100-Day Security Plan
Sets quick wins, stabilisation actions and strategic decisions for the first hundred days.
Available soon
- Format
- Excel
- Size
- 95 KB
- Length
- 12 sheets
- Version
- 1.1
- Updated
What's inside
What changed
- 1.1
PL-01 names an inherited exception among the sources a plan item may come from, as TR-14 and the workbook's instructions do.
- 1.0
Published.
Preview
The workbook's sheets as you will receive them, with its example rows and the values its formulas calculate. Highlighted [[text]] is for you to replace; rows marked EXAMPLE are for you to delete. Wide sheets scroll sideways. The cover, document control and changelog sheets are in the file.
Instructions
How to use this workbook
| Step | What to do |
|---|---|
| 1 | Before you start. Draft the plan from what discovery found, not before (TR-01). Have the findings of the Inherited Security Programme Discovery Workbook, the interview records of the Stakeholder Interview Guide & Record and the gaps of the Security Function Handover Document to hand. The plan is drafted in week 9 and agreed in writing with the executive sponsor in week 11 (TR-14). A promise outside the organisation follows the plan and never leads it. |
| 2 | Set the start date (day 1), the as-at date, the days that make an item due soon and the most Large items on the Summary sheet. The day, the week, the phase and the latest due date of each category calculate. The EXAMPLE uses 14 Sep 2026 as day 1 and 30 Sep 2026 as the as-at date. Type dates, never formulas. |
| 3 | Add one row for each item on the Plan sheet, with the ten fields in order: Item ID; Category; Action; Because (DS, IR or HD ID); Owner; Effort; Risk band; Due; Decides (Strategic only); Status. Give each item an ID in the form PI-nn. Write the action in one sentence that a reader outside security can follow. |
| 4 | Choose the category. A Quick win is due by day 30, and its effort may be S; A Stabilisation is due by day 70, and its effort may be S, M; A Strategic decision is due by day 100, and its effort may be S, M, L (PL-02). The workbook shows the latest due date of the category beside each item. Choose an owner, an effort and a due date (PL-03). |
| 5 | Say what each item comes from (PL-01). Enter the ID of the discovery item (DS-nn-n), the interview record (IR-nn), the handover gap (HD-nn) or the inherited exception (IE-n). The workbook checks the form of the ID. It cannot see the other documents, so check that the record is there. An item with no source is not in the plan. |
| 6 | For a Strategic decision, name who decides (PL-04). Take the person from the Transition Decision Rights Matrix and from the packs that set the right. The plan records no decision that the new leader may not take. The optional column "Decision type" names the row of the matrix. |
| 7 | Enter the band of the risk the item answers, as the risk register states it. Leave it blank where the item answers no rated risk. The plan order puts the items with no band last (PL-06). Read the order on the Plan in Order sheet. |
| 8 | Keep the status current: Not started, In progress, Done, Dropped. Enter the date in "Done on" when an item is done. An item dropped, or moved past day 100, is set to Dropped on the Plan sheet and listed with its reason on the Dropped and Moved sheet (PL-07). Work due after day 100 goes to the First-Year Security Operating Calendar. |
| 9 | Review the plan at day 30, day 60 and day 90 (PL-08, TR-15). On the Reviews sheet, enter the date held and type the counts from the Summary sheet as they stand that day, and what changed and why. The counts are a snapshot: they do not change afterwards. |
| 10 | Report counts with the names beside them, such as "1 item is overdue: PI-02", and no score or share (PL-08). The Summary sheet gives the counts and the sentences. Report the items due after the as-at date too, so that the executives see what is coming. |
| 11 | Keep the plan for 3 years, the records period, or longer where a contract or a law asks (TR-16). To clear the EXAMPLE, delete the EXAMPLE rows on the data sheets once your own are entered. The formulas stay. |
Legend
Yellow cells are inputs. Everything else is calculated or fixed — do not overwrite formulas.
| EXAMPLE | Rows marked EXAMPLE in the first column show how a completed row looks. Delete them before approval. |
Limitations: This document helps a new head of security, and the one who is leaving, to hand over and take over a security function. It is not legal advice and not advice on employment. It does not say that you comply with NIS2 or any standard. What liability means for a member of a management body, what an outgoing leader may be asked to hand over under their contract, and whether your organisation is an essential or an important entity are for counsel to confirm.
