New Security Leader First 90 Days — Guide

New Security Leader First 90 Days

A new security leader inherits a programme described by other people. Some of it is real, some of it is written down and not done, and some of it is a hope. The first months are for finding out which is which, and for saying little that cannot be kept. Listen first. Check what you hear against a record, a test or a system. Agree in writing who decides what while you learn. Then record where you started, in counts and in words, so that in a year you can show what changed. The result is a baseline and a plan. It is never one score.

Learn before you promise. Find out what is real, not what is claimed. Decide who decides. Show the starting position, so that progress can be shown.

Is this for you?

This pack is for you if:

• you have just started as a head of security, security manager or CISO, and you want to know what to do first, and what to leave alone;
• you are the one leaving, and you want the person after you to find the programme as it really is;
• you have a small team or none, and cannot afford a long assessment before you act;
• people keep asking you for a date, a budget or a plan, and you have not yet seen enough to give one;

It works when you were promoted from inside as well, because you still inherit what your predecessor held.

What is different about a first 90 days

You arrive with authority and no history. People tell you what they believe, and what they think you want to hear. Your first statements will be repeated, and some of them will be held against you. Six things follow.

• Listen before you promise. Spend the first three weeks listening and change nothing, except to stop harm, meet a legal duty or take an action you would take whatever you find (TR-01).
• Check what you are told. A statement is not a finding. Look for a record, a test result or a system view (TR-02).
• Ask everyone, not only the executives. The team, IT, audit and the business owners know how the programme really runs (TR-03).
• Do not assume you hold every right your predecessor held. Earlier packs give each decision right to a named role. Agree in writing what you do with each one while you learn (TR-05).
• Take over what was promised. An open incident, an exception past its review date, an access you forgot to remove or a promise to a customer or a regulator is now yours (TR-07, TR-08, TR-09).
• Record where you started. In a year, nobody can show what changed unless you wrote down the starting position (TR-12).

What binds the management body, and what does not

Directive (EU) 2022/2555 is addressed to the Member States, and binds essential and important entities through their national law. Article 20 asks the Member States to ensure that the management body approves the cybersecurity risk-management measures, oversees their implementation, can be held liable for infringements of Article 21, and is required to follow training. What liability means for a member of a management body depends on national law, and counsel confirms it. Whether your organisation is an essential or an important entity comes from its scope assessment and from counsel, and this pack does not decide it.

The NCSC’s Code and toolkit and the ENISA skills framework are voluntary guidance. They are not law. They say what boards might expect and what roles typically do. They do not say what a new security leader must do, and no law named here says how a handover must be run. Following them is not a statement that your organisation complies with NIS2 or any standard.

This pack does not say which document, record or practice meets a requirement of NIS2. Each reference says what its source asks of the management body or the organisation and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.

The sources and their editions

The pack reads Directive (EU) 2022/2555 (NIS2); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); UK NCSC board guidance and the ENISA skills framework, as their publishers state them; as published and read on 10 October 2026. Article 20(2) sets no interval for training the members of the management body. The yearly interval in this pack is the pack’s own choice, taken from the NIS2 readiness pack (P12 NR-05).

We found no NCSC, ENISA, ISACA or SANS publication written for a new security leader or for a handover. The NCSC’s Code and toolkit are written for the boards of medium and large organisations. The ENISA framework describes typical roles, and we could not read its profile of the chief information security officer, so we quote none of it. Commercial guides to a CISO’s first 90 days are practitioner opinion, and none is cited. The method here is the pack’s own, built on the earlier packs. It is a way of working and not a standard.

The four phases

The 90 days are thirteen weeks, counted from your first day. The first briefing falls at the end of week 7. The plan runs to day 100.

The first week has 8 actions of its own, because some things cannot wait: your appointment in writing, the open incidents, your predecessor’s access, and the dates ahead. First 90 Days Security Leader Checklist gives every week’s actions, 40 in all, each with the record that shows it was done.

The rules

The checklist holds sixteen rules, TR-01 to TR-16. Each answers at least one of ten named risks, RK-01 to RK-10. The time limits are house defaults that you set yourself: 30 days to review inherited exceptions, 30 days to confirm contacts, 60 days to tell the management body what it must approve, 60 days to record the baseline, 10 working days to agree the decision rights and 2 working days to confirm that access is removed.

