- Key Takeaways: The New CISO's First 90 Days
- Before Day One: The Preparation Phase
- Days 1-30: Listen and Diagnose
- Days 31-60: Align and Decide
- Days 61-90: Act and Deliver
- The 90-Day Milestone Summary
- The Early Win: Choosing It Deliberately
- The Onboarding Mistake That Sinks New CISOs
- What the Organization Owes the Transition
- From 90 Days to the Full Tenure
- Frequently Asked Questions
As Global Head of Research & Leadership Advisory at JRG Partners, I wrote this first-90-days roadmap for a new CISO because transitions are where hiring investments are protected or squandered. The structure below, listen and diagnose, align and decide, act and deliver, is the pattern behind the successful transitions we have observed, adapted to this role’s specific terrain.
Key Takeaways: The New CISO’s First 90 Days
- Diagnosis before prescription is the whole method: the first month’s job is an honest picture, and announcements made before it forms usually have to be retracted.
- People decisions are the transition’s hardest and most-watched calls; known problems deferred past day 60 start costing the new leader credibility instead of the old one.
- Catching and containing one real intrusion attempt or closing a long-red audit finding in the first quarter converts skeptics.
- Write the 90-day expectations down at offer stage, what will be assessed, decided, and delivered by when, so the first review has a contract, not a vibe.
- New CISOs who lead with policy and restriction before demonstrating value get routed around; the tenure that starts with ‘no’ ends in shadow IT.
Before Day One: The Preparation Phase
The plan starts before day one. Use the offer-to-start window to read everything shareable, board materials, strategy documents, the last year’s operating reviews, and to agree the mandate in writing with your new manager: the three outcomes year one must produce, the known problems, and the decisions already made that you will inherit. Pre-start conversations with key stakeholders, where appropriate, convert week one from introductions into work.
Days 1-30: Listen and Diagnose
Everything later depends on the quality of this month’s picture. A new CISO should prioritize:
- Establish the honest posture baseline: independent assessment, crown-jewel mapping, and the finding backlog’s reality
- Review the last incidents and near-misses for what they reveal about detection and culture
- Meet the executives and board members as stakeholders; learn their risk language and appetite
- Assess the team, the tooling sprawl, and the MSSP relationships
- Verify the basics quietly: identity, patching, backups, and logging coverage
The discipline is restraint: diagnoses shared as hypotheses invite correction while it is cheap, and the organization notices who listens before deciding.
Days 31-60: Align and Decide
Days 31-60 are for alignment and the decisions that cannot wait:
- Deliver the risk-based assessment: exposures ranked by business impact with the investment case
- Fix the cheapest dangerous gaps immediately; early hygiene wins compound
- Establish incident response readiness: the plan tested, roles assigned, communications drafted
- Reset the reporting rhythm: metrics that inform rather than alarm
Days 61-90: Act and Deliver
Days 61-90 convert agreement into evidence:
- Present the security roadmap to the board in business-risk terms with honest trade-offs
- Run the first tabletop exercise with executives participating
- Install the metrics program: posture, speed, and learning, explicitly not incident absence
- Bank the visible win: an audit finding closed, a real exposure eliminated, a near-miss caught
The 90-Day Milestone Summary
| Phase | Focus | Exit Artifact |
|---|---|---|
| Before day one | Mandate, materials, stakeholder map | Written mandate agreed with the hiring leader |
| Days 1-30 | Listening tour, baseline truth, team assessment | The honest diagnosis, delivered upward |
| Days 31-60 | Direction set, urgent people decisions, operating rhythm designed | The plan agreed, with resources and dates |
| Days 61-90 | Visible execution, first win, scorecard live | The early win delivered; the go-forward KPIs published |
The Early Win: Choosing It Deliberately
Early wins are selected for three properties: visible to the people whose belief you need, meaningful rather than cosmetic, and deliverable inside the window. For a CISO, the pattern that works: Catching and containing one real intrusion attempt or closing a long-red audit finding in the first quarter converts skeptics. The wrong early win, flashy, contested, or hollow, costs more than none.
The Onboarding Mistake That Sinks New CISOs
New CISOs who lead with policy and restriction before demonstrating value get routed around; the tenure that starts with ‘no’ ends in shadow IT. Alongside the universal transition errors, premature judgment, deferred people calls, unexamined mandates, this is the trap this particular seat sets for its new occupants.
What the Organization Owes the Transition
Half of transition failures are organizational, not individual: mandates left vague, landmines undisclosed, stakeholders unintroduced, and instant performance expected. The fix costs little, a written mandate, real introductions, disclosed problems, and calendared alignment checkpoints at 30, 60, and 90 days.
From 90 Days to the Full Tenure
The transition ends where the tenure’s measurement begins. The scorecard that goes live at day 90 should be the same one governing the tenure: our guide to measuring CISO performance defines those KPIs and their cadence. And if the hire is still ahead of you, our CISO interview questions guide tests for exactly the transition skills this roadmap demands.
Frequently Asked Questions
- Q: What should a new CISO accomplish in the first 90 days?
- A: Three artifacts: an honest diagnosis by day 30, a plan agreed with the manager or board by day 60, and by day 90 the first visible win delivered plus the go-forward scorecard live. Volume of activity is not the measure; those three are.
- Q: How long until a new CISO reaches full productivity?
- A: Contribution is immediate, ownership is not: plan for real diagnostic value in month one and full accountability for results somewhere between months four and nine, with the role’s natural feedback-loop length setting the pace.
- Q: What is the right early win for a new CISO?
- A: Catching and containing one real intrusion attempt or closing a long-red audit finding in the first quarter converts skeptics. Choose for visibility, meaning, and deliverability inside the window, and deliver it before the honeymoon’s attention fades.
- Q: How quickly should a new CISO make people changes?
- A: Fast on assessment, deliberate on process, prompt on execution: month one to see clearly, month two to decide the obvious cases, and immediate, respectful action once decided, because the team is watching whether the new leader sees what they see.
- Q: What if the job turns out different from the one described?
- A: Surface it at the next scheduled checkpoint with specifics: what was represented, what the evidence shows, and what mandate adjustment follows. Boards and CEOs respect early recalibration far more than late surprises, and the written mandate makes the conversation factual rather than personal.
- Q: Who owns executive onboarding, HR or the hiring manager?
- A: The hiring manager, unambiguously, with HR building the process and the executive driving their own plan; the fastest way to predict a transition’s outcome is to ask who thinks they own it.
![](https://www.jrgpartners.com/wp-content/uploads/2025/12/tanya-gallardo.jpeg")
Tanya Gallardo
Managing Director, Executive Search & AI Talent Strategy
Tanya Gallardo is the Managing Director of Executive Search & AI Talent Strategy at JRG Partners, leading C-suite and Board engagements across key growth sectors including Technology, Financial Services, and Manufacturing.
With over 18 years of experience specializing in disruptive technology leadership, Tanya is recognized as a leading authority on talent architecture for future-focused executive roles, such as the Chief AI Officer (CAIO) and Chief Digital Officer (CDO). Her expertise lies in accurately assessing the cultural fit and technical depth required to ensure a high return on investment (ROI) for critical leadership appointments.
Prior to her role at JRG Partners, Tanya held senior roles directing global talent acquisition strategies at a major publicly-traded technology firm, advising on organizational design and succession planning for emerging executive functions. She is a recognized speaker and contributor to industry events, sharing data-driven insights on executive compensation, leadership development, and the measurable business impact of C-suite talent.
