30-60-90 day plan for CISOs
On this page
- What makes a CISO's first 90 days different?
- Which regulations set a new CISO's deadlines?
- What does the 30-60-90 day plan look like?
- Which numbers should a new CISO baseline?
- How should the CEO or board use the plan in the final interview?
- What should each check-in cover?
- A filled example
- What does the company owe the new CISO?
- Common mistakes
- How do you adapt the plan?
- Questions people ask
A 30-60-90 day plan for a new chief information security officer should prove the incident response path works in the first month, map which regulations put duties and deadlines on the company, and set a baseline against a framework such as NIST CSF 2.0; then run a tabletop with executives by day 60 and bring the board a prioritized, funded risk plan by day 90. As of October 2026 the deadlines that shape that plan include the SEC's four business days after a materiality determination, NYDFS's 72 hours, and the FTC Safeguards Rule's 30 days for events affecting at least 500 consumers.
This plan is for a CEO, CIO or board hiring a CISO at a mid-size or large organization. The technology portfolio side is in the 30-60-90 day plan for CIOs, and the analyst ramp in the 30-60-90 day plan for cybersecurity analysts.
What makes a CISO's first 90 days different?
A new CISO can be in charge of a serious incident in week one, before knowing the systems or the people. That is why the plan starts with the incident path rather than a strategy: who gets the first call at 2 a.m., who has authority to take systems offline, who briefs legal and the executives, and who decides whether a regulator or investor disclosure is needed.
The second difference is accountability by name. Regulators increasingly ask about the CISO's role directly: NYDFS requires a written CISO report to the board, the FTC Safeguards Rule names a Qualified Individual, and public companies describe management's cyber expertise in the annual report. A new CISO inherits what the last report said and should read it in the first week.
Which regulations set a new CISO's deadlines?
The rules below are as they read in October 2026. Which ones apply depends on the company: public or private, financial services, health care, government contracts, the states where its customers live and its own contracts. Confirm the list with general counsel; this is not legal advice.
| Rule | Who it covers | What it requires of the security program | Source |
|---|---|---|---|
| SEC cybersecurity disclosure | Public companies | Form 8-K Item 1.05 within four business days after determining an incident is material; annual description of risk management, board oversight and management's role and relevant expertise | SEC release 2023-139; 17 CFR 229.106 |
| NYDFS Part 500 | Entities licensed under New York's Banking, Insurance or Financial Services Law | CISO reports in writing at least annually to the senior governing body; incident notice no later than 72 hours after determining an incident occurred; annual compliance certification or acknowledgment by April 15; notice within 24 hours of an extortion payment | 23 NYCRR Part 500 (amended effective November 1, 2023) |
| FTC Safeguards Rule | Non-bank financial institutions under FTC jurisdiction | A Qualified Individual reports in writing at least annually to the board; annual penetration testing; notice to the FTC no later than 30 days after discovering a notification event involving at least 500 consumers | 16 CFR 314.4 |
| NIST CSF 2.0 (voluntary) | Any organization | Six functions (Govern, Identify, Protect, Detect, Respond, Recover) and profiles to describe current and target state | NIST CSWP 29, February 2024 |
The NYDFS amendments phased in over two years from November 1, 2023, so by October 2026 every requirement in the amended rule is in force for covered entities. State breach notification laws, HIPAA for health data, payment card standards and customer contracts add their own notice clocks; build one table of every clock the company is subject to.
What does the 30-60-90 day plan look like?
30-60-90 day plan — [Name], Chief Information Security Officer, [company]
Reports to: [CEO / CIO / general counsel] Board or committee: [ ]
Start date: [date] Security team: [N] staff, [N] contractors, MSSP: [ ]
Regulators and frameworks in scope: [SEC / NYDFS / FTC / HIPAA / PCI ...]
