For a security leader who has inherited a programme. Enter your first day in the role to see where you are in the first 90 days and what that phase is for. Below are the 20 things to find out, with what counts as proof. Free, no account, and nothing is stored.
Your first day in the role. It is day 1, and week 1 runs for seven days from it.
Today, unless you are planning ahead.
Where you are in the first 90 days
Enter your first day in the role, and the day, week and phase appear here, with what the phase is for.
Record your findings in the workbook, not here. This page has no place for what you find and keeps nothing you enter. The Inherited Security Programme Discovery Workbookholds each finding with what you saw and when.
The four phases
Phase
Weeks
What it is for
Listen
1 to 3
Meet people, read what exists, and promise nothing. Learn who expects what.
Verify
4 to 7
Check what you were told against a record, a test or a system. End with the first executive briefing.
Decide
8 to 10
Choose the few priorities the findings support, agree the decision rights, and settle the plan.
Propose
11 to 13
Take the plan, the reporting rhythm and the asks to the executives and the management body.
What to find out, by area
10 areas, two items each. Ask for one kind of proof for each item. A statement is never proof. A Record is a document or a file you read. A Test is something you do or check yourself, on a sample. A System view is what the system shows you, on screen, with its dates.
DS-01 Governance
DS-01-1 Who is accountable for security, and what authority do they hold in writing?
DS-01-2 Has the management body approved the cybersecurity risk-management measures, and is there a minute?
Record
The role description, the appointment letter and the minute of the approval.
Test
Ask two members of the management body to say what they approved.
A record, a test result or a system view that you saw matches what you were told or what the document says.
Described only
You were told, or a document claims it, and you have seen nothing that shows it is done.
Not found
You asked for it, by a date, and nothing was produced and nothing could be found.
Contradicted
What you saw differs from what you were told or what the document says.
How this works, and what it is not
Your start date is day 1, and week 1 runs for seven days from it. Weeks run from 1 to13; a day before the start, or after week 13, has no phase. Discovery ends at the close of week 7. This is the workbook's own arithmetic.
Rules the workbook applies
TR-01. Change no policy, tool, team structure or priority until discovery ends at the close of week 7, except to stop harm, to act on a legal duty or to take a no-regret action. Spend the first three weeks listening.
TR-02. Every discovery finding states what was seen: a record, a test result or a system view. A statement alone is Described only. A finding is checked again after 6 months, or on a material change.
TR-14. Every item in the 100-day plan traces to a finding, an interview record, a handover gap or an inherited exception. The plan lists what was dropped and why. A promise outside the organisation follows the plan, and never leads it.
What it is not
Not a record. It keeps no finding, no note and no date. The workbook counts your findings by word and by area, and shows which are due for a second look.
Not a score. Findings are counted, never added up into a score or a share.
Not the whole list. The twenty items are a floor. Add your own for what the interviews raise.