The CISO Comp Negotiation Script

Ground rules before any script

The window. Everything here happens between the verbal offer and your signature. Before the verbal, you have no standing. After the signature, no leverage. A company that ran a four-month executive search will not rescind over a ten-day negotiation conducted professionally.

The channels. Use the recruiter for money and only money. Recruiters relay numbers that fit their form fields; they turn structural asks into "the candidate has some legal questions." For reporting line, plan of record, D&O, and severance, ask for a direct conversation with the hiring executive and run it yourself. The GC gets the protection items in writing.

The paper rule. Every agreement gets memorialized in a confirming email within 24 hours. Verbal executive promises have a half-life measured in weeks, and the executive who made them may not be there next year. The final template at the end of this document is where everything lands.

Part 1: The order (structure before money)

Run the negotiation in exactly this sequence:

1. Scope and reporting line (with the hiring executive)
2. Plan of record (same conversation or the next one)
3. Money, as one consolidated package, once (through the recruiter)
4. Paper: D&O, indemnification, severance (with the GC/CHRO)
5. The final confirming email (to the hiring executive)

Why this order and no other:

• You cannot price an unshaped role. A CEO-line CISO with a committed budget and a director-line CISO with "we'll figure it out" are different jobs. Fix the shape first or you are negotiating the price of an unknown.
• Structural asks build credibility; money asks spend it. Asking about board cadence and officer status reads as diligence. Asking for $40K more base reads as haggling. Lead with the one that makes them want you more.
• Serialized money asks exhaust goodwill. Base this week, equity next, sign-on after trains the company to expect one more ask forever. One package, one counter, one commitment to close.
• Paper goes last because it goes fastest. Once the company has mentally closed you, standard officer terms are a legal workflow, not a negotiation. Raised first, they can spook a company into slow-rolling everything else.

Part 2: The scripts

Conversation 1: Scope and reporting line (hiring executive, live)

Opening frame:

"Before we get to the package, I want to make sure we agree on the shape of the role: reporting line, board cadence, and the year-one plan of record. If we're aligned there, I don't expect the economics to be hard."

That last sentence buys enormous goodwill and is usually true. Then, the specific asks:

"The offer letter should name the reporting line as it is today. If a reorg is in flight, I'd rather we say so explicitly and put a floor under it: a written commitment that for year one I report to an executive officer."

If the line itself will not move (org design fights are hard to win from outside), pivot to board access, which costs the company nothing but a standing agenda item:

"Then here's what matters more to me than the box on the chart: a written commitment to present to the board or audit committee at least quarterly, with me in the room. Regulators and your auditors expect direct board engagement with the security program; I want that cadence committed up front so we're not inventing it during an incident."

And the cheap ask almost nobody makes:

"I'd also like standing attendance at e-staff, even as a non-direct-report. Quarterly board time without weekly executive context is how security leaders end up surprised."

Conversation 2: The plan of record (hiring executive)

"I want us to agree on the year-one plan of record before I sign: current approved headcount, open reqs with quarters attached, and the program budget planning assumption for next fiscal year. I've built my own view of what the program needs from the interview process; let's reconcile it with yours this week."

When they agree verbally but legal will not put numbers in the offer letter (legal never will, and that is fine), you say:

"Understood, it doesn't need to be in the letter. I'll send you a two-line email confirming what we agreed and you reply 'confirmed.' That's all I need."

That email will not win a lawsuit. It will win the budget meeting in month four, because it converts a vague promise into a specific commitment a named executive made.

Conversation 3: D&O and indemnification (raise live, close in writing)

Raise it with the hiring executive in one sentence, framed as hygiene:

"Last category, all standard officer terms: written D&O confirmation, the form indemnification agreement, and severance language. Happy to work directly with your counsel so this doesn't take your time."

Then send this email to the GC (copy the CHRO):

Subject: Officer status and indemnification, [Your Name] offer

[Name], ahead of signing I'd like to confirm three items that I'd expect to be routine:

1. That I will be a duly appointed officer of the company, and that my role falls within the definition of insured persons under the current D&O policy, including Side A coverage. If a policy summary is shareable under NDA, I'd appreciate a look at whether regulatory inquiries are covered as well as civil litigation.
2. That I will receive the company's form indemnification agreement for officers, board-approved, with fees advanced as incurred.
3. Whether I will be designated a Section 16 officer. [Public companies only.]

A one-line confirmation on each is all I need. Glad to get on a call if easier.

A competent GC answers in one email. Evasion here is not a negotiation problem; it is a diligence result.

Conversation 4: The money (recruiter)

One consolidated counter, delivered once, with a close attached:

"Here's where I need the package to land, and if we get there I'm ready to sign this week. Base at [X]. Sign-on of [Y], and that's not a round number: it's [forfeited unvested equity] plus [walked-away bonus], itemized here. Initial grant at [Z], and I'd like the refresh philosophy for executives stated in the process, because I'm pricing year three, not year one. Bonus at [N]% guaranteed at target for year one since I'm starting mid-cycle, with MBOs tied to program milestones rather than incident counts."

