How do I build a hundred-day plan that mixes quick wins with the decisions that take longer?

Start

You need a hundred-day plan for a security function you inherited

The pack's plan has three kinds of item, each with a latest due day: a quick win by day 30, a stabilisation item by day 70 and a strategic decision by day 100. Each item must come from something you found, and each has one owner. The plan is short on purpose: eight good items that trace to findings beat forty that do not.

• Then: Has discovery ended, with each finding recorded in the four words?

Decision

Has discovery ended, with each finding recorded in the four words?

The pack drafts the plan in week 9, after discovery closes at the end of week 7, and agrees it with the sponsor in week 11. A plan written earlier rests on what you were told. The four words are Evidenced, Described only, Not found and Contradicted. If you are unsure, take the cautious branch.

• No, or not known: Hold the plan. Take only no-regret actions and note candidates
• Yes: List each candidate as one action a non-specialist can follow

Outcome

Hold the plan. Take only no-regret actions and note candidates

Until discovery ends, change no policy, tool, team structure or priority, except to stop harm, act on a legal duty or take a no-regret action such as removing a leaver's access. Keep a private list of candidate actions with the finding behind each, and promise nothing to anyone outside. Come back to this flow when the findings are in.

Step

List each candidate as one action a non-specialist can follow

Write each action in one sentence that a reader outside security can follow, and keep it to one piece of work. Gather the candidates from the discovery findings (Not found and Contradicted first), the interview records, the handover gaps and any inherited exception that is past its review date.

• Then: Does it trace to a finding, interview, handover gap or inherited item?

Decision

Does it trace to a finding, interview, handover gap or inherited item?

The plan's first rule is that an item with no source is not in the plan. The source is the ID of the discovery item, interview record, handover gap or inherited exception, so a reader can check it. An idea you like with nothing behind it is a candidate for the interviews or discovery, not for the plan.

• No, or not known: Leave it out until you can show what it comes from
• Yes: Is a legal duty, an open incident or live harm behind it?

Outcome

Leave it out until you can show what it comes from

Find the record, test or system view that supports it, or ask the stakeholder what they saw. If you cannot, leave the item out. An item added on instinct is a promise made without evidence, which is the first risk the pack names for a new leader.

Decision

Is a legal duty, an open incident or live harm behind it?

These do not wait for the plan's timing. An open incident or reporting duty follows your incident plan, whose roles, decision rights and clocks the pack leaves unchanged. A legal duty goes to Legal. If you cannot tell whether a duty or an incident is involved, take the cautious branch and ask.

• Yes, or not known: Act now through the incident or legal route, then list it in the plan
• No: Is it small, needed whatever the plan finds, and low in risk?

Outcome

Act now through the incident or legal route, then list it in the plan

Do the work through your incident procedure or with Legal, and let the people who hold the incident roles take the incident decisions. Do not wait for the plan to be agreed. Add the item afterwards with its source and date, so the plan shows everything that was done in the period.

Decision

Is it small, needed whatever the plan finds, and low in risk?

A quick win is Small in effort and is due by day 30 under the pack's defaults. Because discovery is still open then, most quick wins are no-regret actions already taken, entered with their dates. Judgement: that reading joins two pack rules, so a plan written after day 30 should enter quick wins already done and not back-date new ones.

• Yes: a quick win, due by day 30: Give it one owner, an effort, a due date and a risk band
• No: Does it close a gap the findings show, at Small or Medium effort?

Decision

Does it close a gap the findings show, at Small or Medium effort?

A stabilisation item makes the programme do what it says it does, and is due by day 70 under the pack's defaults. It may be Small or Medium effort. Judgement: a gap that needs Large effort is not a stabilisation item, so plan the decision on whether and how to do it as a strategic decision.

• Yes: stabilisation, due by day 70: Give it one owner, an effort, a due date and a risk band
• No: a strategic decision, due by day 100: Would it be a Large item, taking the plan above three?

Decision

Would it be a Large item, taking the plan above three?