This pack does not say which document, record or practice meets a requirement of NIS2. Each reference says what its source asks of the management body or the organisation and which CISO Times document helps with that work. Using a document does not by itself show that a requirement is met.
The idea of the pack: Learn before you promise. Find out what is real, not what is claimed. Decide who decides. Show the starting position, so that progress can be shown.
The plan records and chases. It changes no decision right: the rights are those of the earlier packs that set them, and the Transition Decision Rights Matrix shows how the new leader holds each one in the first 90 days. It states no incident or reporting clock.
The checks read the cells as typed. A date typed as text, a status that is not on the list or an ID in another form is a finding or is ignored. Dates are entered as dates.
EXAMPLE: Kestrel Components B.V. (EXAMPLE), a manufacturer of industrial pumps and valves in an EU Member State, with about 600 staff and two plants. Sam Okafor, its new Head of Information Security, started on 14 Sep 2026. As at 30 Sep 2026, day 17 and week 3, the draft plan has 14 items: 2 of 14 items done; 3 in progress, 9 not started, 1 overdue, 2 due within 14 days. 2 of the 3 items due by then were done by their due date, and the two Done items each carry a done date. The checks find no problem. The EXAMPLE organisation is not the distributor of the earlier packs.
Adapting this template:
• Small organisation: keep the ten plan fields and the three categories. One person may own every item, and the executive sponsor may decide every strategic decision. A plan of eight good items that trace to findings is better than one of forty. Three Large items is the most the plan holds (PL-05).
• Regulated organisation: add columns to the right of the calculated ones for what your regulator or a customer's contract asks you to record, such as the clause an item answers. Do not insert columns between the fields, because the checks read them by position. NIS2 Article 20 asks the management body to approve and oversee the measures, so agree the plan with the sponsor in writing and show it to the management body.
• Service provider or outsourced IT: if a managed service provider runs part of the programme, give each of its items an owner in your organisation. The provider's own plan is a source for items, not a substitute for them.
• Replace the [[placeholders]] and the EXAMPLE rows with your own values. Keep the formulas.
• The days that make an item due soon and the most Large items are house defaults of the pack. Change them on the Summary sheet if your own practice differs.
• Rows are limited to the number the formulas cover. To add rows, copy a whole blank row (every column) to the bottom of the table.
This workbook is your own record. Keep a copy that can be reached when the main systems are down.
Summary
Settings, categories, counts and check totals
Set the yellow cells, then read the counts and the check totals. Each count is a number with the others named: no score and no percentage.
Settings
| Start date: day 1, the new leader's first day | 14 Sep 2026 | The latest due dates count from here. EXAMPLE: 14 Sep 2026. Type a date, never a formula. |
| As-at date: the date the plan is read at | 30 Sep 2026 | Open items are tested at this date. EXAMPLE: 30 Sep 2026. Use today's date, or type =TODAY(). |
| Days that make an item due soon | 14 | A house default of the pack (the plan's counts of items due soon). Change it to your own practice. |
| Most Large items the plan holds (PL-05) | 3 | A house default of the pack. Split a Large item, or let it wait for the next plan. |
Where the plan stands in the 90 days
| Measure | Value | |
|---|---|---|
| Day of the plan (day 1 is the start date) | 17 | |
| Week (1 to 13) | 3 | |
| Phase | Listen | |
The four phases of the 90 days
| Phase | From week | To week | What it is for | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Listen | 1 | 3 | Meet people, read what exists, and promise nothing. Learn who expects what. | ||||||
| Verify | 4 | 7 | Check what you were told against a record, a test or a system. End with the first executive briefing. | ||||||
| Decide | 8 | 10 | Choose the few priorities the findings support, agree the decision rights, and settle the plan. | ||||||
