Choosing an IT director

The first three questions are not for the candidate. A recruiter or headhunter should put them to the board in a single meeting, all together.

Expected outcomes after 18 months

What should change within 18 months, and how will we know?

A brief often says "get IT in order". That is not a goal.

For its 2026 CIO agenda, Gartner surveyed more than 2,500 CIOs. More than 57% of them have to increase productivity, and 52% have to reduce costs. The percentages refer to the CIOs surveyed, not to companies, and Gartner's page does not explain whether they were calculated for the whole sample. These are two different jobs. Imagine the board of a mid-sized manufacturing company that wants to cut IT costs and launch online sales at the same time (hypothetical example). Every candidate will hear this differently, and every one of them will say they can do it.

The Kore1 guide identifies missing success measures as a common mistake when hiring a CIO. Agree no more than three outcomes with the board and when to assess them. If an outcome cannot yet be quantified, define an observable acceptance criterion, such as agreed accountability or a working process.

Decision-making independence

Which decisions will the IT director take alone, and which will need approval?

This concerns the budget, the choice of suppliers, a right of veto over systems that business departments buy on their own, and who the director actually reports to.

A good candidate will ask about this unprompted. If the board cannot define the scope of independent decisions, the candidate will notice. The answer "of course, they have full freedom", without saying up to what amount they can decide on their own, means nothing.

Responsibility for security

Who on the board is responsible for cybersecurity, and what does the KSC amendment change?

The amendment to the Act on the National Cybersecurity System (KSC), implementing the NIS2 Directive, came into force on 3 April 2026. According to gov.pl, key and important entities could apply for entry in the register until 3 October 2026, and must implement the new obligations by 3 April 2027 if they met the criteria on the day the act came into force.

The head of the entity is responsible; if a multi-member body leads it and no responsible person has been designated, its members are. Assigning the duties to someone else does not release the head (Articles 8c–8d). The fine under Article 73a can reach 300% of remuneration, calculated as a cash payment in lieu of annual leave; the provision does not specify the period. For public entities the limit is generally 100%, unless the entity is also a key or important entity in another sector listed in the annexes. Article 35 penalties cannot be imposed until two years have passed; according to ksc.expert, this includes the penalty under Article 73a.

A new IT director hired now (as of 7 October 2026) will start work in the middle of this timetable. Establish whether the company is subject to the new rules (this depends on sector and size) and whether anyone on the board treats them as their own responsibility. The answer "that is a task for the new director" means the problem lies with the board.

Ask them to all candidates, in the same order. That way you compare answers, not impressions from the interview.

Stopping a misguided initiative

Tell me about a technology initiative you managed to stop, even though the board wanted to continue it.

This is a variant of a question from the Kore1 guide. It tests whether the candidate can say "no" to superiors and whether they can explain and support their objection.

A useful answer explains the type of system, cost scale, participants’ roles and the outcome of the decision. Names can be anonymised and confidential amounts expressed as a range where disclosure is permitted. A general statement about “making difficult decisions in the organisation’s interests” needs a specific example.

Decisions with a smaller budget

The IT budget has fallen by 20%. What do you cut first, and what do you leave alone?

Also from the Kore1 guide. There is no good general answer here, only better and worse justifications. Listen for whether the candidate treats IT as a cost to be reduced or as a capability that has to be protected. Since, according to Gartner, 52% of CIOs have to cut costs, the question is not academic.

"I will fight to keep the budget" is a suspect answer. It is a convenient one in an interview, but in practice someone will make the decision anyway.

Responding to an incident

Tell me about a real security incident: who knew what, and at what time?

Ask for a specific incident, not for an "approach to cybersecurity". Article 11 of the KSC Act distinguishes an early warning of a significant incident, due without undue delay and no later than 24 hours after detection, from the incident notification, generally due within 72 hours. Trust service providers have a shorter, 24-hour notification deadline (KSC amendment, Journal of Laws 2026, item 252; also described by KPMG). The timeline therefore matters in practice.

Someone who really led an incident remembers the sequence of events, knows whom they informed and what they told the board, and can say what was changed afterwards. A hypothetical answer ("if that happened, I would do this") suggests that there was no incident or that the candidate did not lead it. It is worth asking for references about precisely this event.

Making the investment case

Explain in three sentences why the company should pay for the modernisation of system X.

System X is a real case from your company or industry, ideally one the board has actually considered. The condition: no abbreviations or acronyms and no names of technologies.

Almost half of the CIOs in the Foundry survey (46%) see themselves as business leaders. Here you can test that with a single task. If the candidate begins with risk, costs and the impact on revenue, they are speaking the language of the board. If they begin with architecture, they are speaking the language of the team. Do not judge how elegant the answer is, only whether, after three sentences, a board member could make a decision.

