Independent thinking. Informed defence.

CISO Times

Intelligence for the people behind the defence.

The CISO Decision Brief

When do we…

What do I do in my first 90 days as a new CISO?

6 decision pointsThe pack behind this answer: CISO Transition, Handover & First 90 Days

Add to board memo

The short answer

Recommendation
Spend week 1 on the actions needed whatever you decide later: open incidents, the outgoing leader's access and your authority in writing. Then listen, check what you were told against proof until the end of week 7, and build a 100-day plan only from what you found.
Reasoning
An inherited programme can be described as doing more than it does, and a promise made in week 2 rests on what you were told. Checking each statement against a record, a test or a system view shows what is real before you build on it. Agreeing who decides stops a decision being taken twice or by the wrong person. A baseline in counts and words lets you show a year later what changed.
Considerations
  • The timings are the pack's defaults: decision rights agreed within 10 working days, inherited exceptions reviewed within 30 days, the management body told and the baseline recorded within 60 days. Your own standard may set others.
  • The change freeze has three exceptions: stopping harm, acting on a legal duty and a no-regret action such as removing a leaver's access (rule TR-01).
  • Who approves an inherited exception or risk acceptance depends on its band and on how you are governed: the board or a board risk committee it has delegated to, the management board in a two-tier structure, or executive management where there is no board.
  • Whether NIS2 applies to your organisation, and what the management body's liability means, are for your scope assessment and counsel to confirm.

The decision, step by step

Select any step for the reasoning behind it and where the pack covers it.

  • Start
  • Step
  • Decision
  • Outcome
StartYour first week as head of security or CISODecisionIs any incident or reporting duty open?StepList each one and confirm who holds each roleDecisionIs the outgoing leader's access confirmed removed?StepHave it removed and confirm it against a fresh extractStepAgree your authority and decision rights in writingStepWeeks 1 to 3: listen and interview every groupStepCollect the handover and mark every gapDecisionIs anyone asking you to promise or change something now?StepNote it, check it can be kept, then answerDecisionAre you asked to sign a statement you have not checked?OutcomeDo not sign yet; ask for the evidence firstStepWeeks 4 to 7: check what you were toldDecisionIs an inherited exception or acceptance past its review date?StepRenew, change or close it by the approver its band setsStepEnd of week 7: brief the executives on what you foundDecisionHas the management body been told what NIS2 Article 20 asks of it?StepTell it through the sponsor, with counsel on liabilityStepWeeks 8 to 10: build the 100-day plan from your findingsStepWeeks 11 to 13: agree the plan and the reporting rhythmOutcomeDay 90: review, set the calendar, repeat the baseline in month 12

Keyboard: Tab to a step, arrow keys move along the flow, Enter pins its explanation, + and − zoom, 0 fits the diagram, Esc closes. The text version below has the same content.

Where a step quotes a number, it is the default in the CISO Times pack. Your own standard may set a different one.

Read as text

The same flow written out: each step, its reasoning and where the pack covers it. 21 steps.

  1. Start

    Your first week as head of security or CISO

    The first week is for the few actions that are needed whatever you later decide, and for changing nothing else. The pack runs the first 90 days in four phases: Listen (weeks 1 to 3), Verify (weeks 4 to 7), Decide (weeks 8 to 10) and Propose (weeks 11 to 13). Its idea is to learn before you promise, find out what is real, decide who decides, and record the starting position.

    In the pack

  2. Decision

    Is any incident or reporting duty open?

    List every open incident and every open reporting duty in week 1. Answer yes if you cannot yet say. Nothing open is a finding to confirm later, not an assumption. Incident roles, decision rights and clocks belong to the incident response plan and stay as they are.

    In the pack

  3. Step

    List each one and confirm who holds each role

    Write down each open incident and duty, who holds each incident role and who deputises, and get that confirmed in writing. Take only the decisions the incident plan gives your role. Do not change who holds a role or how a decision is taken while an incident is open.

    In the pack

    See also

  4. Decision

    Is the outgoing leader's access confirmed removed?