| Propose | 11 | 13 | Take the plan, the reporting rhythm and the asks to the executives and the management body. | ||||||
The three categories, with the latest due date of each
| Category | Latest due day | Latest due date (calc) | Efforts allowed | Items | Not started | In progress | Done | Dropped | Overdue |
|---|---|---|---|---|---|---|---|---|---|
| Quick win | 30 | 13 Oct 2026 | S | 5 | 1 | 2 | 2 | 0 | 1 |
| Stabilisation | 70 | 22 Nov 2026 | S, M | 5 | 4 | 1 | 0 | 0 | 0 |
| Strategic decision | 100 | 22 Dec 2026 | S, M, L | 4 | 4 | 0 | 0 | 0 | 0 |
Counts for the report
| Count | Number |
|---|---|
| Items in the plan (all rows) | 14 |
| Items not dropped | 14 |
| Items with status Not started | 9 |
| Items with status In progress | 3 |
| Items with status Done | 2 |
| Items with status Dropped | 0 |
| Items overdue: open, with a due date before the as-at date | 1 |
| Items due within the days set above | 2 |
| Large items that are not dropped (PL-05) | 2 |
| Items that come from: discovery item (DS) | 6 |
| Items that come from: interview record (IR) | 4 |
| Items that come from: handover gap (HD) | 3 |
| Items that come from: inherited exception (IE) | 1 |
| Items due on or before the as-at date, not dropped (TM-05) | 3 |
| Of those, Done on or before their due date (TM-05) | 2 |
| Done items with no done date: TM-05 cannot count them | 0 |
| Dropped items not listed on the Dropped and Moved sheet (PC-10) | 0 |
| Entries on the Dropped and Moved sheet | 0 |
| Rows with at least one check finding (all data sheets) | 0 |
| Check findings in all (PC-01 to PC-11) | 0 |
Check totals PC-01 to PC-11
| Check and what it looks at | Findings | Result | Where it reads | ||||||
|---|---|---|---|---|---|---|---|---|---|
| PC-01 (Plan sheet): Every item has an ID in the form PI-nn, and no two items share one. | 0 | No finding | Item ID. Duplicates are counted from the second item with the same ID. | ||||||
| PC-02 (Plan sheet): The category and the status are each one of the values on the Lists sheet (PL-02, PL-03). | 0 | No finding | Category and Status, against the Lists sheet. | ||||||
| PC-03 (Plan sheet): Every item says what it comes from: a discovery item (DS), an interview record (IR), a handover gap (HD) or an inherited exception (IE). An item with no source is not in the plan (PL-01). | 0 | No finding | Because. The check reads the form of the ID. It cannot see the other workbooks, so confirm the record exists there. | ||||||
| PC-04 (Plan sheet): Every item has an owner and a due date (PL-03). | 0 | No finding | Owner and Due. | ||||||
| PC-05 (Plan sheet): The effort is Small, Medium or Large, and the category allows it. A Quick win is Small (PL-02, PL-03). | 0 | No finding | Effort and Category, against the effort each category allows on this sheet. | ||||||
| PC-06 (Plan sheet): The due date is not before the start date and not after the latest day the category allows (PL-02). | 0 | No finding | Due, against the start date and the latest due date of the category. | ||||||
| PC-07 (Plan sheet): A Strategic decision names who decides (PL-04). | 0 | No finding | Decides, for each Strategic decision, against the Lists sheet. | ||||||
| PC-08 (Plan sheet): The risk band is blank, or one of Critical, High, Medium and Low. | 0 | No finding | Risk band. | ||||||
| PC-09 (Summary sheet): The plan holds no more Large items than the maximum on this sheet. A dropped item does not count (PL-05). | 0 | No finding | The Large items that are not dropped, against the maximum above. | ||||||
| PC-10 (Summary sheet): Every item that is Dropped on the Plan sheet is listed on the Dropped and Moved sheet (PL-07). | 0 | No finding | Status on the Plan sheet, against the item IDs on the Dropped and Moved sheet. | ||||||
| PC-11 (Dropped and Moved sheet): Every entry on the Dropped and Moved sheet is a Dropped item on the Plan sheet, says how it left the plan and gives a reason (PL-07). | 0 | No finding | Item ID, What happened and Reason on the Dropped and Moved sheet, against the Plan sheet. | ||||||
A check counts the findings it makes, which can be more than one on a sheet. The Result column of each data sheet names the checks that fail on a row.
In words (for the report)
Day 17, week 3, Listen phase.
2 of 14 items done; 3 in progress, 9 not started, 1 overdue, 2 due within 14 days
Overdue: PI-02. Due within 14 days: PI-04, PI-05.