The make-whole framing matters: companies pay reimbursements far more readily than raises. The commitment to close matters more: it is what separates a negotiation from a fishing expedition.

Conversation 5: Severance (hiring executive or GC)

"One more standard officer item, and it's the one shaped by this seat in particular: security executives carry dismissal risk tied to events outside their control, so severance here is actuarial, not pessimistic. The ask is twelve months of base plus target bonus on termination without cause, good-reason resignation triggers covering a material change in reporting line, budget, scope, or base, and double-trigger acceleration on change of control, which I'd expect every other officer already has. Send me your standard executive agreement and I'll work from that."

Severance is often the easiest structural term to win: it costs nothing today, and the approver does not expect to be there when it pays out. If you are getting resistance everywhere else, push here.

The final confirming email (to the hiring executive, before signing)

Subject: Confirming our agreement, [Your Name]

[Name], ahead of signature, confirming what we've agreed beyond the offer letter itself:

• Reporting line: I report to [title], with a written year-one floor of an executive-officer line.
• Board cadence: I present to the [board / audit committee] at least quarterly, in person, beginning [quarter]. Standing e-staff attendance.
• Plan of record: Security enters [FY] planning with [N] FTE and [$X] program budget, subject to normal planning process, with [N] committed reqs in [quarters].
• Officer terms: Appointed officer status, D&O insured-person confirmation with Side A, form indemnification agreement with fee advancement, per [GC name]'s email of [date].
• Severance: Twelve months base plus target bonus without cause, good-reason triggers as discussed, double-trigger change-of-control acceleration.
• Economics: Base [$X], bonus [N]% guaranteed at target year one, initial grant [Z], sign-on [$Y] with pro-rated clawback.

If that matches your understanding, a quick "confirmed" is all I need, and I'll sign today.

Nothing in this email is aggressive. Everything in it is now a specific commitment a named executive affirmed in writing.

Part 3: The six pushbacks

1. "The comp committee already approved this band."

"Understood, and I'm not asking you to reopen the band today. Two of my asks don't touch it at all: the plan of record and the officer paperwork cost nothing against the band. On the cash, the sign-on is a make-whole, not a raise: here's the itemization of what I'm forfeiting. Most committees treat make-wholes as a separate line."

2. "We need an answer by Friday."

"I can give you a yes by Friday if the three open items close by Thursday: the GC's confirmation, the plan-of-record email, and the severance language. The timeline is in your hands, and I mean that literally: the fastest path to my signature is those three emails."

Deadline pressure converted into their to-do list.

3. "We'll revisit the reporting line after you start."

"In every case I know of, 'revisit after you start' resolves in favor of the org chart as it stands, and I'd be negotiating from inside with no leverage. If the line genuinely can't change now, let's do what can: a written year-one commitment on board cadence and e-staff attendance, and a good-reason severance trigger if the reporting line materially changes. That way neither of us needs to rely on revisiting anything."

4. "Our D&O policy covers all employees."

"That phrasing is usually where the problem hides: policies define 'insured persons,' and a CISO who isn't a duly appointed officer can sit outside that definition while carrying the title's exposure. I'm not asking for new coverage, just written confirmation from [GC name] that my role is inside the existing definition, with Side A. If the answer is yes, that's one email."

5. "Why are you planning your exit before you start?" (severance hostility)

"For the same reason the company buys D&O before there's a lawsuit. Security executives get terminated over incidents they inherited, flagged, and documented; that's a property of the seat, not a plan of mine. Pricing that risk up front is what you're hiring me to do with every other risk the company holds. The right response to this ask is a redline, and I'll take any reasonable one."

6. "We don't want to over-formalize; there's a lot of trust here."

"Trust is exactly what written commitments create: neither of us has to remember anything, and the people who inherit this deal on both sides inherit the same facts. Everything I've asked to confirm is something we've already agreed. If writing it down changes it, then we haven't agreed yet, and better to know that now."

If a promise cannot survive being written down, it was never a promise. That is a diligence result, and it goes in your red-flag tally (see the companion Offer Evaluation Checklist).

Part 4: Benchmarks by company stage

Typical mid-2026 US market ranges observed in live searches and peer conversations, not survey data. Variance is wide: geography, industry (financial services and healthcare pay up), and rebuild-versus-maintain scope all move numbers materially. Price the scope, not the title: a public mid-cap CISO with a 12-person team can earn less than a pre-IPO CISO owning security, IT, and compliance with 60 heads.

The tails are long in both directions: deputy-CISO-titled-up seats at $300K all-in exist, and so do $2M financial-services packages. One inversion worth naming: a post-incident, under-resourced, high-scrutiny seat should price above these ranges, the way distressed-company CFO roles do. If the risk premium is missing, that is the company telling you how it values the function.

Run the finished offer through the companion Offer Evaluation Checklist before you sign. The negotiation is done when every critical item reads "confirmed in writing," not when the recruiter says congratulations.