    Accounts, administrator rights, tokens, shared secrets, vendor portal logins and any personal account used for work should go on the day they leave. Confirmed means you saw a fresh extract that shows it. Answer no if you only have someone's word.

    In the pack

  5. Step

    Have it removed and confirm it against a fresh extract

    Have each item removed through your own access process and get a fresh extract of accounts and privileged rights. The pack’s default is to confirm within 2 working days; your own standard may set another limit. Check the person’s other possible access too, since some of it is known only to them.

    In the pack

  6. Step

    Agree your authority and decision rights in writing

    Agree your appointment, reporting line and authority with the executive sponsor in week 1, and the arrangement for each kind of decision within 10 working days (the pack's default). For each kind, you Own it, Share it or Escalate it across days 1 to 30, 31 to 60 and 61 to 90. The arrangement gives you no right the earlier packs do not give your role, and nobody approves what they own.

    In the pack

  7. Step

    Weeks 1 to 3: listen and interview every group

    Book an interview with each of the ten stakeholder groups and hold them by the end of week 4: executives, the board or its chair, IT, legal, HR, finance, business owners, suppliers, audit and your own team. Ask the same four core questions of each. Record each interview the same working day, and send the person a short note of what you heard so they can correct it. Judgement: do not stop at the executives, since the people who built the programme can tell you the most.

    In the pack

    See also

  8. Step

    Collect the handover and mark every gap

    Use the handover document the outgoing leader left. It is what they believed, so check each part later against a record, a test or a system view. If there is none, build it from records and write down what is missing. A section with nothing in it says None, with a date and who said so, where None is allowed.

    In the pack

    See also

  9. Decision

    Is anyone asking you to promise or change something now?

    Executives, customers, auditors and regulators may ask for a date, a budget, a result or a change in these weeks. Answer yes if any request is open or you are unsure. The pack's rule is to change no policy, tool, team structure or priority until discovery ends at the close of week 7.

    In the pack

  10. Step

    Note it, check it can be kept, then answer

    Record a request as Committed only after you have checked that you can keep it, and say how. Otherwise record it Noted, not committed, or Declined with the reason. The Not Early list asks you not to promise a date, budget or result until the plan is agreed (week 11). The change freeze has its own exceptions: acting to stop harm, to meet a legal duty, or a no-regret action such as removing a leaver’s access. Judgement: a request you cannot check yet is Noted, with the date you will answer.

    In the pack

  11. Decision

    Are you asked to sign a statement you have not checked?

    This covers a statement or form to a regulator, an auditor or a customer. A statement is held against the organisation and against you. Answer yes if you are unsure whether you have seen the evidence. Judgement: the pack says to sign only after you have seen the evidence, and this flow treats not sure as not yet seen.

    In the pack

  12. Outcome

    Do not sign yet; ask for the evidence first

    Tell the person asking that you will sign once you have seen a record, a test or a system view. Put the request on your commitments list with its due date and owner. Judgement: if the date cannot move, take it to the executive sponsor, and to counsel where the statement is a legal one.

    In the pack

  13. Step

    Weeks 4 to 7: check what you were told

    Take each discovery item and look for a record, a test result or a system view. Record one of four words: Evidenced, Described only, Not found or Contradicted. A statement alone is Described only. Start with the areas the interviews raised, test two controls the programme says it runs, and compare an extract of leavers and privileged accounts with the HR record.

    In the pack

    See also

  14. Decision

    Is an inherited exception or acceptance past its review date?

    Read every inherited exception and risk acceptance with its reason, band, approver and review date. Answer yes if any is past its date or if you have not yet listed them. Nothing continues by default.

    In the pack

  15. Step

    Renew, change or close it by the approver its band sets

    Do this within 30 days of your start (the pack's default). The first decision on an inherited item is a review, not a new approval. The approver is the one the exception or risk acceptance rules set for its band, and nobody approves an exception they requested or a risk they own. Take no new risk acceptance in your first 30 days; it goes to the accountable executive and the sponsor.