2 Large items in the plan, against a most of 3 (PL-05).
2 of 3 items due by the as-at date were done by their due date (TM-05); 0 Done items have no done date.
No plan check has a finding.
TM-05 is plan items done by their due date: Plan items done on or before their due date, out of the items due in the period.
Plan
EXAMPLE: 14 items as at 30 Sep 2026. One row for each item. Yellow columns are inputs; white columns calculate. Order the plan on the Plan in Order sheet, not by sorting this one.
| Example | Item ID | Category | Action | Because (DS, IR or HD ID) | Owner | Effort | Risk band | Due | Decides (Strategic only) | Status | Done on (working column) | Decision type in the Decision Rights Matrix (working column) | Note (working column) | Row in use (calc) | Latest due date for the category (calc) | Due day (calc) | Comes from (calc) | Open item (calc) | Overdue (calc) | Due soon (calc) | State (calc) | Order key (working) | Place in the plan order (calc) | PC-01 findings (calc) | PC-02 findings (calc) | PC-03 findings (calc) | PC-04 findings (calc) | PC-05 findings (calc) | PC-06 findings (calc) | PC-07 findings (calc) | PC-08 findings (calc) | Check findings on this row (calc) | Result (calc) | Running list of overdue items (calc) | Running list of items due soon (calc) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| EXAMPLE | PI-01 | Quick win | Disable the 11 leaver accounts found active and confirm against a new extract. | DS-04-1 | Head of IT | S | High | 25 Sep 2026 | Done | 24 Sep 2026 | 1 | 13 Oct 2026 | 12 | Discovery item | Done | 12146290 | 1 | No finding | |||||||||||||||||
| EXAMPLE | PI-02 | Quick win | Review the two inherited exceptions and renew, change or close each. | IE-1 | New security leader | S | High | 28 Sep 2026 | In progress | 1 | 13 Oct 2026 | 15 | Inherited exception | 1 | 1 | Overdue | 12146293 | 2 | No finding | , PI-02 | |||||||||||||||
| EXAMPLE | PI-03 | Quick win | Name the deputies for the incident manager and the executive incident lead, in writing. | HD-05 | New security leader | S | Medium | 30 Sep 2026 | Done | 30 Sep 2026 | 1 | 13 Oct 2026 | 17 | Handover gap | Done | 13146295 | 3 | No finding | , PI-02 | ||||||||||||||||
| EXAMPLE | PI-04 | Quick win | Build the list of commitments to regulators, customers and auditors. | HD-06 | General counsel | S | Medium | 9 Oct 2026 | In progress | 1 | 13 Oct 2026 | 26 | Handover gap | 1 | 1 | Due soon | 13146304 | 4 | No finding | , PI-02 | , PI-04 | ||||||||||||||
| EXAMPLE | PI-05 | Quick win | Confirm the regulator, CSIRT, insurer and responder contacts by a call. | HD-08 | New security leader | S | Low | 13 Oct 2026 | Not started | 1 | 13 Oct 2026 | 30 | Handover gap | 1 | 1 | Due soon | 14146308 | 5 | No finding | , PI-02 | , PI-04, PI-05 | ||||||||||||||
| EXAMPLE | PI-06 | Stabilisation | Close incident INC-2026-041 and hold its post-incident review. | DS-06-2 | New security leader | S | High | 16 Oct 2026 | In progress | 1 | 22 Nov 2026 | 33 | Discovery item | 1 | Open | 22146311 | 6 | No finding | , PI-02 | , PI-04, PI-05 | |||||||||||||||
| EXAMPLE | PI-07 | Stabilisation | Draft a risk appetite statement for the executives to approve. | DS-02-2 | New security leader | M | Medium | 13 Nov 2026 | Not started | 1 | 22 Nov 2026 | 61 | Discovery item | 1 | Open | 23246339 | 8 | No finding | , PI-02 | , PI-04, PI-05 | |||||||||||||||
| EXAMPLE | PI-08 | Stabilisation | Run one restore test of the order-entry system and keep the record. | DS-08-1 | Head of IT | M | High | 20 Nov 2026 | Not started | 1 | 22 Nov 2026 | 68 | Discovery item | 1 | Open | 22246346 | 7 | No finding | , PI-02 | , PI-04, PI-05 | |||||||||||||||
| EXAMPLE | PI-09 | Stabilisation | Reassess the critical suppliers with no assessment in the last 12 months. | DS-07-2 | New security leader | M | Medium | 20 Nov 2026 | Not started | 1 | 22 Nov 2026 | 68 | Discovery item | 1 | Open | 23246346 | 9 | No finding | , PI-02 | , PI-04, PI-05 | |||||||||||||||
| EXAMPLE | PI-10 | Stabilisation | Close or re-date the three audit findings that are past due. | IR-08 | Internal audit lead | M | Medium | 20 Nov 2026 | Not started | 1 | 22 Nov 2026 | 68 | Interview record | 1 | Open | 23246346 | 10 | No finding | , PI-02 | , PI-04, PI-05 | |||||||||||||||