A strategic decision sets the direction for the next year and is due by day 100. It may be Large, but the pack's default is no more than three Large items in the plan. Split a Large item into steps, or let it wait for the next plan. If you have not yet sized it, take the cautious branch.

• Yes, or not sized: Split it, or leave it for the next plan
• No: Can you take this decision yourself under the published rule?

Outcome

Split it, or leave it for the next plan

Split the work into smaller items, each with its own source and owner, or record it as dropped or moved past day 100 with the reason. Do not carry a fourth Large item and hope it fits. Work due after day 100 goes to the first-year calendar.

Decision

Can you take this decision yourself under the published rule?

Check the decision-rights matrix for the type of decision and the window (days 1 to 30, 31 to 60, 61 to 90). The matrix never gives you a right the earlier packs do not give, and nobody approves what they own. The top approver depends on how you are governed: the board or a delegated risk committee, the management board in a two-tier structure, or executive management where there is no board. If not known, take the cautious branch.

• Yes: Give it one owner, an effort, a due date and a risk band
• No, or not known: Name who decides, and prepare the ask with a recommendation

Step

Name who decides, and prepare the ask with a recommendation

The plan records who decides, taken from the matrix and from the packs that set the right. The item's owner prepares it, and the decider takes it. Make the ask as the board reporting pack sets out: options, a recommendation, the cost and the risk of not deciding. Judgement: the executive briefing, or the agreement of the plan, is the natural place to ask.

• Then: Give it one owner, an effort, a due date and a risk band

Step

Give it one owner, an effort, a due date and a risk band

Each item has one owner by role, an effort of Small, Medium or Large, and a due date no later than the category allows. Enter the band of the risk it answers as your risk register states it, and leave it blank if it answers no rated risk. Do not make up a band to raise an item's rank.

• Then: Order the plan by category, risk band, effort and due date

Step

Order the plan by category, risk band, effort and due date

The pack's order puts quick wins first, then stabilisation, then strategic decisions. Within a category it puts the highest risk band first, unrated last, then smaller effort, then the earlier date. Read the order from the plan, then check that it still makes sense to the people who will do the work. Dependencies are a judgement the order does not settle.

• Then: Does any item run past day 100, or need to be dropped?

Decision

Does any item run past day 100, or need to be dropped?

An item dropped, or moved past day 100, stays on the plan marked Dropped and is listed with its reason, who decided and where the work goes now. Work due after day 100 goes to the first-year calendar. If you are not sure an item fits, ask the owner for a date before you decide.

• Yes: List it with the reason, and move later work to the calendar
• No: Agree the plan in writing with the executive sponsor

Step

List it with the reason, and move later work to the calendar

Record what happened, the reason, who decided and when, and whether the work now belongs to a calendar item, a later plan or nowhere. This is your own record in your own register. A plan that shows what it dropped is easier for the sponsor to trust than one that shows only what went well.

• Then: Agree the plan in writing with the executive sponsor

Step

Agree the plan in writing with the executive sponsor

Take the plan to the executive sponsor in week 11 and agree it in writing, then show it to the management body. NIS2 Article 20 asks the management body to approve and oversee the measures, as the pack's references state it. A promise to a customer, auditor or regulator follows the plan and never leads it. Counsel confirms what any liability means.

• Then: At a day 30, 60 or 90 review, has anything changed an item?

Decision

At a day 30, 60 or 90 review, has anything changed an item?

Review the plan at day 30, day 60 and day 90 and record the counts as they stand that day, with what changed and why. A new finding, a missed date or a decision taken elsewhere can all move an item. If you have not reviewed the sources since the last review, take the cautious branch.

• Yes, or not reviewed: List each candidate as one action a non-specialist can follow (back to an earlier step)
• No: Report counts with names, and keep the plan

Outcome

Report counts with names, and keep the plan

Report counts with the item names beside them, such as 1 item overdue, named, and 2 due within 14 days. Do not give a score or a share. Keep the plan, the interview records and the decision-rights arrangement for the records period in the pack's default, which is 3 years, or longer if a contract or law asks.