The wording of each rule is in First 90 Days Security Leader Checklist. Three of them carry most of the weight. Change nothing until discovery ends (TR-01). Show what you saw for every finding (TR-02). Promise nothing until you have checked it (TR-04).

What not to do early

Most mistakes in the first weeks are things done too soon. Each of these has a date before which it waits.

• Announce a reorganisation, a new strategy or a new tool. Wait: the Decide phase (week 8).
• Rewrite or withdraw a policy, a standard or a procedure. Wait: the Decide phase (week 8).
• Promise a date, a budget or a result to the executives, a customer, an auditor or a regulator. Wait: the plan is agreed (week 11).
• Accept or renew an inherited exception or risk acceptance without reading it. Wait: never. Read it first.
• Sign a statement or a form to a regulator or an auditor that you have not checked. Wait: you have seen the evidence.
• Change who holds an incident role or how an incident decision is taken. Wait: p09’s own review of the plan.
• Criticise the outgoing leader or the earlier programme in front of others. Wait: never.
• Buy a tool to fix a problem you have not yet shown to exist. Wait: the Decide phase (week 8).
• Treat what you were told as a finding. Wait: you have seen a record, a test or a system view.

Finding out what is real

The discovery workbook (Inherited Security Programme Discovery Workbook) holds ten areas, governance, risk, policy, access, vulnerabilities, incidents, suppliers, resilience, awareness, assurance. Each has two items to look at, twenty in all. For each item you record one of four words.

A finding is always backed by something you saw. For each area the workbook names three kinds of proof, record, test, system view, and says which document to read first. A statement alone is Described only, however senior the person who made it.

Evidenced is at least Seen in P19’s words, and Described only is Told. A finding is not a maturity level. A level is set by P19’s rules, from a sample of records.

Count the findings and never add them up. “14 of 20 items looked at” says how far you have got. It says nothing about how good the programme is.

The interviews

Interview ten groups, in the Listen phase: executive, board or its chair, iT, legal, hR, finance, business owners, suppliers, audit, the team. Put the same four questions to every group.

1. What do you expect from the security function, and how will you know it is doing well?
2. What worries you most about security today?
3. What has been promised to you or to your area, and what is still open?
4. Who else should I talk to, and what should I read first?

Each group then has a few questions of its own, in Stakeholder Interview Guide & Record. Write each interview down in a fixed record of six fields: who and when, expectation, concern, commitment, follow-up, sent back. Send each person a note of what you heard, so that they can correct it.

The commitment field needs care. Record each promise as Committed, Noted, not committed, Declined. You record a promise as Committed only after you have checked that you can keep it, and you say how (TR-04). Declining early, with a reason, is better than agreeing and failing.

The handover

The outgoing leader completes the handover document, twelve sections, before they leave (TR-06). It lists what they hold and what they have promised, from open risks and incidents to contacts and accounts. 5 sections may say None, with a date and the name of the person who said it. No section may stay blank.

The document is what the outgoing leader believed. Check it as you check everything else.

If the outgoing leader has gone, build the document yourself from records, and write down what is missing. Where they are still at work, ask them to sign last. The record is counted in four kinds of gap: missing, partial, access not confirmed removed, not signed. Count them as numbers, as “8 of 12 sections complete”, and work through them.

Remove your predecessor’s access on the day they leave: accounts, administrator rights, tokens, shared secrets, vendor portals and any personal account used for work. Confirm it against a fresh extract (TR-08). The access review pack (P07) asks the same of any removal (P07 AR-07).

Who decides while you learn

The earlier packs give each decision right to a named role. When a new leader takes the role, nobody should have to guess. Agree in writing, with your executive sponsor, what you do with each kind of decision in the first 30, 60 and 90 days. There are three modes.

Transition Decision Rights Matrix sets the arrangement for eight kinds of decision. The arrangement never gives you a right that the pack which sets the right does not give you. It holds you back, or asks another person for a view, or refers a decision upward.

The rights are set by P04 PF-03, P02 EX-05, P05 RM-08, P09 and P06 TP-05. No earlier pack sets spending or hiring. They are the organisation’s own, and the matrix leaves them as [[placeholders]] for you to fill. Agree the arrangement within 10 working days of the start (TR-05). Review it at day 30, day 60 and day 90.

Nothing in this pack changes who holds an incident role, what each may decide or how fast anything is reported. Those belong to the incident pack (P09) and the regulatory notification pack (P18). In week 1, list every open incident and every open reporting duty, and confirm in writing who holds each role and who stands in (P09 IM-03).