| EXAMPLE | PI-11 | Strategic decision | Decide whether to have an independent maturity assessment. | DS-01-2 | Executive sponsor | M | 11 Dec 2026 | Executive sponsor | Not started | 1 | 22 Dec 2026 | 89 | Discovery item | 1 | Open | 35246367 | 13 | No finding | , PI-02 | , PI-04, PI-05 | |||||||||||||||
| EXAMPLE | PI-12 | Strategic decision | Decide the shape of the security team and the one post to fill. | IR-09 | Executive sponsor | L | 18 Dec 2026 | Executive sponsor | Not started | 1 | 22 Dec 2026 | 96 | Interview record | 1 | Open | 35346374 | 14 | No finding | , PI-02 | , PI-04, PI-05 | |||||||||||||||
| EXAMPLE | PI-13 | Strategic decision | Decide to replace, isolate or accept the two legacy systems that cannot take multi-factor sign-in. | IR-03 | Executive sponsor | L | High | 18 Dec 2026 | Executive sponsor | Not started | 1 | 22 Dec 2026 | 96 | Interview record | 1 | Open | 32346374 | 11 | No finding | , PI-02 | , PI-04, PI-05 | ||||||||||||||
| EXAMPLE | PI-14 | Strategic decision | Agree the first-year calendar and the reporting rhythm with the management body. | IR-02 | New security leader | S | 18 Dec 2026 | Executive sponsor | Not started | 1 | 22 Dec 2026 | 96 | Interview record | 1 | Open | 35146374 | 12 | No finding | , PI-02 | , PI-04, PI-05 |
Plan in Order
The plan in the order of PL-06: by category, then by the band of the risk it answers (Critical first, no band last), then by smaller effort, then by earlier due date. Every cell calculates from the Plan sheet. An item whose category or due date is missing is not shown.
| Place (calc) | Plan row (working) | Item ID | Category | Action | Because | Owner | Effort | Risk band | Due | Decides (Strategic only) | Status | State |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | 1 | PI-01 | Quick win | Disable the 11 leaver accounts found active and confirm against a new extract. | DS-04-1 | Head of IT | S | High | 25 Sep 2026 | Done | Done | |
| 2 | 2 | PI-02 | Quick win | Review the two inherited exceptions and renew, change or close each. | IE-1 | New security leader | S | High | 28 Sep 2026 | In progress | Overdue | |
| 3 | 3 | PI-03 | Quick win | Name the deputies for the incident manager and the executive incident lead, in writing. | HD-05 | New security leader | S | Medium | 30 Sep 2026 | Done | Done | |
| 4 | 4 | PI-04 | Quick win | Build the list of commitments to regulators, customers and auditors. | HD-06 | General counsel | S | Medium | 9 Oct 2026 | In progress | Due soon | |
| 5 | 5 | PI-05 | Quick win | Confirm the regulator, CSIRT, insurer and responder contacts by a call. | HD-08 | New security leader | S | Low | 13 Oct 2026 | Not started | Due soon | |
| 6 | 6 | PI-06 | Stabilisation | Close incident INC-2026-041 and hold its post-incident review. | DS-06-2 | New security leader | S | High | 16 Oct 2026 | In progress | Open | |
| 7 | 8 | PI-08 | Stabilisation | Run one restore test of the order-entry system and keep the record. | DS-08-1 | Head of IT | M | High | 20 Nov 2026 | Not started | Open | |
| 8 | 7 | PI-07 | Stabilisation | Draft a risk appetite statement for the executives to approve. | DS-02-2 | New security leader | M | Medium | 13 Nov 2026 | Not started | Open | |
| 9 | 9 | PI-09 | Stabilisation | Reassess the critical suppliers with no assessment in the last 12 months. | DS-07-2 | New security leader | M | Medium | 20 Nov 2026 | Not started | Open | |
| 10 | 10 | PI-10 | Stabilisation | Close or re-date the three audit findings that are past due. | IR-08 | Internal audit lead | M | Medium | 20 Nov 2026 | Not started | Open | |
| 11 | 13 | PI-13 | Strategic decision | Decide to replace, isolate or accept the two legacy systems that cannot take multi-factor sign-in. | IR-03 | Executive sponsor | L | High | 18 Dec 2026 | Executive sponsor | Not started | Open |
| 12 | 14 | PI-14 | Strategic decision | Agree the first-year calendar and the reporting rhythm with the management body. | IR-02 | New security leader | S | 18 Dec 2026 | Executive sponsor | Not started | Open | |
