What should a new CISO deliver in the first 90 days?

Four things, and none of them is a new tool. An honest assessment of where the organisation actually stands, in writing, including the things the last leader didn't say. The three risks that matter most, in business terms, with a rough cost of each. A plan to address them with dates and owners, sized to what the organisation will actually fund. And a working incident process: named decision-makers, tested at least once on paper. If a new CISO hands you a vendor shortlist in month two, something's wrong. If they hand you a page you could read to the board, with uncomfortable parts, they're doing the job.

Why 90 days is about understanding, not fixing

A new security leader doesn't know the organisation. They don't know which systems are fragile, which executives will cooperate, which findings have been raised and ignored for years, or where the bodies are. Anything they fix in the first quarter is a guess. The value of the first ninety days is the picture they build and the trust they establish, and both take walking around and listening. The leaders who skip that and announce a transformation programme in week three are usually gone by month eighteen.

What to expect, month by month

Month one: listen and inventory. Conversations with every executive about what they fear and what they've been told. The team: who does what, what's working, what's held together by one person. The current state against a recognised baseline. NIST's framework is built for this: describe the current profile honestly, decide the target profile with leadership, and the gap between them is the plan (Pascoe et al., 2024). CISA's performance goals are a shorter, prioritised list that gives a fast first read on whether the basics are in place (Cybersecurity and Infrastructure Security Agency, 2025).

Month two: risk and decisions. The top risks, estimated with a consistent method and expressed in terms the business recognises (Joint Task Force Transformation Initiative, 2012). The existing risk acceptances and exceptions, with a view on which are still defensible. The incident process: who can decide what, tested in a short tabletop with executives in the room. The budget: where it's going and whether it maps to the risks.

Month three: the plan and the board. A plan with a small number of priorities, dates, owners, and a cost, and a clear statement of what's being accepted because it won't be funded. A first board or committee briefing that gives directors something to decide, not something to admire (I've written about what that should contain in Your Board Needs a Decision). And the first "what I need from you" conversation with the CEO.

How to judge what you get

The assessment should contain things you didn't want to hear. If it doesn't, either the organisation is in unusually good shape or the new leader is managing you. The risks should be specific enough that you could argue with them. The plan should be short, and it should say what it's not doing. The incident process should have names in it. And across all four, the test is whether the CISO has made a judgement and signed it, rather than presenting options and waiting for you to choose. NACD's guidance for directors asks boards to guide how cyber risk is measured and reported; the new CISO's first deliverables are where that measurement gets set, and it's fair for the board to expect them to be legible (National Association of Corporate Directors & Internet Security Alliance, 2026).

What the organisation owes the new CISO

Access to the board without a filter. A clear answer on authority: what they can stop, what they can spend, who they escalate to. An honest briefing on the history, including the incidents that weren't reported upward. And patience with the fact that the first quarter produces a picture, not a result. Most CISO failures I read about are mutual: a leader who promised too much and an organisation that hired a title and starved it.

The red flags in the first 90 days

A tool purchase before the assessment. A reorganisation of the team before understanding it. A board deck full of maturity scores and no decisions. A plan with twenty priorities. No tabletop, no conversation with the CFO, no visit to the people who run the systems. Any of these means the leader is performing the role rather than doing it.

What I'd do next

If you've just hired, send your new CISO this page and agree the four deliverables with dates. If you're about to hire, write the four into the job description so candidates know what success looks like. If you'd like help setting up the first ninety days, or an independent read on what comes out of them, request a briefing. More on this cluster is in Executive leadership.