Next board or committee report: [date]
DAYS 1-30 — Prove the incident path; map the obligations
Goals:
- Read the incident response plan; confirm on-call, severity levels,
authority to isolate systems, outside responders and counsel on
retainer, cyber insurer notice terms
- Walk the materiality or regulatory-notice decision with general
counsel and the CFO: who decides, how fast, what facts they need
- Build the notice-clock table for every rule and contract in scope
- Read the last risk assessment, penetration test, audit findings,
board report and the 10-K cyber section (if public)
- Meet the CIO, GC, CFO, head of internal audit, privacy lead,
business unit heads and the board or committee chair
- One-to-one with every security team lead
Deliverables by day 30:
- Notice-clock table and incident escalation chart, agreed with GC
- Top ten risks as found, with evidence, for the CEO
Check-in: day 30, with the CEO or reporting executive
DAYS 31-60 — Baseline and rehearse
Goals:
- CSF 2.0 current profile: rate each function with evidence
- Executive tabletop: a ransomware or data theft scenario through to
the disclosure decision
- Check identity basics: MFA coverage, privileged accounts, offboarding
- Asset inventory: compare IT's inventory with what the security
tools actually see
- Third-party risk: list critical vendors and their last review
Deliverables by day 60:
- Current profile and tabletop findings with owners and dates
- Security team assessment: skills, gaps, contractor reliance
Check-in: day 60
DAYS 61-90 — Plan and fund
Goals:
- Target profile and a 12-18 month roadmap tied to the top risks
- Budget request with the CFO and CIO: people, tools, services
- First board or committee report in the format the board will keep
- Agree the metrics the board will see each quarter
Deliverables by day 90:
- Roadmap and budget reviewed by the CEO; board report delivered
- Tabletop corrective actions closed or dated
Check-in: day 90 — full reviewWhich numbers should a new CISO baseline?
The standards in the last column are examples only. The board needs a few measures that track the top risks, reported the same way every quarter, not a long list of tool counts.
| Measure | Why it matters | Example standard (example only) |
|---|---|---|
| MFA coverage for remote access, email and privileged accounts | Stolen credentials are a common way in | Gaps listed by system with dates by day 60 |
| Endpoint and logging coverage against the asset inventory | What the tools do not see they cannot protect | Coverage gap known by day 60 |
| Critical vulnerabilities past the patch standard | Shows whether known holes stay open | Reported weekly with owners |
| Time to detect and contain in exercises and real incidents | Tests the incident path end to end | Measured in the day-60 tabletop |
| Backups restored in a test | Ransomware recovery depends on it | One restore test of a critical system by day 90 |
| Critical vendors with a current security review | Third-party incidents count under several notice rules | List complete by day 60 |
How should the CEO or board use the plan in the final interview?
Give every finalist the same brief: company type, regulators in scope, size of the security team, the last major incident or audit finding and the board calendar. Use the rubric in how to evaluate a 30-60-90 day plan in an interview. A strong plan starts with the incident path and the notice clocks, and does not promise a new tool stack before the baseline. Scenario questions:
- "In week two, the help desk reports a ransom note on a file server on a Friday night. Walk me through the first four hours."
- "Who in our company decides whether an incident is material, and what do you need to give them?"
- "Our last board report showed a green dashboard. What would make you change that in your first report?"
- "The business wants a new AI tool connected to customer data next month. What do you need to see?"
Earlier rounds for the team are covered in the interview guide for cybersecurity roles.
What should each check-in cover?
| Checkpoint | Questions to ask | On track | Worth a direct conversation |
|---|---|---|---|
| Day 30 | "If we were breached tonight, who calls whom, and who decides on notice?" | Escalation chart and notice-clock table agreed with GC; top risks with evidence | Strategy deck before the incident path; has not met general counsel |
| Day 60 | "What did the tabletop show us?" | Executives took part; findings owned and dated; current profile with evidence | Tabletop limited to IT; profile scored from interviews only |
| Day 90 | "What will you stop, start and fund?" | Roadmap tied to top risks; budget request with trade-offs; board report delivered | Tool shopping list without risk reduction; no agreed board metrics |
A filled example
CISO: Angela Wu (invented), previously deputy CISO at a bank, joining a public insurance broker licensed in New York as its first full-time CISO.