| 13 | 11 | PI-11 | Strategic decision | Decide whether to have an independent maturity assessment. | DS-01-2 | Executive sponsor | M | 11 Dec 2026 | Executive sponsor | Not started | Open | |
| 14 | 12 | PI-12 | Strategic decision | Decide the shape of the security team and the one post to fill. | IR-09 | Executive sponsor | L | 18 Dec 2026 | Executive sponsor | Not started | Open |
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
Dropped and Moved
EXAMPLE: no item has been dropped or moved as at 30 Sep 2026. List every item dropped, or moved past day 100, with the reason (PL-07). The item stays on the Plan sheet with the status Dropped.
| Example | Item ID | What happened | Reason | Decided by (a name and role) | Decided on | Where the work goes now: a calendar item, a later plan or nowhere | Row in use (calc) | Status on the Plan sheet (calc) | PC-11 findings (calc) | Result (calc) |
|---|
Reviews
Review the plan at day 30, day 60 and day 90 (PL-08, TR-15). On the day, type the counts from the Summary sheet, so that the review keeps what the plan said then. Nothing is entered in the EXAMPLE: as at 30 Sep 2026 no review is due.
| Review | Day | Date (calc) | State (calc) | Held on | Checklist and findings reviewed too? | Items done | In progress | Not started | Dropped | Overdue | Due soon | What changed since the last review, and why |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Day 30 review | 30 | 13 Oct 2026 | Not yet due | |||||||||
| Day 60 review | 60 | 12 Nov 2026 | Not yet due | |||||||||
| Day 90 review | 90 | 12 Dec 2026 | Not yet due |
Lists
| ListCategory | ListStatus | ListEffort | ListBand | ListDecides | ListDecisionType | ListHappened | ListYesNo |
|---|---|---|---|---|---|---|---|
| Quick win | Not started | S | Critical | Executive sponsor | DE-01 Policy | Dropped | Yes |
| Stabilisation | In progress | M | High | Management body | DE-02 Exception | Moved past day 100 | No |
| Strategic decision | Done | L | Medium | New security leader | DE-03 Risk acceptance | ||
| Dropped | Low | Legal | DE-04 Incident decision | ||||
| HR | DE-05 Supplier | ||||||
| Head of IT | DE-06 Spend | ||||||
| Data Protection Officer | DE-07 Hiring |
DE-08 Regulator contact
Definitions
Definitions
| Term | Meaning in this workbook |
|---|---|
| Quick win | A small action that the discovery shows is needed, can be done in a few days and carries little risk. It is due within the first 30 days. |
| No-regret action | An action that is needed whatever the plan turns out to be, such as removing the leaver's access. It may be done before discovery ends. |
| Stabilisation | Closes a gap the findings show, so that what the programme says it does, it does. Due by day 70. |
| Strategic decision | A decision that sets the direction of the next year, taken by the person the decision rights name. Due by day 100. |
| Inherited | Held, accepted or promised before the new leader started: an exception, a risk acceptance, a contract, a commitment to a customer or a regulator, or an open incident. |
| Decision right | The power to take a kind of decision. Earlier packs give each right to a named role. The transition arrangement never gives a right that those packs do not give. |
| Transition arrangement | What the new leader does with a decision right in the first 30, 60 and 90 days: Owns it, Shares it, or Escalates it. It is agreed in writing with the executive sponsor. |
| Executive sponsor | The executive the new leader reports to, who agrees the arrangement and the plan, and who speaks for the leader to the management body. |
| Management body | The board, or the equivalent, that NIS2 Article 20 says approves the cybersecurity risk-management measures and oversees their implementation. |
| Effort | S, Small: [[up to 5]] person-days; M, Medium: [[6 to 20]] person-days; L, Large: [[21 to 60]] person-days |
| Because | The source of an item: a discovery item (DS), an interview record (IR), a handover gap (HD) or an inherited exception (IE). |
| Overdue | An open item, Not started or In progress, whose due date is before the as-at date. A Done or Dropped item is never overdue. |
| Due soon | An open item whose due date falls from the as-at date to the as-at date plus the days set on the Summary sheet. |
