A new CISO's first ninety days are usually spent assessing the technical estate: what systems exist, what the risk register says, where the obvious gaps are. That work matters, but it answers the wrong first question. The question that actually determines whether the role can succeed is narrower and rarely written down anywhere: when this person says no to something the business wants, does that no hold?Why the Mandate Is Usually Vague on ArrivalJob descriptions describe scope — which systems, which teams, which reporting line — far more often than they describe authority. A CISO can be given responsibility for the whole security posture and, in practice, discover that any decision inconvenient enough gets escalated past them and reversed, quietly, by someone with more organizational weight. The scope was real. The authority was not.Questions Worth Asking Before Accepting the Role, Not AfterWho has overturned a security decision in the last year, and why: the answer describes the real chain of authority far better than the org chart does.What happens when the CISO and a revenue-owning executive disagree: is there a defined escalation path, or does it default to whoever is more senior in the room.Is risk acceptance authority written down anywhere: a mandate that exists only as an informal understanding tends to erode the first time it is inconvenient.Who signed off on the last major exception: if the answer is unclear or unrecorded, the mandate was never really tested — it was avoided.“A title with no tested authority behind it is not a weak mandate. It is a mandate nobody has checked yet.”Establishing It Early, DeliberatelyThe mandate question is best answered in the first real disagreement, not avoided until a crisis forces it. A new CISO who lets the first several contentious calls go unchallenged is, without meaning to, teaching the organization what the role's authority actually is — and that lesson is far harder to unteach later than it would have been to establish correctly from the start.Share this articleX (Twitter)LinkedInFacebookCopy Link
CISO LeadershipAug 25, 2026The CISO as Strategic Enabler, Not BlockerThe CISOs a board trusts most are rarely the ones who say no fastest. They are the ones who can say yes, on the record, to the risk a decision actually carries.
OperationsJul 21, 2026The Operating Rhythm a CISO Actually NeedsMost CISO calendars are reactive by default — full of meetings called because something went wrong. A deliberate rhythm is what keeps the job from being entirely made of those.
Risk AppetiteJul 7, 2026Writing a Risk Appetite Statement People Actually UseMost risk appetite statements are signed once, filed, and never consulted again — usually because nobody could apply the wording to an actual decision.
