Grade your offer on paper, not on vibes: every term that decides whether the seat is survivable, in one fill-in working document.
Part of the CISO Interview Template Pack · cisoprep.com
Work through this against the actual offer in front of you, ideally with the offer letter, any side letters, and your email thread open in another window. Do it before your final call with the company, and again the night before you sign. After three weeks of negotiation, motivated reasoning sets in and you will grade your own deal on a curve. The checklist exists so that paper, not memory, makes the call.
Every line gets one of four status codes:
| Code | Meaning |
|---|---|
| W | Confirmed in writing: offer letter, side letter, or an email from a named executive (not the recruiter) |
| V | Verbal only: someone said it, nobody wrote it |
| U | Unknown: never discussed, or the answer was vague enough to mean nothing |
| R | Refused: you asked directly and they declined |
Three rules for scoring honestly:
This is the section that determines what job you are actually taking. Two offers with identical money can be different jobs, and this table is where the difference shows.
| # | Item | What good looks like | Status (W/V/U/R) | Notes |
|---|---|---|---|---|
| 1.1 | Reporting line, named | You report to a named executive officer (CEO, CTO, CIO, CFO, or GC), stated in the offer letter. Not "TBD," not a VP, not "initially reporting to" | ☐ | |
| 1.2 | Layers to CEO | Zero or one. Two or more layers means you are not the CISO in any meaningful sense, whatever the letter says | ☐ | |
| 1.3 | Appointed officer status | You will be a duly appointed officer of the corporation under the bylaws. This is what pulls you inside the D&O definition of "insured persons." Title alone does not do it | ☐ | |
| 1.4 | Section 16 status (public company) | A clear yes or no from the GC. Either answer is workable; "we're not sure" is not | ☐ | |
| 1.5 | Board / audit committee cadence | Written commitment to present at least quarterly, with you in the room, not your boss reading your slides | ☐ | |
| 1.6 | Executive staff attendance | Standing attendance at the weekly or biweekly e-staff, even as a non-direct-report. Quarterly board time plus e-staff exclusion starves you of context | ☐ | |
| 1.7 | Budget ownership | A security cost center that you own. "You'll partner closely with the CIO on investment priorities" is a no wearing a yes costume | ☐ | |
| 1.8 | Current-year budget number | An actual figure, from the hiring executive or CFO, not "we'll invest appropriately" | ☐ | |
| 1.9 | Headcount plan of record | Current approved headcount, open reqs with quarters attached, and next fiscal year's planning assumption, confirmed by email from a named executive | ☐ | |
| 1.10 | Scope boundaries | Written or clearly stated ownership: what you own (e.g., security engineering, GRC, IR) and what you do not (e.g., physical security, IT). Ambiguity here becomes blame later | ☐ | |
| 1.11 | Why the last CISO left | A specific, consistent answer, plus what changed about the role since. Three interviewers reciting "not the right fit" means the answer was coached | ☐ |
Post-Uber and post-SolarWinds, you are signing up to be the named human when things go wrong. This section prices that in. Nothing here costs the company money today, which is exactly why refusals are so diagnostic.
| # | Item | What good looks like | Status (W/V/U/R) | Notes |
|---|---|---|---|---|
| 2.1 | D&O: named insured confirmation | Written confirmation from the GC (not the recruiter, not HR) that your role falls within the policy's definition of insured persons. "Everyone's covered" without specifics means nobody checked | ☐ | |
| 2.2 | D&O: Side A coverage | Confirmed present. Side A pays you directly when the company cannot or will not indemnify you: insolvency, or the company deciding you are the problem | ☐ | |
| 2.3 | D&O: regulatory investigations covered | Policy summary shows regulatory inquiries covered, not only lawsuits. SEC inquiries are the live risk and some policies handle them badly | ☐ | |
| 2.4 | Indemnification agreement | A standalone, board-approved form indemnification agreement, the same one directors and officers sign. The offer letter is not this document and does not substitute for it | ☐ | |
| 2.5 | Fee advancement | Legal fees advanced "as incurred," mandatory, not contingent on a final determination. Indemnification without advancement means technically protected, practically bankrupt | ☐ | |
| 2.6 | Severance: without-cause terms | 12 months of base plus target bonus, pro-rated current-year bonus, COBRA for the severance period. Six months is the common opening; 12 is the defensible ask for the most-scapegoated seat in the C-suite | ☐ | |
| 2.7 | Good-reason triggers | Severance also pays if you resign after: material change in reporting line, material reduction in budget or scope, material reduction in base. This is the clause that defeats the bury-them-until-they-quit play | ☐ | |
| 2.8 | Change of control: double trigger | Acquisition plus termination or good-reason resignation within 12–18 months accelerates unvested equity. Exactly one CISO survives an acquisition; assume it will not be you and price accordingly | ☐ | |
| 2.9 | Mutual non-disparagement | Mutual, with no severance clawback over disputes about it. Post-incident exits get public | ☐ | |
| 2.10 | Severance document location | In the offer letter or a standalone agreement, not in a handbook the company can revise unilaterally | ☐ |
The money matters; it is just third on the list because you cannot price a role whose shape is unfixed. Score every component, not just the headline.