| Day of the plan | Day 1 is the start date. The first 90 days are 13 weeks of 7 days, and the plan runs to day 100. |
| (calc) | A column or cell the workbook calculates. Do not type or paste over it. |
| PL-nn, TR-nn, PC-nn, TM-05 | Rules of the plan, rules of the pack's checklist, checks of this workbook and a headline measure. The First 90 Days Security Leader Checklist and the First Executive Briefing Deck for a New Security Leader use the same IDs. |
| EXAMPLE | A worked example: Kestrel as at 30 Sep 2026. Every name and value is made up. Delete before use. |
The ten plan fields and the columns that hold them
| Field | What to enter |
|---|---|
| Item ID | The plan's own number, in the form PI-nn. |
| Category | Quick win, Stabilisation or Strategic decision. The category sets the latest due day and the effort it may carry (PL-02). |
| Action | What will be done, in one sentence that a reader outside security can follow. |
| Because (DS, IR or HD ID) | The discovery item, interview record, handover gap or inherited exception the item comes from (PL-01). An inherited exception takes an IE ID, as the EXAMPLE shows. |
| Owner | One owner, by role. For a Strategic decision the owner prepares it and the person in the next column decides. |
| Effort | S, M or L: Small, Medium or Large, as the maturity pack sets them (PL-03). A Quick win is Small. |
| Risk band | The band of the risk the item answers, as the risk register states it. Leave it blank where the item answers no rated risk. Unrated items come last (PL-06). |
| Due | The date the item is due. It is never after the latest date of its category. |
| Decides (Strategic only) | Only for a Strategic decision: who decides, under the Transition Decision Rights Matrix and the packs that set the right (PL-04). |
| Status | Not started, In progress, Done or Dropped. |
The working columns
| Column | What it is for |
|---|---|
| Done on | The date an item was finished. The Summary sheet uses it to count the items done by their due date. It is not a field of the pack. |
| Decision type (A06 row) | Optional. The decision type in the Transition Decision Rights Matrix that a Strategic decision falls under, so that the matrix and the plan name the same decider. |
| Note | A line on why an item is where it is. It is not a field of the pack. |
| Calculated columns (calc) | The latest due date of the category, the due day, what the item comes from, whether it is overdue or due soon, its place in the order, the eight checks and a running list of names. Do not type or paste over them. |
The rules of the plan
| Rule | What it sets |
|---|---|
| PL-01 | Every item says what it comes from: a discovery item (DS), an interview record (IR), a handover gap (HD) or an inherited exception (IE). An item with no source is not in the plan. |
| PL-02 | Every item is a Quick win, a Stabilisation item or a Strategic decision. The category sets the latest due day (30, 70 or 100, counted from the start) and the effort it may carry. |
| PL-03 | Every item has an owner, an effort (Small, Medium or Large, as P19 sets them), a due date and a status. A Quick win is Small. |
| PL-04 | A Strategic decision names who decides, under the arrangement in A06 and the packs that set the right. The plan records no decision the new leader may not take. |
| PL-05 | The plan holds no more than [[3]] Large items. A Large item is split, or waits for the next plan. |
| PL-06 | Order the plan by category, then by the band of the risk it answers (Critical first, unrated last), then by smaller effort, then by earlier due date. |
| PL-07 | List every item dropped or moved past day 100, with the reason. Work due after day 100 goes to the calendar (A08). Keep the plan for [[3]] years (TR-16). |
| PL-08 | Report the plan as counts: items done, in progress, not started, dropped, overdue and due soon. Review it at day 30, day 60 and day 90 (TR-15). |
Rules of the checklist that the plan carries out
| Rule | What it sets |
|---|---|
| TR-01 | Change no policy, tool, team structure or priority until discovery ends at the close of week 7, except to stop harm, to act on a legal duty or to take a no-regret action. Spend the first three weeks listening. |
