Template kit
Leader Change Kit
Security Change Brief and Leader Cascade Worksheet
Join to save this for later.
Join to tell us if this was useful.
Security changes rarely fail in the policy. They fail in the hand-offs. A change starts out clear, then shifts a little each time one leader passes it to the next. By the time it reaches the people doing the work, it's a different message, and nobody has explained what it means for their job.
This free two-page kit fixes both problems. The Security Change Brief holds the facts in one place. The Leader Cascade Worksheet helps each leader turn those facts into what the change means for their team.
What's inside
1 page
Security Change Brief
Written once by the brief owner and kept in Trygg as the single source of truth. It covers what is changing, why now, who it affects, what is not changing, key dates and where questions go. Four cascade rules keep the message intact: link, don't retell; quote the version; send questions back; and only the owner edits.
1 page
Leader Cascade Worksheet
Each leader completes this with their team. It turns the change into everyday tasks ("where we meet this, what we do today, what we do from now on"), walks the team through the ADKAR® model in order with proof to check at each step, captures questions to send back to the brief owner, and sets a 30-day check.
How to use it
- The brief owner completes the brief, gets the sponsor's approval and publishes it in Trygg with a version number.
- Each leader receives the link and a worksheet.
- Leaders complete the worksheet with their team, ideally in a regular team meeting.
- Questions go back to the brief owner. Answers are added to the brief as a new version, so everyone sees the same answer.
- At 30 days, each leader completes the check and files the worksheet as ISMS evidence.
Why it works
People want to hear why a change matters from senior leaders, and what it means for them from their own manager (Prosci research on preferred senders). This kit splits the work the same way: the brief owns the facts, and each leader owns the relevance.
ISO/IEC 27001:2022 alignment
Leadership (Clause 5.1), planning of changes (6.3), awareness (7.3), communication (7.4), documented information and version control (7.5), management responsibilities (Annex A 5.4), and awareness, education and training (Annex A 6.3).
- 5.1 Leadership
- 6.3 Planning of changes
- 7.3 Awareness
- 7.4 Communication
- 7.5 Documented information
- A.5.4 Management responsibilities
- A.6.3 Information security awareness, education and training
ADKAR® is a registered trademark of Prosci, Inc. Trygg is not affiliated with Prosci.