Day 30: Found that the incident response plan named an outside firm whose retainer had lapsed, and that the cyber insurance policy required notice to the insurer before engaging responders. Built a notice-clock table with general counsel covering the SEC, NYDFS's 72 hours, state breach laws and two large client contracts with 24-hour notice clauses.
Day 60: Ran a ransomware tabletop with the CEO, CFO and general counsel; the materiality discussion stalled because nobody owned the business impact estimate, so the CFO took it. The current profile showed strong detection but weak recovery: no restore test of the policy system in two years.
Day 90: Renewed the retainer, completed a restore test, and presented a roadmap funding recovery and privileged access work first. Delivered the first written report to the board, which the NYDFS rule requires at least annually, and agreed five quarterly metrics with the audit committee.
What does the company owe the new CISO?
- Direct access to the board or committee that oversees cyber risk, and to general counsel.
- The full history: past incidents, regulator correspondence, audit findings, insurance claims and penetration test reports.
- Clear authority to isolate systems during an incident, written into the incident response plan.
- A budget conversation before day 90, so the roadmap is not presented without a way to fund it.
Common mistakes
- Strategy before the incident path. An incident in week three will not wait for the roadmap.
- Treating notice clocks as legal's problem. The clocks start from facts the security team finds; the CISO decides how fast those facts travel.
- Reporting tool counts to the board. Directors need risk, trend and decisions, not alert volumes.
- Replacing tools in the first 90 days. New tools hide the baseline and consume the team that should be fixing basics.
How do you adapt the plan?
- Private company with no regulator in scope: weight the notice-clock table toward state breach laws, contracts and the cyber insurance policy.
- Health care: add the HIPAA security risk analysis and business associate agreements; the HIPAA guide for interviews shows how the rule reaches unexpected places.
- First CISO, small team: combine with the IT director plan and use a managed detection provider while hiring.
- Architecture-heavy role: the solutions architect plan shows how design reviews can carry security requirements early.
- Credentials: common ones are CISSP from ISC2 and CISM from ISACA; weigh them against incident and board experience.
Questions people ask
What should a new CISO do in the first 30 days?
Confirm the incident response path works before anything else: who is called, who decides severity, who decides materiality or regulatory notice, and whether outside responders are on retainer. Then map which rules apply (SEC disclosure, NYDFS Part 500, the FTC Safeguards Rule, state breach laws, contracts), read the last risk assessment, audit and penetration test, and meet the CIO, general counsel, CFO and the board or committee chair who oversees cyber risk.
How often does a CISO have to report to the board?
It depends on the rule that applies. As of October 2026, NYDFS Part 500 requires the CISO of a covered entity to report in writing at least annually to the senior governing body, and the FTC Safeguards Rule requires a covered financial institution's Qualified Individual to report in writing regularly and at least annually to the board. Public companies describe the board's oversight and management's role each year under Regulation S-K Item 106. Most boards want more frequent updates than the minimum. This is not legal advice.
How fast must a public company disclose a material cyber incident?
Under the SEC's rules, a Form 8-K under Item 1.05 is due four business days after the company determines that a cybersecurity incident is material, not four days after the incident, as of October 2026. Disclosure may be delayed only if the U.S. Attorney General determines that immediate disclosure would pose a substantial risk to national security or public safety. The CISO's job is to make sure the facts reach the people making the materiality decision quickly.
What is the difference between a CISO's and a CIO's 30-60-90 day plan?
A CIO's plan covers the whole technology portfolio, spend and delivery. A CISO's plan covers cyber risk: the incident response path, the regulatory map, a security baseline against a framework such as NIST CSF 2.0, the security team and its budget, and a risk report the board can act on. The two plans should share one asset inventory and one view of the top risks.