| TR-04 | Promise nothing until it is checked. A commitment is recorded as Committed only after the new leader has checked that it can be kept, and says how. Anything else is recorded as Noted, not committed, or Declined, with the reason. |
| TR-14 | Every item in the 100-day plan traces to a finding, an interview record, a handover gap or an inherited exception. The plan lists what was dropped and why. A promise outside the organisation follows the plan, and never leads it. |
| TR-15 | Review this checklist, the discovery findings and the plan at day 30, day 60 and day 90, and the baseline and the calendar at the first anniversary. Record what changed and why. |
| TR-16 | Keep the handover document, the interview records, the decision-rights arrangement and the plan for [[3]] years, the P22 records period, or longer where a contract or a law asks. |
What each item comes from
| Prefix | Kind of source |
|---|---|
| DS- | Discovery item |
| IR- | Interview record |
| HD- | Handover gap |
| IE- | Inherited exception |
Framework References
Framework references
These references indicate relevance only and do not reproduce the text of any standard.
| Framework | Reference | Supported by |
|---|---|---|
| ISO/IEC 27001:2022 | Clause 6.2 — Information security objectives and planning to achieve them | Plan sheet: the plan sets out what will be done, by whom, how large each task is, by when and with what status. These are the matters a plan to achieve objectives is about |
| NIST CSF 2.0 | GV.RM-01 — “Risk management objectives are established and agreed to by organizational stakeholders” | Plan and Summary sheets: the plan records the priorities the findings support, each with an owner, and is agreed in writing with the executive sponsor |
| NIS2 — Directive (EU) 2022/2555 | Article 21(1) — essential and important entities take “appropriate and proportionate technical, operational and organisational measures to manage the risks posed to the security of network and information systems”, and “to prevent or minimise the impact of incidents on recipients of their services and on other services” | Plan sheet: an entity takes measures that are appropriate and proportionate to the risks it faces. The plan ties each item to a finding and, where there is one, to a risk band, so that the work follows what discovery showed. The Article binds the entity and says nothing about a plan |
| NIS2 — Directive (EU) 2022/2555 | Article 21(2)(f) — “policies and procedures to assess the effectiveness of cybersecurity risk-management measures” | Reviews and Summary sheets: the plan is reviewed at day 30, day 60 and day 90, and reports counts of items done, overdue and due soon. That helps the new leader see whether the work is carried out. The Article asks for policies and procedures to assess the effectiveness of the measures themselves, which is wider than this plan |
Editions referenced: Directive (EU) 2022/2555 (NIS2); NIST CSF 2.0; ISO/IEC 27001:2022 incl. Amd 1:2024 (by number and title only); UK NCSC board guidance and the ENISA skills framework, as their publishers state them; as published and read on 10 October 2026
ISO/IEC 27001 references name the clause or control this document relates to, by number and title only. No text of the standard is reproduced. A reference does not say that meeting a clause or control meets any requirement of NIS2, or that your organisation holds a certificate.
These references show where this document supports an external framework. They indicate relevance only and do not reproduce the text of any standard.
Directive (EU) 2022/2555 is addressed to the Member States, and binds essential and important entities through their national law. Article 20 asks the Member States to ensure that the management body approves the cybersecurity risk-management measures, oversees their implementation, can be held liable for infringements of Article 21, and is required to follow training. What liability means for a member of a management body depends on national law, and counsel confirms it. Whether your organisation is an essential or an important entity comes from its scope assessment and from counsel, and this pack does not decide it.