Team development and departures

Who in your team was promoted, and who left? Why?

In Foundry's State of the CIO 2025 report, 54% of respondents named staff and skills shortages (especially in AI, cybersecurity and data science) as a major challenge. In the Nash Squared Digital Leadership Report 2025, AI skills moved to first place on the list of shortages, up from sixth place a year earlier. In such an environment, the ability to build and keep a team is as important an argument as knowledge of technology.

Look for a specific example: who took on more responsibility, how succession was prepared and what the candidate learned when someone left. Roles are sufficient at this stage; names are not required. Arrange any reference conversation with a former team member with the consent of the candidate and that person.

Acting on difficult feedback

What difficult feedback have you received in the last two years, and what changed in your work as a result?

The question targets the two most common causes of failure according to Leadership IQ: coachability and emotional intelligence. Together they account for 49% of the failed hires in that study.

Look for specifics and a change in behaviour. "I was told I am too committed" is self-promotion. "I do not recall such a situation" may mean that the candidate does not listen, or that no one dares to tell them anything.

An investment that fell short

Which investment in AI or another technology did not deliver the expected outcome, and how did you know?

In Gartner's survey of 2,501 CIOs and technology executives, conducted in May and June 2025, 64% of respondents planned to deploy agentic AI within the following 24 months. Agentic AI means systems that can carry out successive steps of a task and use tools within their granted permissions. Nash Squared reports in its 2025 report that one in three organisations sees a clear return on investment in AI. The two figures come from different studies and different populations and should not be set against each other. They do show why the question about measured results is worth asking.

If the candidate has not led an AI deployment, ask about another investment evaluated by its outcome, such as ERP, automation or an infrastructure change. Examine the decision criteria and measurement method. The absence of a previous AI project does not by itself determine their ability to lead IT.

Put questions 1 to 3 to the board before the search starts, and write down the answers. Send them back for confirmation by email, because "agreed at the meeting" can mean something different to each participant two months later.

Put questions 4 to 10 to each candidate in the same order. Record their decision authority, the team’s role, the outcome and the limits of the evidence. Ask about scope, measurement and accountability where information is missing, while respecting confidentiality.

This does not replace reference calls. After such an interview, however, you know what to ask the referees about.

Sources

• Foundry / CIO.com, State of the CIO 2026 (662 heads of IT, 249 business representatives).
• Foundry / CIO.com, State of the CIO 2025 (more than 900 heads of IT and 250 business representatives).
• Gartner, The CIO and Technology Executive Agenda for 2026 (more than 2,500 CIOs).
• Gartner, press release of 21 October 2025 (64% of respondents planning agentic AI within 24 months; 2,501 CIOs and technology executives, survey conducted May–June 2025).
• Nash Squared, Digital Leadership Report 2025.
• This Week Health, CIO tenures plummet (report on the Nash Squared Digital Leadership Report 2024).
• Leadership IQ, Why New Hires Fail.
• Kore1, Hire a CIO guide.
• Gov.pl, Amendment to the Act on the National Cybersecurity System comes into force (Polish original: Nowelizacja ustawy o krajowym systemie cyberbezpieczeństwa zaczyna obowiązywać).
• Amendment to the Act on the National Cybersecurity System, Journal of Laws 2026, item 252 (Act of 23 January 2026; Articles 8c–8d, 11, 33, 35, 73a).
• Infor.pl, NIS2 comes to Poland (Polish original: NIS2 wchodzi do Polski; obligation of management bodies to approve measures).
• KPMG Poland, The NIS 2 Directive and the new KSC Act (Polish original: Dyrektywa NIS 2 i nowa ustawa o KSC; 24/72-hour reporting regime).

Start with tenure. The Nash Squared Digital Leadership Report 2024, as reported by This Week Health, shows that more than 70% of CIOs have held their post for less than five years, and almost 40% for two years or less. I did not find Polish data on the tenure of IT directors in publicly available sources, so treat this as a reference point from the international market, not as a national statistic.

Then consider why hires fail. In 2011, Mark Murphy of Leadership IQ collected the opinions of 5,247 managers from 312 organisations about more than 20,000 new hires. Within 18 months, 46% of them were judged to be failed hires. According to the authors, in 89% of those cases the cause was attitude, and in 11% technical shortcomings. The most frequently cited were low coachability (reluctance or inability to accept feedback and learn from others, 26%) and low emotional intelligence (23%), followed by low motivation (17%) and temperament (15%).

A caveat: this study covers employees in general, not IT leaders, and the authors themselves defined "failed hire". The direction is worth noting, though: in these managers' assessments, the most frequent causes of failed hires were attitudes, and a CV does not show them.