The First 90 Days as a CISO: A CISM Holder Playbook

Why the First 90 Days Define Your Tenure

Security leadership transitions are high-stakes in a way most executive roles are not. A new CFO can spend months learning the books before making changes. A new CISO often inherits an active threat landscape, unresolved audit findings, and a team that may have just watched the previous leader fail publicly. The first 90 days set expectations, establish relationships, and -- critically -- surface the gaps that will define your first-year program.

CISM's four domains map cleanly to this period. Domain 1 (Information Security Governance) gives you the framework for assessing the existing governance posture. Domain 2 (Information Risk Management) guides your risk identification sprints. Domain 3 (Information Security Program Development) structures how you start building or rebuilding your program. Domain 4 (Incident Management) tells you what you need to audit and strengthen before something goes wrong under your watch.

The 90-day structure below is not a rigid formula -- it is a prioritization discipline. Adjust the timing based on what you find. If you discover a live ransomware threat in week two, Domain 4 becomes your immediate focus. If the CEO's first ask is a board risk report, you accelerate the governance deliverables from Day 60 to Day 30.

Before Day One: Pre-Boarding Intelligence Gathering

If you have access to pre-boarding materials, treat the period between accepting the offer and your start date as an intelligence-gathering phase. Ask your hiring manager or HR contact to share whatever is publicly available or appropriate for a pre-hire review.

Items worth requesting before day one:

• The most recent external audit report or penetration test -- what third-party assessors said about your future program
• The last board or executive security presentation -- what leadership has been told about risk posture
• Any open regulatory findings -- especially in financial services, healthcare, or federal environments where timelines are non-negotiable
• Your predecessor's exit interview or departure context -- understanding why the role is open tells you a great deal about what you are walking into
• A copy of the current security policy suite -- policy maturity is a fast proxy for program maturity

If you are coming from outside the industry (say, moving from financial services to healthcare), use pre-boarding to quickly orient on relevant compliance frameworks. HIPAA, SOX, PCI-DSS, FedRAMP, and CMMC each have distinct security control requirements that will shape your first-quarter priorities.

Days 1-30: Listen, Map, and Learn

The first month has one primary objective: develop a factual, ground-level understanding of where the organization actually stands -- not where leadership believes it stands, and not where the policies say it should stand.

Week 1: Orientation and Relationship Starts

Focus entirely on introductions and context. Meet your direct team, your IT peers, and the key business unit leaders who interact most with security. Do not make promises, do not surface problems publicly, and do not reorganize anything. Your job this week is to learn names, understand the informal org chart, and begin identifying your allies.

Week 2: Technical Asset and Control Inventory

Ask your team to walk you through the current asset inventory, vulnerability management program, and incident log from the past 12 months. You are not auditing yet -- you are getting a baseline. How mature is the vulnerability management program? What does the incident log tell you about recurring weaknesses? Does the team have documented playbooks or is everything tribal knowledge?

Week 3-4: Policy and Compliance Review

Review the policy library, the last risk register update, and any compliance assessments completed in the past 18 months. Map findings against ISACA's risk management framework from CISM Domain 2. Identify policies that exist only on paper, control gaps with regulatory implications, and findings that have been open longer than 90 days without remediation progress.

By end of day 30, you should have a clear enough picture to brief your manager or the executive team on what you found -- not solutions yet, just an honest assessment of the current state.

Stakeholder Mapping for Security Leaders

CISM Domain 1 is explicit: security governance only works when key stakeholders understand their roles and responsibilities. Stakeholder mapping is not a soft skill -- it is a governance prerequisite. If you do not know who controls the budget, who approves exceptions, and who owns the data that security is protecting, you cannot build a program that works.

A practical stakeholder map for a new CISO covers four categories:

For each stakeholder, document three things: what decisions they control that affect security, what their current understanding of security risk is (usually lower than the actual risk), and what they care about most that security can either enable or threaten. Your future program depends on translating security outcomes into business terms that each stakeholder group actually values.

If you want a deeper look at how this governance mapping connects to the CISM exam, the CISM Domain 1 governance guide covers the accountability frameworks ISACA tests on this topic.

Days 31-60: Quick Wins and Critical Gaps

Month two is when you shift from listening to acting -- carefully. The goal is to demonstrate value and build momentum without overcommitting resources or creating dependencies you cannot sustain.

Identifying the Right Quick Wins

A good quick win has three characteristics: it is visibly valuable, it is achievable within 30 days with existing resources, and it does not create new technical debt or policy exceptions that come back to haunt you. Common examples:

• Patching a small set of critical, externally exposed vulnerabilities that have been deferred
• Formalizing an incident response communication template (contacts, escalation triggers, notification language)
• Closing a policy exception that has been open without review for more than 180 days
• Delivering a concise security risk briefing to the executive team -- often the first time they have received one in plain language
• Running a tabletop exercise on a ransomware scenario with your team and at least one business unit lead

Addressing Critical Gaps

Alongside quick wins, you need to triage the critical gaps you identified in month one. Not everything is equally urgent. Use a simple risk prioritization matrix: likelihood x impact -- the same framework CISM Domain 2 tests extensively.