Inherited exceptions, acceptances and promises

An exception or a risk acceptance that your predecessor approved is still in force. Some will be past their review date. Review each one within 30 days, and renew, change or close it by the approver its band sets (P02 EX-05, P05 RM-08). Nothing continues by default (TR-07). Read the reason, the date and who approved it before you decide anything.

Find what the organisation has promised to regulators, customers, auditors and the insurer, and put it on one list with an owner and a date for each (TR-04, TR-06). Customer commitments made in questionnaires sit in the tracker of the questionnaire pack (P26-A07, P26 QG-17).

Telling the management body

Within 60 days of the start, tell the management body, through your executive sponsor, what NIS2 Article 20 asks of it: to approve the measures, to oversee their implementation and to follow training (TR-11). Say in plain words that it can be held liable, and that counsel confirms what that means. The NIS2 readiness pack records what the management body approved and oversaw (P12 NR-03 to NR-05), and the awareness pack covers its training (P16 AW-07).

The first executive briefing

Brief the executives at the end of discovery, in week 7. First Executive Briefing Deck for a New Security Leader gives thirteen briefing slides, inside a deck that also holds framing, example and reference slides: what you did, what is working, what is described and not yet shown, what you could not find, what contradicts what you were told, the top risks, the inherited items, the baseline, what the management body must approve, the proposed priorities and the decisions asked. Each ask has options, a recommendation, the cost and the risk of not deciding, as the board reporting pack asks (P03 BR-06).

six asks go to the executives, EA-1 to EA-6.

Recording where you start

The baseline (Security Posture Baseline Scorecard) is the starting position, as at a date. It holds twelve measures, each taken unchanged from the measures catalogue (P11), and a level in words for each domain of the maturity pack (P19). The starting position, recorded as counts and as levels in words, with a reason wherever a value is unknown. It is never one score.

The rules are BL-01 to BL-06, and Security Posture Baseline Scorecard holds them. The levels are Not in place, Informal, Defined, Managed. The evidence words are Told, Seen, Tested. Where you do not know a value, write Unknown, with one reason from this list: not measured here; data not available; not yet asked; owner disputes the data. Do not estimate. An Unknown with a reason and a plan item to find it out is honest and useful. An estimate is a promise in disguise.

Do not add the baseline up. It is a set of counts and words. In a year, repeat the same measures with the same definitions, and compare only where the definition and the scope are unchanged.

The 100-day plan

From the findings, the interviews and the handover gaps, draft a plan. Every item says where it came from (PL-01), so that the plan follows what you found and not what you assumed. There are three categories.

A Strategic decision names who decides, under the arrangement in Transition Decision Rights Matrix (PL-04). Keep Large items to three or fewer (PL-05). List what you dropped and why (PL-07). Report the plan as counts: done, in progress, not started, dropped, overdue and due soon (PL-08). A promise outside the organisation follows the plan. It never leads it (TR-14).

The first year

The plan ends at day 100, but the work does not. First-Year Security Operating Calendar sets out twenty-four recurring items for the first year, from month 1, the month you start: 7 for reporting, three for risk, 5 for controls, three for incidents, three for suppliers, three for people. four are monthly and twelve are yearly. Every interval comes from the pack that sets it, such as the access review pack (P07 AR-02), the supplier pack (P06 TP-09) and the incident pack (P09 IM-12). Move each month to your own board and audit dates.

The order to work in

The document numbers are not the order of use. Work through the documents as the phases need them.

Start with First 90 Days Security Leader Checklist on your first day. It tells you what the week holds.

How it runs in practice (EXAMPLE)

Take Kestrel Components B.V. (EXAMPLE), a manufacturer of industrial pumps and valves in an EU Member State, with about 600 staff and two plants. It is treated as an important entity under NIS2 (manufacturing), on its own scope assessment, which counsel has not yet re-checked. It is not the distributor of the earlier packs, who held the role throughout. Every value here is made up.

Sam Okafor (Head of Information Security) started on 14 September 2026. Jonas Brandt left on 28 August 2026, after a notice period of three weeks and a partial handover. Ines Moreau (chief executive) is the executive sponsor. On 30 September 2026, day 17 and week 3, the Listen phase is ending.

