The First 180 Days as a CISO

A calm guide to knowing what to do when everyone is looking at you to know what to do.

You got the job. Somewhere between the offer letter and your first login, a quiet worry arrives: everyone will expect you to know what to do, and on day one you do not know where the coffee is. That is normal. Nobody walks into this role knowing the place. The good ones walk in knowing how to find out.

This book follows the first six months in order. Each chapter starts with the questions people in your seat ask, often only to themselves, and answers them as plainly as we can. Some of the answers are uncomfortable. A few chapters are about what security teams are bad at, because pretending otherwise helps nobody.

Read it straight through once, then dip back in when a week gets hard. Every chapter ends with one thing to practise on PlayCISO, because reading about a board meeting is not the same as sitting through one.

This is advice, not law. Where a chapter states a rule or a standard, the source is listed with the date we read it. Check the source again before you rely on it, and talk to your own counsel about anything legal.

Start reading Read it on one page

Welcome to the chair

The first week. Who to meet, what to find out, and what to keep to yourself for now.

Your First Day: Who to Meet and What Not to SayDay 1 to week 2
The Facts That Matter: Mandate, Budget, Risk OwnerWeeks 1–3
The Org Chart Is a Map, Not the TerritoryWeeks 2–4

Settling in

The first 30 days and a little beyond. What to work on, your first incident, and the vendors you inherited.

What to Work On: Pick 3 of 300Weeks 3–6
Your First Incident: What If I Screw Up?Any time, often sooner than you think
Vendors and the Inherited MessWeeks 4–10

How am I doing?

Months 2 to 4. Measuring what matters and facing the board for the first time.

Metrics That Don't Lie: Five Numbers, Not FiftyMonths 2–3
Your First Board MeetingMonths 3–4

Choose your own adventure to 180 days

Months 3 to 6. Turning one-off fixes into lasting programs, and widening what you know.

Programs, Not Projects: PQC, AI and IdentityMonths 3–6
Growing Your Toolbox: Be T-ShapedMonths 4–6

Building the team

Months 3 to 6. Hiring people who are better than you, and interviews that show real judgement.

Hiring People Better Than YouMonths 3–6
Interviews That Test JudgementMonths 3–6

Epilogue

What security teams are not good at, and what to do when none of this works.

What Security Is Not Good AtMonth 6 and every month after
When None of This Works: Burnout and EscalationWhenever you need it

Glossary

Asset inventory: A list of the systems, data and devices an organisation has. Hard to keep accurate, impossible to secure without.
Attack surface: All the places an attacker could try to get in, such as internet-facing systems, accounts and suppliers.
Audit finding: A gap an auditor recorded, usually with a date by which it should be fixed.
Backup restore test: Actually recovering data from a backup to prove it works, not just checking that backups ran.
Blameless review: A look back at an incident that focuses on how the system failed, not on punishing a person.
Board: The group of directors responsible for overseeing how a company is run.
Business continuity: Plans to keep the most important parts of the business running during a disruption.
CISO: Chief Information Security Officer. The person who leads an organisation's security program.
Compensating control: A different safeguard used when the normal one cannot be applied.
Containment: Stopping an incident from spreading, before fully investigating it.
Control: Any safeguard that reduces risk: a technical setting, a process or a check.
Crypto inventory: A list of where and how an organisation uses encryption. The first step in moving to post-quantum algorithms.
D&O insurance: Directors and officers insurance. Covers some legal costs for company leaders. Check whether your role is included.
Deputy: A second person who can lead in your absence. Essential for incidents and for your own rest.
Detection: Noticing that something bad is happening, through alerts, logs or people reporting it.
Escalation: Taking a decision to someone with more authority when it is beyond the current owner.
Evidence preservation: Keeping logs, images and records from an incident intact so they can be examined.
Exercise: A practice run of an incident or decision, usually as a discussion or simulation.
Form 8-K: A report US listed companies file with the SEC about significant events. Item 1.05 covers material cybersecurity incidents.
Govern function: The part of NIST CSF 2.0 covering strategy, roles, policy and oversight of cybersecurity risk.
Governance: How decisions about security are made: roles, policy, oversight and accountability.
Identity: Any account that can access something: a person, a service, a device or an AI agent.
Incident: An event that harms, or could harm, the confidentiality, integrity or availability of systems or data.
Incident lead: The one person who coordinates the response to an incident.
Lateral movement: An attacker moving from the first system they reach to others inside the network.
Legacy system: An old system still in use, often hard to patch or replace.
Logging: Recording what happens on systems so it can be reviewed later.
Mandate: What you are formally responsible for and allowed to decide.
Materiality: Whether an incident is significant enough that a reasonable investor would want to know about it.
Metric: A number tracked over time to show whether something is improving.
MFA: Multi-factor authentication. Signing in with something beyond a password, such as an app prompt or a hardware key.
NIST CSF: The Cybersecurity Framework from the US National Institute of Standards and Technology, a common way to organise a security program.
Outcome metric: A number that changes when risk changes, as opposed to one that counts activity.
Patch: A software update that fixes a flaw.
Phishing: Messages designed to trick people into giving up access or running something harmful.
Policy: A written rule about how people and systems must behave.
Post-quantum cryptography (PQC): Encryption designed to stay secure against future quantum computers.
Privileged access: Accounts that can change systems or reach sensitive data. The most valuable target for attackers.
Program: Ongoing work with an owner and a budget that does not have an end date.
Project: Work with a defined end date and outcome.
Quick win: A change that reduces real risk fast and visibly.
RACI: A chart of who is Responsible, Accountable, Consulted and Informed for a task.
Ransomware: Malicious software that locks or steals data and demands payment.
Recovery: Getting systems and data back to normal after an incident.
Risk acceptance: A recorded decision by the right owner to live with a risk rather than fix it now.
Risk owner: The person with the authority to decide how a risk is handled. Usually a business leader, not the CISO.
Risk register: A list of known risks, their owners, ratings and what is being done about them.
SEC: The US Securities and Exchange Commission, which sets disclosure rules for listed companies.
Service account: An account used by software rather than a person. Often has wide access and is easy to forget.
Supplier risk: The risk that a vendor's weakness or failure harms your organisation.
T-shaped: Deep in one area and broad enough in others to ask good questions.
Tabletop: A discussion-based exercise where people walk through how they would handle an incident.
Technical debt: Shortcuts and old choices that make systems harder to secure and change over time.

Frequently asked questions

What should a new CISO do in the first 90 days?

Spend the first month listening and pinning down your mandate, budget and who owns risk. In the second month, pick three priorities and a few honest metrics. By the third, have a written plan, an incident roster and a first report your board can use.

What should a CISO not do in the first month?

Avoid criticising your predecessor, promising dates, buying tools or cancelling contracts before you understand why they exist. Act at once only on risks that are clearly dangerous right now.

How should a new CISO prepare for a first board meeting?

Meet the chair beforehand, read past minutes that mention security, and bring a short paper: the few risks that could seriously hurt the company, what you are doing, and one clear decision you need from them.

What metrics should a CISO report?

A handful of outcome measures that change when risk changes, such as time to fix critical internet-facing flaws, strong sign-in coverage for admin access, and the date of the last successful restore test.

Who owns cyber risk, the CISO or the business?

The business leaders who make the decisions own the risk. The CISO's job is to make sure those decisions are informed, recorded and made by someone with the authority to make them.

Other handbooks

Updated 2026-11-14. General guidance, not legal advice. Where a chapter states a law or standard, its sources are listed at the end of that chapter.