30-60-90 day plan for CIOs
On this page
- How is a CIO's first 90 days different from an IT director's?
- The 30-60-90 day plan
- What should a CIO bring to the board in the first 90 days?
- Which measures should a new CIO baseline?
- What does "on track" look like at day 30, 60 and 90?
- A filled example
- How should a CEO use this plan in the final interview?
- What should the CEO ask at the 30, 60 and 90-day check-ins?
- What the CEO and board owe a new CIO
- Common mistakes
- Adapting the plan
- Questions people ask
A 30-60-90 day plan for a new CIO should map the company's technology portfolio, spend and operating model in the first 30 days, agree how technology investments and cyber and AI risk are governed with the CEO and board by day 60, and present a funded technology plan with business owners by day 90. It differs from an IT director's plan because the CIO answers for how the whole company decides on technology, not only how IT runs. At a public company the CIO also needs to understand the SEC's cybersecurity disclosure duties, as of October 2026, before the first incident tests them.
This plan is for a CEO, COO or CFO hiring a chief information officer, and for boards that oversee the hire. If the role leads internal IT at a mid-size company without board exposure, the 30-60-90 day plan for IT directors is the closer fit; for the listening tour every executive runs, see the 30-60-90 day plan for executives. If the role owns the product's technology rather than the company's internal systems, use the 30-60-90 day plan for CTOs.
How is a CIO's first 90 days different from an IT director's?
| Area | IT director's first 90 days | CIO's first 90 days |
|---|---|---|
| Strategy | A 12 to 18 month IT roadmap | How technology supports the company strategy, agreed with the executive team |
| Money | Contracts, renewal dates and license counts | The investment process: who proposes, who decides, how benefits are tracked |
| Risk | Admin access, restore tests, incident plan | How cyber and AI risk are governed and reported to the board, with the CISO |
| Organization | Team skills and workload | The IT operating model: central versus business-unit IT, product teams, sourcing |
| Stakeholders | Business leaders and the IT team | The CEO, executive team, board or audit or risk committee, major vendors |
The 30-60-90 day plan
30-60-90 day plan — [Name], Chief Information Officer, [company]
Reports to: [CEO / COO / CFO] Board committee for tech risk: [name]
Start date: [date] IT budget: [opex / capex] IT staff: [N]
Direct reports: [IT directors, CISO if reporting here, architecture,
data, PMO] Largest vendors: [ERP, cloud, managed services]
DAYS 1-30 — Map the portfolio, the money and the risk
Goals:
- Meet every executive: their strategy, what technology blocks it,
what they would fund
- Meet the chair of the committee that oversees technology risk
- Map the application portfolio: system, business owner, cost,
contract end, age, criticality, overlap
- Map spend by run, grow and transform, with finance
- Review security posture with the CISO: open high risks, incident
history, last tabletop, escalation path for a material incident
- List every AI tool in use or in pilot, and who approved it
Deliverables by day 30:
- Portfolio and spend map; risk summary with owners and dates
- Listening tour themes for the CEO
DAYS 31-60 — Set the governance
Goals:
- Agree an investment process with the CFO and executive team:
intake, business case, priority, benefits review
- Agree how cyber risk is reported to the board: format, cadence,
metrics, who presents
- Draft an AI use policy and a review process for new AI tools,
with legal, security and HR
- Review the IT operating model: where work queues, where business
units buy their own technology, what is outsourced
- Close or schedule the highest security risks
Deliverables by day 60:
- Investment process agreed; first board cyber report delivered
- AI policy draft circulated for comment
DAYS 61-90 — Present the plan
Goals:
- Present a technology plan tied to the company strategy, with a
budget the CFO has reviewed
- Name a business executive as owner for each major initiative
- Propose operating model changes with evidence
- Agree a short set of measures reported quarterly
Deliverables by day 90:
- Plan and budget reviewed by the CEO and presented to the board
- Retirement list for overlapping or end-of-life applications
Check-ins: weekly with [manager]; day 30, 60 and 90 reviews.What should a CIO bring to the board in the first 90 days?
Expect the board to ask the CIO, often alongside the CISO, to explain technology risk in business terms. Three sources shape that conversation, all checked as of October 2026:
- SEC cybersecurity disclosure (public companies). The SEC's cybersecurity disclosure rules require a Form 8-K under Item 1.05 within four business days after the company determines an incident is material, and annual disclosure under Regulation S-K Item 106 of the processes for managing cyber risk, the board's oversight, and management's role and expertise. A new CIO should learn who makes the materiality determination and how fast the escalation path runs, and read how the last 10-K describes their own role.
- NIST Cybersecurity Framework 2.0. CSF 2.0, released by NIST in February 2024, organizes cyber outcomes into six functions: Govern, Identify, Protect, Detect, Respond and Recover. The Govern function is a useful frame for the board report because it treats cybersecurity as an enterprise risk alongside financial and reputational risk. It is voluntary, and it gives IT, the CISO, auditors and directors a common vocabulary.
- NIST AI Risk Management Framework. The AI RMF 1.0 (January 2023) is voluntary and organizes AI risk work into Govern, Map, Measure and Manage; NIST added a Generative AI Profile in July 2024 and says the framework is being revised. It gives the CIO a shared vocabulary for the AI policy due at day 60.
Sector rules, privacy laws, customer contracts and cyber insurance policies add their own duties, and they differ by company. Confirm which apply with counsel and the CISO; this is not legal advice. For AI tools used in hiring specifically, the AI governance policy for recruiting shows what a function-level policy looks like.
Which measures should a new CIO baseline?
