Chapter 4 of 14 · Weeks 3–6
What to Work On: Pick 3 of 300
- There are hundreds of problems. Where do I start?
- Should I go for quick wins or fix the deep stuff?
- How do I say no to the other 297 without upsetting people?
By week three you will have a list of problems far longer than your team can fix in a year. That list is not a plan. A plan is the three things you will do first, why those three, and what you are knowingly leaving for later.
How to choose the three
- Group the list by what could actually hurt the business: stop it trading, leak what customers trusted you with, or break a promise to a regulator or client.
- For each group, ask how likely it is in the next year given what you have seen, not what you fear.
- Ask what it would cost and who else would need to help.
- Pick three that together cover the worst harms and that you can show progress on within a quarter.
Three is not magic. It is small enough that you can say all of them in one breath to the CEO, and small enough that your team can hold them in their heads.
Quick wins vs long-term debt
A quick win is a change that removes real risk fast and is visible: turning on strong sign-in for admin accounts, closing an exposed service, fixing backups that have never been restored. Quick wins buy you trust, and you will need that trust for the slow work.
Long-term debt is the stuff that took years to build up: old systems nobody can patch, identity sprawl, an asset list nobody believes. You cannot fix it in 30 days. You can start measuring it, name an owner and agree a direction.
| Quick win | Long-term debt | |
|---|---|---|
| Time to show progress | Weeks | Quarters or years |
| Who notices | Your boss, your team | Auditors, attackers, your successor |
| Danger | Looks busy, changes little | Never finishes, loses support |
| Healthy share of your plan | One of your three | One or two of your three |
The question you might not ask out loud
What if my three turn out to be wrong?
Then you change them and say why. A plan that changes because you learned something is a sign you are paying attention. A plan that never changes is usually a plan nobody looks at.
Saying no to the rest
Put everything else on a written list called something honest, like "known and not yet funded". Show it to your boss. Each item should say what the risk is and who owns the decision to wait. That turns a quiet worry into a shared, dated choice.
Rule of thumb:If everything is a priority, the attackers set your priorities for you.