The First Week of an Interim CISO Engagement: What Good Looks Like

The interim CISO started Monday. By Friday, one of two things has happened. In the good version, they have met the people who matter, read what exists, found the two or three risks nobody was saying out loud, and told you what the first ninety days should look like. In the bad version, they have been locked in a room with policy documents, and nobody is sure what they are for yet.

The first week of an interim engagement is disproportionately informative. Interim leaders earn their fee through speed of understanding: they have done this in a dozen companies, and the pattern-recognition that justifies the rate shows up in days, not months.

If you know what a good first week looks like, you can course-correct on day six instead of month three. Here is the shape of it.

TLDR

• A good first week is about listening and mapping, not changing anything.

• By Friday they should name the key people, the real risks, and the 90-day shape.

• They should talk to operators and frontline staff, not only executives.

• Warning sign: a rewrite of everything before the listening is done.

• The CEO should get one honest, uncomfortable observation by the end of week one.

Listening is the deliverable

The instinct is to put the new interim to work immediately: review this, approve that, attend the customer call. Resist it for five days. The value of an interim CISO is calibrated judgment, and judgment this early is only as good as the listening behind it.

The good version of the week is a meeting map: the CEO and the leadership team, the IT provider or internal team, the operations people who know where the bodies are buried, and one or two skeptics. What they are building is not an audit; it is a picture of how decisions actually get made here.

The engagement models vary - the distinctions in fractional versus full-time CISO arrangements change the hours, not the listening. A good interim does this work whatever the contract says.

What should be true by Friday

Four things, and you can ask for them directly. They can name the people whose cooperation the security work depends on. They can list the top risks as the business experiences them, not as a framework numbers them. They have read what exists - the incident history, the current projects, the last assessment - and can say what is missing. And they can sketch the ninety days: what gets attention first and why.

This fictional example shows the Friday note from a strong first week. It is an illustration, not a prescription.

Area	What I found	First move
Backups	Tested monthly, never restored fully	Full restore test, week 3
Access	Two departed employees still active	Clean-up done Friday
Customer pressure	Two questionnaires stuck	Evidence library, weeks 2-4

Note what the note is not: it is not a forty-page gap assessment. It is a short, opinionated map with early wins already done.

The warning signs to watch

Three patterns predict a weak engagement. The hermit: a week spent reading documents without meeting operators, producing observations everyone already knew. The arsonist: declarations that everything is broken, which is a way of making the job sound big rather than making the company safer. And the vendor in waiting: an early, enthusiastic interest in tool purchases before the diagnosis exists.

Each is fixable if caught in week one. The conversation is simple: show me the people you have talked to and what you learned that we did not already know.

The hiring discipline that screens for this upfront is in the questions that separate real leaders from resume padding; the first week is where the screening gets verified.

Your job in their first week

The company has homework too. Make the introductions promptly; an interim who spends week one chasing calendar access is burning your fee. Be honest about the messy parts; they have seen worse, and the mess is what they are for. And give them the permission structure: what they can decide, what needs you, and who to call at 2 a.m.

By Friday, ask for the uncomfortable observation. Every good interim finds at least one thing in week one that insiders stopped seeing. If the report is entirely comfortable, either the company is unusually healthy or the interim is unusually polite, and it is worth knowing which.

That single observation is often the cheapest value of the whole engagement.

The related discussion of fractional versus full-time CISO is worth your time alongside this one. The related discussion of separate real leaders from resume padding is worth your time alongside this one.

Frequently asked questions

Should the interim CISO attend customer security calls in week one?

Yes, as an observer if the relationship is warm. Customer-facing credibility is part of the job, and watching the interim handle a customer's questions tells you as much as any internal review.

How much access should an interim have in week one?

Read access broadly, change access narrowly. They need to see the environment to judge it; changes should wait until the listening supports them, usually weeks two and three.

What if the first week reveals something alarming?

Then the engagement is working. A good interim distinguishes urgent from important: the active compromise gets handled today, the structural issue goes into the ninety-day plan, and they tell you plainly which is which.

A Defensible Next Step

If you have an interim CISO starting, send them the meeting map before day one: the eight people to meet and the documents worth reading. The first week will set the tone for everything after. Book a Decision-Clarity Call if you want the engagement scoped first.