    In the pack

    See also

  16. Step

    End of week 7: brief the executives on what you found

    Show findings by count in the four words, the top risks, inherited exceptions, open incidents and promises, and your baseline. The baseline is counts and levels in words, with Unknown and a reason where you do not know. It is never one score. Each ask gives options, a recommendation, the cost and the risk of not deciding.

    In the pack

  17. Decision

    Has the management body been told what NIS2 Article 20 asks of it?

    Article 20 asks Member States to ensure the management body approves the cybersecurity risk-management measures, oversees their implementation, can be held liable for infringements, and follows training. Your national law and counsel settle what that means for your organisation and for liability. Answer no if you do not know whether the body was told.

    In the pack

  18. Step

    Tell it through the sponsor, with counsel on liability

    Do this within 60 days of your start (the pack’s default), through the executive sponsor, in plain words, with a short note and a minute. Say what it must approve and oversee and that it must follow training. Leave liability to counsel. Whether NIS2 applies to your organisation comes from its scope assessment and counsel, not from this flow; your own governance rules say who approves.

    In the pack

    See also

  19. Step

    Weeks 8 to 10: build the 100-day plan from your findings

    Every item traces to a finding, an interview record or a handover gap, and is a Quick win (by day 30), a Stabilisation item (by day 70) or a Strategic decision (by day 100). Each has an owner, an effort and a due date. The pack's default is no more than 3 Large items. List what you dropped and why. A promise outside the organisation follows the plan.

    In the pack

  20. Step

    Weeks 11 to 13: agree the plan and the reporting rhythm

    Take the plan, the reporting rhythm and the asks to the executives and agree the plan in writing. The calendar sets the reporting rhythm: a monthly report to the executive committee and a quarterly report to the management body. Treat any budget promise as following the agreed plan. At day 90, review the checklist, the findings and the plan.

    In the pack

  21. Outcome

    Day 90: review, set the calendar, repeat the baseline in month 12

    Review the checklist, the findings and the plan at day 90, and set the first-year calendar from the owners and dates you now know. Repeat the same measures with the same definitions at month 12. Compare them only where the definition and scope have not changed, so you can show a year later what changed.

    In the pack

Practical checklist

  1. List every open incident and reporting duty in week 1, and confirm in writing who holds each incident role and who deputises.
  2. Confirm the outgoing leader's access is removed against a fresh extract, within 2 working days in the pack's defaults (rule TR-08).
  3. Agree your appointment, reporting line and decision rights in writing with the executive sponsor.
  4. Interview all ten stakeholder groups by the end of week 4 with the same four core questions, and promise nothing you have not checked.
  5. Check each discovery item against a record, a test or a system view, and record Evidenced, Described only, Not found or Contradicted.
  6. Review each inherited exception and risk acceptance with the approver its band sets, and tell the management body through the sponsor what NIS2 Article 20 asks of it.
  7. Brief the executives at the end of week 7 with the findings in counts, the top risks, the baseline and the asks.
  8. Build the 100-day plan from the findings, agree it in writing with the sponsor in week 11, and review it at day 90.

Evidence to have ready

  • The sponsor's signed or emailed note of your appointment, authority and decision-rights arrangement.
  • The fresh extract showing the outgoing leader's access removed, and the list of open incidents with the named role holders and deputies.
  • The interview records and the discovery findings, each stating what was seen and when.
  • A decision on each inherited exception and risk acceptance, and the briefing note and minute for the management body.
  • The baseline in counts and words, and the 100-day plan agreed in writing, each item traced to its source.

Assumptions

  • You have just taken a head of security or CISO role, and an executive sponsor exists to agree your authority and plan.
  • The timings shown are the defaults in the CISO Times pack for a new security leader. Your own standard, contract or national law may set others.
  • The earlier packs give each decision right to a named role, and your arrangement gives you no right they do not give.
  • The outgoing leader has left or is about to leave. Where they are still in post, they complete the handover document before they go.

Not covered here