CISO First 90 Days: A 30-60-90 Day Plan
A CISO 90 day plan: what to do first, what to deliver by day 90, how to brief the board, and the mistakes that sink new security leaders.
Loading...
A CISO 90 day plan: what to do first, what to deliver by day 90, how to brief the board, and the mistakes that sink new security leaders.
What AI-driven security solutions really do: alert triage, behavior-based detection, risk ranking and automated response, and how to test the AI claims.
The first thing a new CISO should do is learn the business. If I started a CISO role tomorrow, I'd spend most of the first month with every business unit leader and every person who reports to me, and only then test which inherited controls really work and write a short risk register. By day 90 I'd want to walk into the board with a risk assessment in business terms, a vendor inventory with contract dates, a roadmap tied to specific risks and a plan for my people.
Browse the Full Cybersecurity Market. Every Category.
Every category on CybersecTools, from AI Security and Cloud Security to Threat Intelligence and Offensive Security. Filter by use case, industry, or company size.
The first 90 days as a CISO are not an orientation period, they are an audition. Your board, your peers in the C-suite and your own people are all forming opinions about whether you understand the business, whether you can be trusted with budget, and whether you'll make their lives harder or easier. Most new CISOs who fail it know enough about security, but they treat the 90 days as a discovery exercise while everyone around them is judging how they lead.
The instinct to listen and learn before acting is correct. But listening without a framework gets you a pile of observations and no decisions, so you need a way to absorb context quickly, find the two or three things that could actually hurt the business in the next 12 months, and start building the relationships that decide whether your program gets funded. The clock starts on day one, whether you're ready or not. The mistakes below derail experienced leaders as often as first-timers, so if you've done the job before, the goal is to spot them faster this time.
| Phase | Focus | What you finish with |
|---|---|---|
| Days 1 to 30 | Learn the business and meet your people | Your top business dependencies, every one-on-one done |
| Days 31 to 60 | Test the inherited program, build the risk register, start the vendor audit | 10 to 15 ranked risks, a full product and contract list |
| Days 61 to 90 | Brief the board, plan the roadmap and the team | Four deliverables: risk assessment, vendor inventory, 12-month roadmap, team plan |
In practice the phases overlap. One-on-ones start in week one, the risk register is due by day 45 and the vendor audit runs until day 60, so I'd read the table as an order of priorities and not as a calendar.
Your first month is about the business, because before you can make one good security decision you need to know what the company actually does, where it makes money and what would make it stop. That last question is your threat model.
So in your first two weeks, book 30-minute conversations with every business unit leader, and don't use them to talk about security. Ask what keeps them up at night, what they depend on to operate and what a bad day looks like for their people. You will learn more about your actual risk surface in those conversations than from any vulnerability scan.
The questions that matter most in week one:
The people you inherit are your most important asset and your most immediate constraint, so hold a one-on-one with every person who reports to you in the first 30 days. Keep it away from performance. Ask what they work on, what frustrates them and what they would change if they could, and you will learn how the work really gets done faster than any org chart can show you.
Every new CISO inherits a program that looks better on paper than in practice, and the gap between documented controls and working controls is where your real risk lives. Your job is to measure that gap honestly without spending political capital on announcing that everything is broken.
Run a quiet assessment across five areas: asset visibility, identity and access management, detection and response, third-party risk and compliance. What you're after is the controls that exist only on paper, the products that were deployed but never tuned, and the processes that depend on one person who could leave tomorrow.
The most dangerous finding is usually a control everyone believes works but doesn't. Think of the quarterly access review that produces a spreadsheet nobody acts on, or the SIEM that raises 10,000 alerts a day and gets 20 minutes from one analyst. These ceremonial controls give auditors comfort and leave you exposed at the same time.
You probably arrive with a roadmap in your head, because you have done this before and you want to start building. Hold it back. A roadmap built before you understand this company's risks will fund the wrong things and miss the right ones.
Your risk register doesn't need 200 rows. It needs the 10 to 15 risks that could cause material harm, with enough context to rank them. For each risk, record four things:
That register becomes your budget case, your board briefing and the order of your roadmap. Build it by day 45 and update it every quarter, so that when the board asks why you fund something, the answer traces back to a specific risk with a specific business impact. "Because it is best practice" does not survive a budget cut.
A company of 500 to 5,000 employees can easily run dozens of security products. Many overlap, some are shelfware, and a few are critical without anyone having written down why.
Within your first 60 days, map every product to the risk it is meant to address and the person who owns it. You will end up with three groups:
Groups two and three are where your consolidation budget comes from. A vendor's TCO calculator usually leaves out integration work, training and the analyst hours spent running the product, so your audit should count all of it.
Don't make consolidation decisions in the first 90 days, though. Make the list, learn the contracts and renewal dates, and pick up the quick wins where you can drop a product and lose nothing. The rest goes into your 12-month roadmap with savings targets, because boards respond well to a CISO who brings a plan to cut spend while keeping or improving protection. For the full method, read my guide on vendor consolidation.
