Introduction
A new CISO's first 90 days are a structured chance to learn the business, earn trust, find the risks that matter, and set a direction people can execute. Racing to replace every tool or policy on day one usually backfires.
The pressure is real. You inherit systems and a team you didn't build, with incomplete visibility and executives who each want something different. CISO tenure averages about four years in Heidrick's 2024 survey, so the early window matters.
This roadmap covers three phases. Each should produce tangible outputs, named owners, measurable priorities, and a reporting cadence that survives changing business conditions.
Key Takeaways
- Listen, map stakeholders, and build an evidence-based baseline in days 1-30 before changing anything major.
- Assess risk, resilience, compliance duties, people, technology, and constraints across days 31-60.
- By day 90, lock priorities, land a few quick wins, set decision rights, and brief the board.
- Keep the plan flexible so it can bend to incidents, acquisitions, and regulatory change.
Days 1-30: Learn Before You Change
Establish the mandate and definition of success
Start with the people who explain why the role exists. Meet the CEO, COO, CIO or CTO, general counsel, finance leader, risk owners, audit committee representatives, and key business-unit heads. Ask what prompted the hire and what outcomes they expect.
Then document the business itself:
- Business model, critical services, and revenue dependencies
- Sensitive data and regulatory exposure
- Major transformation programs
- Tolerance for operational disruption
Turn what you hear into a short success statement. It should separate the CISO's responsibilities from those of IT, legal, compliance, privacy, internal audit, and business leaders. A one-page brief covering context, 30-to-90-day outcomes, decision rights, stakeholders, constraints, and success measures keeps this honest.
Build a stakeholder map and listen
Run structured listening sessions with the security team and the business. Ask what works, where decisions stall, which risks keep coming up, and which earlier initiatives lost support. Include engineering, HR, procurement, privacy, finance, communications, and customer-facing teams so you see how work actually happens.
Write down recurring concerns, conflicting assumptions, undocumented dependencies, and places where policy and practice diverge. Pre-booking this listening tour in week one saves weeks later.
Understand the inherited team
Review reporting lines, open roles, outsourced services, skills, workload, and morale. Find out whether the role is new or inherited, why a predecessor left, and which commitments are already made.
Don't judge the team by its tools or documentation. Ask whether authority, staffing, and escalation paths let it execute. IANS's new-CISO checklist points the same direction: responsibilities, staff, resources, and inherited findings come first.
Run a rapid baseline review
Collect what already exists:
- Risk assessments, audit findings, and incident reviews
- Policies, architecture diagrams, and asset and third-party inventories
- Business-impact analyses, recovery plans, security metrics, and board materials
Then ask pointed questions about crown-jewel assets, privileged access, cloud environments, critical vendors, detection and response, and recovery. Separate verified facts, management assertions, open questions, and assumptions. An incident response plan that exists "on paper" is not a capability.
Define your 30-day outputs
Produce:
- A concise stakeholder map
- A current-state hypothesis
- A list of urgent risks needing validation
- An inventory of key documents
- A schedule for deeper reviews in days 31-60
Set an interim escalation path for critical incidents now, but don't redesign governance before you have evidence. Some changes are safe immediately: shrinking admin access, locking remote access, confirming backups restore. Everything else waits for the fuller assessment.
Days 31-60: Establish the Risk and Operating Baseline
Define risk appetite and tie it to business consequences
Work with executives, board representatives, legal, finance, and risk owners to clarify which risks the organization will accept, mitigate, transfer, or avoid. A one-page appetite statement works well: what to protect first, which impacts are unacceptable, and what calculated risk supports growth goals.
Map critical services to plausible impacts: customer harm, disruption, regulatory exposure, financial loss, safety, or reputational damage. Then build a shared vocabulary for likelihood, impact, urgency, ownership, treatment, and residual risk, so executives aren't stuck debating technical severity labels. NIST CSF 2.0 makes this a governance function, covering appetite, accountability, and enterprise risk integration.
Review resilience and crisis decision-making
Review these areas:
- Incident response, business continuity, and disaster recovery
- Backup assumptions and recovery objectives
- Communications plans, legal involvement, and notification duties
- Third-party dependencies
Confirm that executives, technical teams, legal, and communications understand their roles and escalation thresholds.
Then test it. Run a tabletop exercise that tests decisions, handoffs, evidence preservation, customer communication, and recovery, not just technical containment. CISA offers free exercise packages with scenarios and an After Action Report template.
Minimum viable playbooks for ransomware, business email compromise, and suspected data exposure should name first-hour actions, evidence to preserve, and who approves taking systems offline. Publish an after-hours call tree.
Assess people, process, technology, and vendors
Evaluate:
- Control ownership and service-level expectations
- Tool coverage, overlap, and managed-service performance
- Contracts and renewal dates
Then review how the organization discovers assets, manages privileges, protects data, monitors threats, handles vulnerabilities, and tracks remediation.
Vendors deserve early attention. Third parties were involved in 30% of breaches in Verizon's 2025 DBIR, roughly double the prior year, though Verizon notes its sample doesn't represent all breaches. A one-week vendor inventory capturing renewal date, spend, access type, data types, and last review gives you a start.
