In your first 90 days as CISO, spend the first month listening and mapping what exists, the second month ranking risks with the people who own them, and the third month committing to a short plan with two or three measurable goals. Resist big announcements until you can show evidence behind them.
Days 1 to 30: listen and inventory
Book short conversations with the CEO, CFO, general counsel, head of engineering, head of IT and your two largest customers if sales will allow it. Ask each one the same three questions. What worries you about security? What has gone wrong before? What would make you say this role was worth hiring?
In parallel, collect what already exists: policies, the last audit report or pentest, the incident log, the asset list, the vendor list and any open findings. Do not judge the quality yet. You are looking for gaps in what is written down versus what people actually do.
Find out who currently owns security decisions in practice. It is rarely the org chart.
Days 31 to 60: rank and agree
Turn the notes into a ranked list of risks. Use plain language, such as "a stolen laptop could expose customer data because disks are not encrypted on contractor machines." Each risk should have an owner outside security and a rough cost to fix.
Pick one visible problem you can fix quickly, such as enforcing multi-factor authentication on the admin accounts or closing a stale set of cloud keys. A fast, boring win earns more trust than a strategy deck.
Check the legal and contractual duties that apply to you. If you are a public company, for example, the SEC rules on cybersecurity disclosure expect a description of how risks are managed and how the board oversees them, so find out who writes that text today.
Days 61 to 90: commit to a plan
Write a one page plan. It should hold three things: the top risks, the two or three goals for the next twelve months, and the resources you need. Share it with the executive team and get a yes or a clear no on each goal.
Pick measures that a non-technical executive can read. Time to fix critical issues, share of admin accounts with strong authentication, and percentage of critical systems with a tested restore are all examples.
Common mistakes
- Buying a tool before you know the problem.
- Rewriting every policy in month one.
- Reporting to the board with numbers nobody trusts.
- Treating engineering as an obstacle instead of the team that fixes things.
Quick check
Should a new CISO change the security stack right away?
Usually not. Understand what the current tools actually cover first. Replace something only when you can name the gap it leaves open.
Who should a new CISO meet first?
The CEO or whoever you report to, then the heads of engineering, IT, legal and finance. They own most of the decisions that security depends on.
Sources
Last reviewed: 19 October 2026.