Gaps that combine high likelihood with high business impact (exposed credentials, unpatched internet-facing systems, no data classification on the most sensitive data stores) require a remediation timeline and an owner assigned within month two. These are not items for a future roadmap -- they are your immediate risk liability.

For a practical look at how security leaders structure day-to-day prioritization beyond the 90-day window, the CISM day-in-the-life guide covers how managers and CISOs allocate time across governance, operations, and stakeholder communication.

Days 61-90: Building Your Governance Roadmap

By month three you have enough context to build something that will outlast your first quarter: a 12-month governance roadmap that translates your findings into a funded, prioritized plan.

Structure of a CISM-Aligned Governance Roadmap

A governance roadmap is not a technical project list. It is a business document that connects security investments to organizational risk reduction. Structure it in three layers:

1. Risk statement -- What is the current risk posture in plain language, and what is the acceptable risk level the organization has declared (or should declare)?
2. Program priorities -- Which domains of the security program (identity, data protection, third-party risk, incident response, compliance) require the most investment in the next 12 months and why?
3. Resource requirements -- What budget, headcount, and executive decisions are needed to execute? Be specific and honest about what happens if resources are not approved.

Getting the Roadmap Approved

Present the roadmap to your executive sponsor and, where appropriate, the board's audit or risk committee. Frame it around business risk, not technology. A CFO does not care that you need a next-generation SIEM -- they care that without better visibility, the organization's mean time to detect a breach remains above 100 days and the regulatory fine exposure is $X million.

The roadmap should also define how you will measure success. ISACA recommends connecting security metrics to business outcomes. Incident frequency trends, mean time to remediation, policy exception close rates, and third-party risk assessment completion rates are all metrics that communicate program health in terms a board can evaluate. For a deeper treatment of building and reporting these metrics, see the incident response metrics guide.

Common Mistakes New CISOs Make in the First 90 Days

Based on patterns observed across executive transitions and documented in ISACA's leadership publications, these are the most common errors new security leaders make:

Announcing Changes Before Completing the Assessment

Telling the team what you plan to change before you understand why things are the way they are destroys trust and often leads to reversing your own decisions later. Complete the discovery phase before making structural announcements.

Trying to Fix Everything at Once

A new CISO who submits a $5 million first-quarter budget request before demonstrating any ROI is unlikely to get it -- and will struggle to get funded for the next three years. Build credibility with small wins, then make the larger asks.

Ignoring the Business Units

Security programs that are built for security teams, not for the business units they protect, end up as compliance exercises with no operational impact. Spend real time with Finance, Legal, Product, and Operations. Their risk tolerance, their data workflows, and their deadline pressures must be understood before you design controls that affect them.

Defaulting to Technical Jargon in Executive Communication

Your board does not need to know the CVE number. They need to know that a critical vulnerability in your internet-facing infrastructure was present for 90 days and that the remediation plan is now in progress. Translate all risk into business terms before it reaches the C-suite or board.

Underestimating Team Morale

Security teams often experience leadership churn. If your predecessor left under difficult circumstances, your team may be burned out, demoralized, or skeptical. Invest in one-on-one conversations early, acknowledge the team's work, and make retention of key contributors a visible priority. Turnover in a security function during a leadership transition is one of the highest-risk outcomes you can face.

Frequently Asked Questions

What should a new CISO focus on first?

The first priority is always an honest assessment of the current risk posture. Before you change anything, understand what exists: the asset inventory, the vulnerability backlog, the open audit findings, and the team's capabilities. Decisions made without this foundation are guesses.

How long does it take to build a security governance roadmap?

A credible 12-month governance roadmap takes approximately 30-60 days to develop properly -- which is why the structure above places it in months two and three. Roadmaps that are completed in week one are generally based on assumptions, not evidence, and tend to be rebuilt from scratch after month-two findings.

Does CISM prepare you for the first 90 days as a CISO?

More than almost any other certification, yes. CISM's four domains map directly to what a new security leader needs: governance frameworks (Domain 1), risk assessment methodology (Domain 2), program structure (Domain 3), and incident readiness (Domain 4). The certification won't teach you every organization's politics, but it gives you the conceptual scaffolding to organize what you're seeing.

What metrics should a new CISO track in the first 90 days?

In the first quarter, focus on baseline metrics rather than improvement metrics. Document current mean time to patch critical vulnerabilities, current open finding counts and average age, policy exception volume, and incident frequency over the prior 12 months. These baselines let you demonstrate improvement to the board in months 6-12.

How should a new CISO handle a security incident in the first 30 days?

Follow the existing response process, even if it's imperfect. An incident in the first 30 days is not the moment to redesign the playbook -- that happens afterward in the after-action review. Your role is to support your team, communicate accurately to leadership, and ensure containment and recovery are properly resourced. Use the experience to inform your program priorities.

Should I aim to earn CISM before stepping into a CISO role?

Yes, in most cases. CISM is specifically designed for security management and governance leadership -- the domains directly map to what a CISO does every day. Many CISO postings now list CISM as either required or preferred. For a breakdown of where CISM holders are hired and at what compensation, see the CISM jobs 2026 guide and CISM salary guide.

Related Guides