Agree measures with the CEO and CFO and report the day-30 baseline before setting targets. The standards below are examples only.
| Measure | What it shows | Example standard (example only) |
|---|---|---|
| Spend split: run, grow, transform | How much of the budget goes to keeping the lights on | Mapped with finance by day 30 |
| Applications per business capability | Overlap and retirement candidates | Overlaps listed with owners by day 60 |
| Major initiatives on time and on budget | Delivery credibility with the executive team | Status reported the same way for every initiative from day 60 |
| Availability of the most critical systems | Whether operations can rely on IT | Baseline for the top five systems by day 30 |
| High cyber risks open past their date | Exposure the board is carrying | Every high risk owned and dated by day 60 |
| Executive satisfaction with technology | Whether IT is seen as a partner | Short survey at day 30 and day 90 |
What does "on track" look like at day 30, 60 and 90?
| Checkpoint | On track | Worth a direct conversation |
|---|---|---|
| Day 30 | Every executive met; portfolio and spend mapped; risk summary with the CISO; AI tools listed | Time spent mostly inside IT; no view of spend outside the IT budget |
| Day 60 | Investment process agreed; first board cyber report delivered in business terms | A technical board report full of tool names; projects still approved by whoever asks loudest |
| Day 90 | Plan and budget tied to strategy, with a business owner for each initiative | A technology wish list; a reorganization announced without evidence |
A filled example
CIO: Daniel Okafor (invented), joining a specialty retailer with stores, an e-commerce site and two distribution centers, after a decade as a divisional IT leader.
Day 30: The portfolio map showed three point-of-sale versions across store formats, marketing and e-commerce each buying their own analytics tools, and an ERP contract renewing in seven months. The CISO's risk list was current, but the board had last heard about cyber risk more than a year earlier. Store operations had piloted an AI scheduling tool without a security review.
Day 60: Agreed an investment intake with the CFO, presented a two-page cyber report to the audit committee with the CISO, and put the scheduling pilot through a review under a draft AI policy.
Day 90: Presented a plan to consolidate point of sale over two years, merge the analytics tools, and renegotiate the ERP contract, with the COO and CMO named as owners. The board asked for a quarterly cyber update, which he and the CISO now deliver together.
How should a CEO use this plan in the final interview?
Give CIO finalists the same brief: company strategy in a paragraph, IT budget and headcount, the reporting line, the board committee that oversees technology risk, and one known problem. The guide on how to evaluate a 30-60-90 day plan in an interview explains the brief and a scoring rubric. A strong CIO plan starts with the executives and the money, names the board and the CISO, and holds back from replacing major systems before the portfolio is mapped. Questions that test it:
- "A business unit has bought its own platform without IT. What do you do in your first month?"
- "How would you explain our cyber risk to the board in ten minutes, without product names?"
- "Three executives each want their project first. How does your process decide?"
- "An AI tool is already in use without approval. What happens next?"
What should the CEO ask at the 30, 60 and 90-day check-ins?
- Day 30: Where is technology money spent that does not appear in the IT budget? Which risk worries you most?
- Day 60: Which executive disagrees with the investment process, and why? What did the board ask that you could not answer?
- Day 90: What will we stop doing to fund the plan? Which initiative has no real business owner yet?
What the CEO and board owe a new CIO
- A seat in executive team meetings where strategy and budget are decided, not only in IT reviews.
- A clear reporting line for the CISO, and an agreed way the two present cyber risk to the board.
- Full visibility of technology spend, including what business units buy themselves.
- Authority to pause projects and tools that create security or compliance risk.
Common mistakes
- Leading with a platform. Announcing an ERP or cloud move before the portfolio map makes every later decision look predetermined.
- Treating the board report as a technical briefing. Boards want exposure, trend, decisions needed and who owns them.
- Ignoring shadow technology. Business-bought tools are where spend and data risk hide; map them in the first month.
- Copying the last company's operating model. Product-aligned teams, central IT and outsourced models each fit some companies; choose with evidence at day 90.
Adapting the plan
- Public company: add the disclosure committee, the 10-K cyber description and the audit committee calendar to days 1-30.
- Regulated sector: add the regulator's examination calendar and the compliance lead to week one.
- CIO who also owns data or digital products: add data ownership, data quality and product delivery measures to the day-30 baseline.
- After an acquisition: put the integration plan for identity, email, ERP and security tooling in days 1-60.
The 30-60-90 day plan for cybersecurity analysts shows how detection and log coverage ramp on the security team, and the general 30-60-90 day plan template for new hires covers the structure for any role.
Questions people ask
What should a new CIO do in the first 90 days?
In the first 30 days, meet every executive and the board or committee that oversees technology risk, and map the application portfolio, IT spend and the operating model. By day 60, agree how technology investments get decided and how cyber and AI risk are reported to the board. By day 90, present a technology plan with a budget the CFO has reviewed and a small number of priorities each owned by a business executive.
How is a CIO's 30-60-90 day plan different from an IT director's?
An IT director's plan centers on running IT well: risks, contracts, service and a roadmap. A CIO's plan sits a level up: how the whole company decides on technology investment, how IT is organized to deliver it, how cyber and AI risk are governed and reported to the board, and how technology supports the company strategy. In many companies the CIO hires and directs the IT directors.
What does the SEC cybersecurity rule mean for a new CIO?
At a public company, as of October 2026, the SEC requires a Form 8-K disclosure within four business days after the company determines a cybersecurity incident is material, and an annual 10-K description of cyber risk management, board oversight and management's role and expertise. A new CIO should learn the incident escalation and materiality process in the first month and know how their own role is described in the annual disclosure. This is not legal advice.
Should a new CIO restructure IT in the first 90 days?
Usually not. A CIO should first understand how work flows between business units and IT, where projects stall, and which skills are missing, then propose an operating model change at around day 90 with evidence. Urgent fixes to security risks are the exception and should not wait.