• Interviews. 9 of 10 groups interviewed; 3 committed, 5 noted and not committed, 1 declined; 8 follow-ups open, 1 overdue. The critical suppliers are booked and not yet interviewed. One request, a cut in licence spend this quarter, was declined with a reason.
• Discovery. 14 of 20 items looked at: 6 Evidenced, 5 Described only, 2 Not found, 1 Contradicted; 6 not yet looked at. The one contradiction is in the area of access. Leavers were described as removed within the window. An extract compared with the HR list showed 11 leaver accounts still active. The plan has a quick win for it (PI-01), and it is done.
• Inherited items. 2 inherited exceptions are past their review dates, IE-1 (legacy order-entry server without multi-factor sign-in, Medium band) and IE-2 (shared engineering account on the plant network, High band). Each goes to the approver its band sets. None of the three inherited risk acceptances is past its review date.
• An open incident. INC-2026-041, a phishing-led mailbox compromise in the finance team, opened on 24 August 2026 and is contained, not closed. Its recovery criteria are not recorded as met and its post-incident review has not been held. The incident pack sets who decides and what is reported.
• The handover. 8 of 12 sections complete; 4 gaps (2 missing, 1 partial, 0 access, 1 unsigned). HD-06 and HD-11 are missing, HD-08 is partial and HD-12 is unsigned.
• Decision rights and plan. Ines Moreau agreed the arrangement on 23 September 2026, 7 working days after the start. The plan, drafted on 28 September 2026: 2 of 14 items done; 3 in progress, 9 not started, 1 overdue, 2 due within 14 days.
• The baseline. 9 of 12 measures recorded, 3 Unknown; 6 of 14 domains given a level, 8 Unknown. The Unknown values carry a reason, most of them “Not yet asked”, and each points to the plan item that will find it out.

The one-sentence position for the executives reads: 9 of 10 stakeholder groups interviewed; 14 of 20 discovery items looked at, 1 Contradicted; 2 inherited exceptions past their review date; 1 incident open at handover; 8 of 12 handover sections complete; 2 of 14 plan items done, 1 overdue.

The first briefing is set for 30 October 2026. Read all of this as Kestrel’s own record. It does not say that Kestrel, or any of its documents, meets any standard or law.

What to report

Report six counts, each as a count or “n of m”, every month, to the executives that sponsor you.

• Stakeholder groups interviewed (TM-01).
• Discovery items looked at (TM-02).
• Inherited exceptions and acceptances past their review date (TM-03).
• Handover sections complete (TM-04).
• Plan items done by their due date (TM-05).
• Baseline values recorded (TM-06).

Never combine them into a percentage, a score, a weighting or a traffic-light total. List the unknowns beside the counts, with their reasons.

Everything in the pack

Limits

• Not legal advice, and not advice on employment. This document helps a new head of security, and the one who is leaving, to hand over and take over a security function. It is not legal advice and not advice on employment. It does not say that you comply with NIS2 or any standard. What liability means for a member of a management body, what an outgoing leader may be asked to hand over under their contract, and whether your organisation is an essential or an important entity are for counsel to confirm.
• No mapping. A reference says what its source asks of the management body or the organisation, and which CISO Times document helps with that work. It does not say that a document from this pack meets a requirement of NIS2.
• Other packs own the rest. Incident roles, decision rights and clocks are the incident pack’s (P09) and the reporting pack’s (P18). Policy approval is P04’s, risk acceptance P05’s, exceptions P02’s and supplier assurance P06’s. This pack states no clock and changes no decision right.
• A baseline is a snapshot. It describes the organisation on the day it was recorded, for the scope it states.
• The method is the pack’s own. No standard or regulator says how a handover must be run, or how a new leader must spend the first months.
• The files are yours. Every file in the pack stays on your own systems. Nothing you enter in them goes back to the CISO Times.
• The example is not a real firm. Kestrel is fictional, marked EXAMPLE, and every value in it is made up.

Where it maps

• NIS2, Directive (EU) 2022/2555: Article 20 (the management body) and Article 21(1). NIST CSF 2.0: GV.RR-01.
• UK NCSC, Cyber Governance Code of Practice and Cyber Security Toolkit for Boards, and the ENISA European Cybersecurity Skills Framework, as their publishers state them. Both are voluntary guidance.
• ISO/IEC 27001:2022: Clause 5.1, Leadership and commitment. By number and title only. ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of NIS2, or that your organisation holds a certificate.