What should a security leader test before accepting a CISO job in India?

Ask how risk exceptions are approved, how product or operational leaders document acceptance and when unresolved exposure reaches the executive committee. The answer should distinguish the CISO’s advisory, control and assurance responsibilities from the owner who chooses the business consequence. Treat that distinction as the first gate. Keep contrary evidence with its source. Do not let interview momentum settle it.

Map five recurring security decisions to accountable executives and escalation forums. Use the map to test whether ownership survives a conflict involving revenue, delivery speed, operational continuity or a powerful sponsor. A policy naming risk owners is not enough when exceptions occur informally or expire without review.

A CISO can be named the owner of cyber risk even though product leaders, business executives, the CIO and the board make the choices that create or accept it. The contradiction converts an enterprise risk into a specialist's personal liability. Ask who approves risk appetite, who may accept exceptions and which leaders own remediation when controls compete with revenue, delivery or cost. Review the risk committee charter, exception register and one recent case in which a material weakness required business action. Compare the CISO's current account with those of the CIO and accountable business executive. The consequence is whether the incoming leader can govern risk through distributed ownership or becomes the endpoint for issues others may defer. Stop if cyber accountability is assigned to the CISO alone, if risk acceptance has no business signatory, or if executives expect the role to provide assurance while withholding the decision forums and remediation authority needed to make that assurance defensible.

Explore direct access to the board or risk committee, private escalation channels and who evaluates the CISO when security challenges technology leadership. Ask how prior material disagreements were documented and whether the CISO can request independent assurance. Turn the gap into an authority question. Ask for one contested decision. Record who resolved it and how.

Define a reporting-line safeguard set: standing committee access, protected issue escalation, explicit non-retaliation and a route to external expertise where necessary. Test each safeguard against a realistic conflict, not a harmonious normal period. A senior title or dotted line does not establish independence if agenda access, information rights or performance consequences remain controlled by the challenged function.

A reporting line can appear independent on an organisation chart while access, budget, performance review and escalation remain controlled by the function whose decisions the CISO must challenge. The contradiction is formal separation without practical protection. Trace a recent disagreement about control, product release or remediation timing. Identify who received the evidence, who set the final position, what reached the board and whether the CISO could preserve dissent. Request the audit or risk committee charter, private-session arrangements and escalation policy. The executive consequence includes professional independence during ordinary operations, not only after an incident. Direct access to a chair is useful only when the route is recognised institutionally and cannot be withdrawn through personal conflict. Stop if board contact is discretionary, if the CIO or another executive can suppress material reporting, or if the candidate's performance and resources depend entirely on a stakeholder whose risk decisions the role is expected to review independently.

Ask who can isolate systems, stop a digital service, engage specialist support and convene legal, communications and business leaders. Distinguish technical incident command from enterprise consequence decisions and regulatory assessment. Test the commitment under visible pressure. Record who accepts the cost. Name who can reverse the choice.

Walk through a tabletop decision sequence using roles rather than a speculative breach scenario. Note where approval paths collide, where evidence thresholds are undefined and whether the CISO can preserve facts while commercial teams manage continuity. Candidate conversations cannot reveal the actual control condition; they can establish whether governance roles and escalation architecture are coherent.

Incident plans often make the CISO operationally central but leave authority over shutdowns, disclosure, customer communication and regulator engagement unclear until a crisis. The contradiction creates accountability after the fact without decision rights when time matters. Run a tabletop around a plausible severe event and ask each executive to state who may isolate systems, suspend a service, notify authorities, preserve evidence and accept continuing exposure. Review the incident-response plan, delegation schedule and findings from the latest exercise. The consequence for the CISO is whether technical judgement can influence enterprise action before commercial or reputational pressure narrows the options. A polished playbook is insufficient if named leaders describe different command structures. Stop if decisive powers are deliberately left informal, if legal and business escalation cannot be reconciled, or if the candidate would be publicly accountable for response quality while lacking an authorised route to require action or record a contrary risk position.

Review how security work competes with product, infrastructure and operational demand. Ask whether budgets are tied to risk scenarios, control obligations or historical allocations, and who decides when accepted risk exceeds appetite. Price the uncertainty before it compounds. Separate verified conditions from working assumptions. Give each gap an accountable source.

Create a resource-governance test that links a material risk, the proposed intervention, the owner declining it and the forum recording the residual position. The purpose is accountability, not an assumption that every request should be funded. Budget size alone cannot establish mandate quality; disciplined prioritisation and documented acceptance may matter more than an unexamined spending promise.

Security leaders are frequently asked to reduce material exposure while remediation budgets, product priorities and scarce engineering capacity remain controlled elsewhere. The contradiction is a risk mandate without a resource compact. Select the highest current risk theme and trace its treatment from assessment to funded action. Request the risk register, remediation ageing, budget decisions and ownership of embedded security capability in products and operations. Ask who can defer work, what evidence supports that choice and how residual risk is reported. The executive consequence is whether the CISO can create sustained reduction or spends the tenure escalating a known backlog. Resource adequacy does not mean every request is approved, but trade-offs must have accountable owners and thresholds. Stop if material risks can age without explicit acceptance, if the CISO is measured on outcomes that other functions may decline to fund, or if sponsors treat influence as a substitute for a documented mechanism that moves people and capital toward agreed priorities.

Warnings include pressure to minimise known uncertainty, unclear legal partnership, incident roles that change by stakeholder and a performance scorecard dominated by absence of incidents. These conditions reward reassurance rather than defensible risk governance. Write the threshold before final-stage momentum. Reopen only on authorised evidence. Keep reassurance outside the proof record.

Agree non-negotiable conditions for escalation, evidence preservation, board communication and risk acceptance. Withdraw if sponsors frame those conditions as disloyalty or refuse to test them against a difficult example. The stop decision concerns governance design and professional accountability; it does not allege a breach, control failure or regulatory violation.

A CISO process should end when the organisation wants the reputational benefit of a senior security appointment without accepting enterprise ownership of cyber decisions. Maintain a chronology of claims about independence, incident authority, board access, budget and risk acceptance. Seek the current governance documents and a narrated precedent for each material right. The executive consequence of accepting unresolved ambiguity appears in the first control exception or incident, when stakeholders may expect certainty from a role that was never permitted to create it. Compensation and reporting proximity cannot repair that structure. Stop if governance questions cause the mandate to narrow, if access to risk or audit leadership is postponed until after joining, if incidents have no coherent command authority, or if known remediation depends on voluntary support from teams that retain the right to refuse while the CISO carries the enterprise accountability.