| # | Item | What good looks like | Status (W/V/U/R) | Notes |
|---|---|---|---|---|
| 3.1 | Base | Within market band for stage and scope (see the benchmarks table in the companion negotiation script). Price the scope, not the title | ☐ | |
| 3.2 | Bonus target | 25–50% of base by stage, against company performance plus individual MBOs | ☐ | |
| 3.3 | Bonus mechanics | MBOs you control: program maturity milestones, control coverage, audit outcomes, remediation SLAs. Not "zero material incidents," a metric you do not control | ☐ | |
| 3.4 | First-year bonus guarantee | Guaranteed at target for year one, standard for executives starting mid-cycle | ☐ | |
| 3.5 | Equity: type and size | Options at Series B–C (0.3%–0.8% fully diluted for a first security executive); options/RSU mix at pre-IPO; RSUs at public companies | ☐ | |
| 3.6 | Options: exercise window | Extended post-termination exercise window (not the default 90 days), plus early-exercise availability with an 83(b) election | ☐ | |
| 3.7 | Options: 409A and preference stack | You have seen the latest 409A and know how much money exits before common sees a dollar | ☐ | |
| 3.8 | RSUs: refresh policy | A stated executive refresh philosophy, ideally with what last cycle's refresh grants at your level looked like. No refresh answer means year-three comp is a coin flip | ☐ | |
| 3.9 | Vesting schedule | Standard four-year; no cliff longer than one year; double-trigger acceleration cross-referenced to 2.8 | ☐ | |
| 3.10 | Sign-on | Sized as a make-whole: forfeited unvested equity plus walked-away bonus, itemized. Companies pay make-wholes far more readily than they raise base | ☐ | |
| 3.11 | Sign-on clawback | Pro-rated, not full. 12-month full clawback is standard, 24-month is aggressive; pro-rated is the counter | ☐ | |
| 3.12 | Relocation | If applicable: covered costs itemized, tax gross-up included, no clawback past 12 months | ☐ |
Every V and U from the tables above lands here. For each, this is the exact wording to send, and to whom. Copy, paste, adjust names.
☐ Officer status and D&O (to the GC, in writing): "Will I be a duly appointed officer of the company, and can you confirm in writing that my role is within the definition of insured persons under the current D&O policy, including Side A coverage?"
☐ Regulatory coverage (to the GC): "Does the D&O policy cover regulatory investigations and inquiries, or only civil litigation? If a policy summary is shareable under NDA, I'd like to review that section."
☐ Indemnification agreement (to the GC or CHRO): "Does the company have a form indemnification agreement for officers, and will I receive it as part of my onboarding paperwork?"
☐ Plan of record (to the hiring executive): "Before I sign, I want us to agree on the year-one plan of record: current headcount, committed reqs by quarter, and the program budget planning assumption for next fiscal year. Can we close that this week?"
☐ Budget survivability (to the hiring executive, live): "Which of these commitments survives a 10% company-wide budget cut?" (Watch the face. Then get the surviving reqs in writing.)
☐ Refresh policy (to the hiring executive or CHRO): "What's the refresh policy for executives, and what did refresh grants at my level look like last cycle?"
☐ Board access (to the hiring executive): "Would the audit committee chair support a standing quarterly security session, and can I speak with them directly before I sign?"
☐ Predecessor (to two different interviewers, separately): "What will be different about this role compared to how it was scoped for my predecessor?" (Compare the answers. Divergence is the finding.)
☐ Escalation path (to the hiring executive): "When I need to tell the board something my manager disagrees with, what's the mechanism?"
☐ Back-channel (to yourself): Have I called a former holder of this seat, off the record? If not, I am negotiating blind. ☐ Done
Count honestly. An R or an immovable U on any starred item below counts as one flag. A V that the company resists converting to W after a direct ask also counts.
Starred (critical) items: 1.1, 1.2, 1.3, 1.5, 1.7, 1.9, 2.1, 2.4, 2.6, 2.7.
| Flag count | Reading | Action |
|---|---|---|
| 0–1 | Normal company. Every loop has friction somewhere | Proceed. Convert remaining V items to W via the confirming email before signature |
| 2–3 | The seat has construction problems, but they may be ignorance rather than design | Negotiate as a condition of signing. Name the items explicitly: "These are my conditions to sign, and I can sign this week if we close them." Watch what moves. Companies fix what they consider broken; what they defend, they built on purpose |
| 4+ | A constructed seat. The construction will outlast your tenure | Walk, or reprice dramatically with everything in writing and eyes open |
Automatic walk triggers, regardless of tally:
One flag that moves when pushed is a fixable gap. A flag met with deflection, delay, or annoyance is a decision the company already made. The market does not remember the offers you declined; it remembers the breach that happened on your watch in a seat built for exactly that purpose.
Final gate before signature: every starred item reads W. If it does not, the negotiation is not finished, whatever the calendar says.