Hunt for visibility gaps where strong-looking dashboards hide material risk. "Installed" is not "working."
Establish the governance and compliance baseline
Identify the U.S. laws, contracts, and customer expectations that apply, then confirm them with legal and compliance owners. A framework is not legal advice. Depending on the organization, the list may include:
- SEC cyber disclosure rules for public companies
- HIPAA for health data
- The FTC Safeguards Rule for financial institutions
- NYDFS Part 500 for covered New York entities
- State breach notification laws
Note that CIRCIA reporting isn't required until its final rule takes effect.
Choose one primary framework, NIST CSF or ISO 27001, and use it as a map rather than a goal. Map existing controls, findings, evidence, and owners to it without creating duplicate paperwork. Then review audit findings, policy exceptions, and risk acceptances to judge whether the program is defensible and repeatable.
Turn findings into a risk register and decision system
Build a register that records the risk statement, affected service, impact, owner, current treatment, required decision, target date, and residual risk. Keep it short. A 50-page register won't get used.
Rank by business criticality, exposure, regulatory and contractual duties, recovery implications, dependencies, and feasibility, not by finding counts. Then define who can make, approve, accept, escalate, and communicate each major decision. A lightweight acceptance process uses a single approver and a time limit, so accountability doesn't stay trapped inside security.
Days 61-90: Prioritize, Execute, and Report
Select quick wins that prove judgment
Pick a small number of actions that address validated risk and fit current resources. Examples, depending on your baseline:
- Closing a known escalation gap
- Fixing a critical access issue
- Rebuilding the incident contact tree
- Formalizing risk acceptance
- Simplifying the executive report
For each, define the owner, expected outcome, dependencies, completion evidence, and business relevance. That keeps progress measurable rather than equating it with task volume.
Build the 12-month roadmap
Group initiatives into four buckets: immediate risk reduction, foundational capability, strategic transformation, and deferred or monitored items. For each, document the business problem, risk addressed, owner, dependencies, resources, decision needed, milestone, and how you'll verify results.
Cover people, process, technology, governance, third-party risk, resilience, culture, and regulatory work. A shopping list of tools is not a strategy.
Define metrics and a reporting cadence
Choose 5 to 7 stable metrics that show risk trends, priority remediation, material incidents, resilience readiness, control effectiveness, exceptions, and pending decisions. NIST SP 800-55 separates implementation, effectiveness, efficiency, and impact measures, and warns that an accurate metric, such as average daily port scans, can still be irrelevant to organizational goals.
Report in plain English: what changed, why it matters, what decision is needed, who owns the next step, and what risk remains. Three slides often suffice: top risks, readiness to respond, and progress against the roadmap.
Prepare the 90-day board briefing
Structure the briefing around:
- Current risk posture and validated findings
- Urgent exposures and strengths to preserve
- Required decisions and recommended priorities
- Resource implications and the roadmap beyond day 90
Show the difference between known facts, assumptions, accepted risks, and unresolved questions.
Speak in business terms. Make clear where leadership must approve funding, accept risk, change priorities, assign ownership, or grant escalation authority.
Make the model sustainable
Set recurring forums for security leadership, risk owners, executive review, and board reporting. A common rhythm is weekly operating check-ins, a monthly risk review, and quarterly board updates. Decide how metrics refresh, when risk acceptances expire, and how business changes alter the roadmap.
If the organization can't staff the roadmap, outside help can bridge the gap. Tyson Martin provides interim and fractional CISO leadership and board advisory work, adding temporary leadership, governance structure, and inspectable execution without slowing the business.
What Success Looks Like After 90 Days
Leadership understands the material risks. Security and business owners know their responsibilities. Critical decisions have clear escalation paths, and you can explain priorities without technical detail or report overload.
A strong 90-day outcome looks like this:
- Credible baseline of material risks and clear ownership
- Defensible priority sequence leadership can stand behind
- Early evidence of progress on the highest-impact work
- Operating model that adapts to incidents and change
NACD's handbook points to similar signs: informed questions from directors, timely emerging-risk identification, and strong security-team relationships.
After your first executive or board review, revisit the plan. New evidence and decisions should reshape the roadmap. The 90-day document is a starting point, not scripture.
Frequently Asked Questions
What should be included in a CISO 90-day plan?
Stakeholder discovery, a current-state assessment, risk and resilience reviews, decision rights, a few quick wins, stable metrics, and executive reporting. Finish with a roadmap that names owners and outcomes.
What are the top CISO priorities for 2026?
PwC's 2026 outlook highlights proactive resilience, AI governance, identity-centric operations, cloud visibility, and third-party oversight. Add regulatory readiness and board communication, then adjust for your own organization's risks.
How should a new CISO prioritize risks in the first 90 days?
Rank by business criticality, potential impact, exposure, legal and contractual obligations, dependencies, and recoverability. Measure each against the organization's stated risk appetite.
What should a CISO report to the board after 90 days?
Current risk posture, material changes, urgent decisions, risk owners, accepted residual risk, resource needs, early wins, and the forward roadmap.
How can a CISO balance quick wins with long-term strategy?
Choose quick wins that address validated risks and fit the sequenced roadmap, so they build credibility without becoming detours. Adjust priorities when incidents or business changes demand it.