Compliance belongs in the plan, but it shouldn't run it. In the first 30 days, list every framework and regulation that applies and which ones carry real penalties. In days 31 to 60, map each obligation onto your risk register as a constraint, and by day 90 your roadmap should show which risks the compliance work also covers.
A compliance framework sets the minimum. A program built only to pass the next audit will pass it, and it will still leave you open to every risk the audit doesn't check.
Compare Cybersecurity solutions side by side
Features, integrations, NIST coverage and deployment for every Cybersecurity solution we list, in one table.
You will likely present to the board or audit committee within your first 90 days, and that briefing shapes how the board sees you and your program for the next two to three years. The common mistake is to present a technical review of the program when the board wants a business risk review.
The board doesn't want your CVSS score spread or your mean time to detect. They want three answers: which risks could seriously harm the business, what you are doing about them, and what more you need from them.
A briefing structure that works:
Keep it to 10 slides and leave time for questions, because the questions are where you build trust. For what to measure after the first briefing, see the security metrics your board cares about.
Use the rule of thirds to check the shape of what you inherited. Roughly a third should be operations specialists who run daily controls, a third should be risk and advisory people who can explain security in business terms, and a third should be project people who build and change things. Most inherited teams are heavy on operations and light on the other two, which is why so many security programs struggle to show their value and struggle to change.
Find your flight risks early. Look for the person passed over for promotion twice and the specialist doing work three levels below their skill. Also look for the analyst who has run the same manual process for two years while asking for automation budget that never comes. These people leave the moment a recruiter calls, usually at the worst time, so address their situation in the first 60 days even if you can't fully solve it.
The most common mistake is announcing a transformation before you have earned the trust to lead one. A "new direction" speech in week two tells your people you judged their work before you understood it. Even if the program needs big changes, the first 30 days are for listening.
The second mistake is letting compliance drive the roadmap. Drive it by business risk and map compliance in as a constraint. Other patterns that cause trouble:
At day 90 you should be able to hand over four deliverables:
Each one feeds the next. The risk assessment drives the roadmap and the roadmap drives the budget request, while the team assessment drives hiring and the vendor inventory drives consolidation.
Present all four to your CEO and board at day 90. That shows you understand the business, have a plan and can be trusted with more, which is what the audition was about in the first place.
Check a vendor before you sign
Mandos tracks funding, acquisitions, hiring and news for security companies. Look up any vendor on your shortlist before the renewal.
The first 90 days as a CISO are a compressed version of the whole job. You assess risk, manage relationships, spend limited attention and decide on partial information. The leaders who do well aren't the ones who know the most about security. They treat security as a business function, and their job as reducing business risk in a way the company can sustain and fund.
So get the four deliverables done, build the relationships that matter and resist the pressure to act before you understand. The program you build in month four will be far better than the one you would have built in week two.
Meet the business before you touch the security program. Book 30-minute meetings with every business unit leader in your first two weeks and ask what they depend on and what a bad day looks like. Those answers become your threat model.
Three phases and four deliverables. Days 1 to 30 are for learning the business and your people, days 31 to 60 for testing controls, building a risk register and auditing vendors, and days 61 to 90 for the board briefing and the roadmap. You finish with a risk assessment, a vendor inventory, a 12-month roadmap and a team plan.
Be open about where you are. Boards respect a new CISO who says, "I am 45 days in. Here is what I know, what I am still learning, and when the full assessment lands," far more than false confidence. Call it a first risk briefing rather than a final program review, and commit to a date for the full assessment.
Present the gap as a business risk instead of a criticism of your predecessor. "We have an identity control gap that exposes us to credential-based attacks" is a risk statement, while "The previous CISO did not roll out MFA" is a blame statement. The first gets you budget and the second gets you politics, so focus on what needs to happen and what it costs.
Build it in three tiers. Tier one is what you can do with current resources, tier two is what you can do with a 15 to 20% budget increase, and tier three needs a large new investment. That gives leadership options instead of one number to approve or reject, and it shows you understand budget limits.
Take the meetings, but use them to learn the market rather than to buy. You will hear which problems vendors think you have, which feeds your vendor audit. Tell every vendor the same thing: you are assessing for 60 days and won't buy before the review is done. That sets expectations and lowers the pressure.
Resistance usually has one of two causes. Either they have seen new leaders arrive, disrupt things and leave, or they feel their work is being dismissed before anyone understands it. Ask them to walk you through their most important work and say out loud what is working, because change meets less resistance when it comes from a leader who did the homework.
Separate urgent from important. Most things that feel urgent in the first 90 days are important but can wait, and the exceptions are active incidents, compliance deadlines with real penalties, and controls that are missing entirely in a high-risk area. Everything else waits for your assessment, because if you react to every urgent request you show that whoever shouts loudest can manage you.
Mostly, yes. The phases, the business meetings and the four deliverables carry over. A CIO's risk register will cover more than security, such as delivery, cost and uptime, and the vendor audit will be larger, but the board briefing still needs risks in business terms.
I wrote this guide from my own work leading security programs. Product and category links point to the CybersecTools catalog of 9,168 security products. Read the methodology for how we review products.