one is duller.
What company law assigns to the board anyway
Part of the answer is not negotiable at all.
Article 716a of the Swiss Code of Obligations lists the duties the board of directors cannot hand over, in its own words as «non-transferable and inalienable duties». Two of them bear on this topic. Item 2 names «the determination of the organisation». Paragraph 2 states that the board may assign the preparation and implementation of its resolutions, and adds: «It shall ensure appropriate reporting to its members.»
Translated: how the security role is embedded in your company, who it reports to and in what rhythm, is set by the board of directors. The provider does not supply that. The external CISO fills a position in an organisation you have defined, and that definition remains when he leaves. If you never wrote it down, it remains as well, only then nobody is named in it.
Article 717 paragraph 1 extends the duty of care expressly to «third parties engaged in managing the company». A mandate holder is therefore bound too. That does not relieve you, and we took that distinction apart in outsourcing security responsibility. How a board evidences its own duty of care is covered in cyber liability for the board.
A role only one person understands is not a role
The NIST Cybersecurity Framework 2.0 puts the requirement in one sentence. Subcategory GV.RR-02 asks that «Roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced.» NIST published this version in February 2024.
Established, communicated, understood, enforced. The middle two are the ones that count when a mandate ends. An authority that only the external CISO and the managing director know about is, by that sentence, not established. It is known. The difference does not show in daily operations. It shows at the handover.
The GV prefix stands for Govern, by the way, and that function arrived with version 2.0. The question of roles and authorities sits where the framework files leadership and steering. The same question stands behind the Swiss federal ICT minimum standard, which deliberately sets no target value: without a person who defines the risk appetite, any assessment stays a picture made of numbers.
What to have recorded from the first month
The remedy is unspectacular, and it belongs in the first month of the mandate, not the last.
First, a decision log with four columns: what was decided, on what grounds, by whom, and how long the decision holds. One line per decision, kept in your systems, not in the provider's filing system. The mistake we see regularly is not missing documentation. It is proper documentation sitting on the consultant's drive.
Second, the risk list with names. Not «IT», but one person per entry, and a person inside the company. A risk assigned to the external CISO changes owner when he leaves, and a risk without an owner is one nobody chases.
Third, minutes of the reporting slot. If the management team handles the security situation once a quarter, then as an agenda item with a resolution in the minutes, not as a presentation attached to an email. In most companies, minutes are the document people find again most reliably.
Fourth, and cheapest: once a year, go through the mandate holder's access. Which accounts exist, which rights hang off them, and what of that would still be active tomorrow. In our experience, companies do this only after the mandate has ended, often months later, sometimes not at all.
If you are setting up a mandate right now, this belongs in the first few weeks. We handle it this way in our fractional CISO mandates, and in our experience the effort is small against the trouble it saves. What such a role does day to day is described in CISO responsibilities in an SME.
What you do not have to buy for it
A decision log with four columns needs no platform. It needs a spreadsheet and a habit, and the habit is the expensive part.
Providers regularly offer three items in this situation, and we would cut all three. A GRC tool whose purpose is to manage decisions and risks while the list still fits on one page. A second inventory after the switch, to create a common basis: that is precisely the payment a maintained log avoids. And knowledge management tools that treat a question of accountability as a question of software.
The money is better placed in the time of the internal person who keeps the log. Half an hour a month is enough at the start. How to right-size security spending is something we derived in right-sizing IT security, and why tool estates grow over time in consolidating security tools.
When a switch hurts anyway
Two caveats belong here.
Some time windows tolerate no switch, however good the documentation is. In the middle of a certification process or two weeks before a customer audit, you do not change the role. The reason is the relationships that carry those weeks, not the knowledge. How an incident plays out organisationally is covered in incident response readiness.
Then the second case: nothing is missing at the end of the mandate because nothing was ever there. A mandate that produced one report per quarter leaves no gap. It closed none either. How to tell whether the role is filled or merely awarded is covered in do you need a CISO.
Three months read backwards
The test needs no preparation. Take the minutes of the last three months and look for the security decisions. Not the measures, the decisions. What did you deliberately not do, and on what grounds.
You find measures in every set of minutes, because they cost money and someone had to approve them. The decision against a measure costs nothing and therefore rarely reaches paper. That is exactly the decision nobody can explain after a switch.
If you find three such entries with reasoning and names, your mandate can be handed over, whoever runs it. If you find none, the decision history of your security sits in the head of a single person. That is a topic even when that person is on your payroll.
If you are not sure where your mandate stands here, look at it in a structured way or talk to us. A first conversation is non-binding and costs nothing.
One question interests us as well: if your current mandate holder dropped out tomorrow, which decision from the last two years would be hardest for you to reconstruct?
Frequently asked questions
What stays in the company when an external CISO leaves?
The systems and the measures stay, the reasoning leaves with the person. Who knowingly carried which risk, and why, is usually written down nowhere. Kept in a decision log from the start, a change of provider becomes a formality instead of a fresh inventory.
Is a documentation clause in the contract enough?
It helps when a working relationship ends badly, but it does not solve the problem. At the end of a mandate nobody can judge any more which decision mattered, and mandates rarely end calmly. The clause is the second line of defence, not the first.
Can the board hand over the security role entirely?
No. Article 716a of the Swiss Code of Obligations calls the determination of the organisation a non-transferable duty of the board, and paragraph 2 requires appropriate reporting to its members. An external CISO fills a position that you have defined.
