CISO Guide: First 90 Days

Most new chief information security officers (CISOs) inherit a security function whose mandate, budget and risk appetite were never written down, and they have about three months to fix that before the organisation decides what kind of leader it hired. The role is now under direct regulatory attention: US listed companies must describe management's cyber expertise in their annual reports, NIS2 makes management bodies approve and oversee cyber risk measures, and the UK Cyber Governance Code of Practice expects quarterly board reporting. This guide covers the mandate and reporting line, a structured first 90 days, strategy and risk appetite, board reporting, metrics, budget and team design, regulation and personal liability, and working with legal, finance, IT and vendors. It is written for new and aspiring CISOs, virtual CISOs, and the executives and directors who hire and oversee them.

Key takeaways

• Agree the mandate in writing first. Scope, decision rights, incident authority and direct board access matter more than the job title or the line on the organisation chart.
• Spend the first 30 days listening, not fixing. A stakeholder map and an evidence-based risk baseline earn the credibility to change things in days 31 to 90.
• Make the board own the risk appetite. NIST CSF 2.0 GV.RM-02 and UK Cyber Governance Code action A.3 both expect appetite set at the top; the CISO proposes, the board approves.
• Report decisions, not activity. A board pack should show risk against appetite, trend, decisions needed and the cost of each option, using a few stable metrics.
• Identity and AI are board topics. Many major incidents start with a stolen or abused identity, human or machine, and AI agents add identities with real permissions. Put both on the risk register by name.

The CISO mandate and reporting line

NIST CSF 2.0 places security leadership in the GOVERN function. GV.RR-01 states that "Organizational leadership is responsible and accountable for cybersecurity risk", and GV.RR-03 that "Adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies." The CISO turns that accountability into a programme, but accepting risk stays with the business and the board. A mandate or charter, approved by the CEO and noted by the audit or risk committee, should state:

• Scope: corporate IT, cloud, OT, products shipped to customers, privacy engineering, physical security and subsidiaries. Anything excluded needs a named owner elsewhere.
• Decision rights: what the CISO decides (policy, standards, incident declaration), recommends (risk acceptance above a threshold) and can block (go-live of systems failing minimum controls, with an exception route).
• Board access: a standing agenda slot at least quarterly and a right to escalate to the committee chair. Code action E.3 asks boards for "regular two-way dialogue" with the CISO or equivalent.
• Incident authority: who can isolate systems, take services offline or engage external responders without waiting for approval.
• Budget ownership: a separate security budget, or influence over spend inside the CIO's budget.

No reporting line is right everywhere; what matters is that the CISO is not marking their own manager's homework without an independent route to the board. The CIO is accountable for delivering and running technology; the CISO is accountable for the security risk that technology, people and suppliers create, and for telling the board when it is outside appetite.

Full-time or virtual: a virtual or fractional CISO (vCISO) suits smaller organisations, interim gaps, or designing a programme before a full-time hire is justified. It works when an internal owner executes day to day and the contract states decision rights and incident availability. Regulated entities and those with frequent board reporting duties generally need an employed CISO, because the accountability is hard to contract out.

The first 90 days

The goal is a defensible picture of risk, relationships that will hold during the first incident, and a strategy the board has approved.

1. Days 1 to 15, confirm the basics: read recent board and audit committee papers, audit findings, regulator correspondence, the risk register, two years of incident logs, the cyber insurance policy and the incident response plan. Confirm today that the incident response retainer, outside counsel and the insurer's breach hotline are reachable.
2. Days 1 to 30, map stakeholders: one-to-ones with the CEO, CFO, CIO, General Counsel, CRO, head of internal audit, DPO, HR, the largest business unit heads and the committee chair. Ask what they fear most, what security has blocked for them, and what good looks like in a year.
3. Days 15 to 45, build the risk baseline: assess against one framework (NIST CSF 2.0 or the NCSC Cyber Assessment Framework) using evidence, not questionnaires alone. Test the claims that matter: is MFA enforced on remote and privileged access, can backups be restored, who holds global admin, how many service accounts and API keys exist and who owns them.
4. Days 30 to 60, assess team and suppliers: skills, capacity, single points of knowledge, on-call cover, and contracts for managed services and key tools. Renewal dates are budget leverage.
5. Days 45 to 75, deliver two or three quick wins: low-regret fixes such as removing standing global admin rights, enforcing phishing-resistant MFA for administrators, closing an unowned internet-facing service, or running the first executive tabletop exercise.
6. Days 60 to 90, propose strategy and appetite: a two to three year roadmap, draft risk appetite, target operating model and budget, presented to the executive committee and then the board.

Two rules keep this reversible. Do not restructure the team or replace major tools before day 60 unless there is an active incident or a clear legal breach. And every quick win needs a rollback plan agreed with IT operations: a conditional access change that locks out a factory floor costs more credibility than it earns.

Strategy, roadmap and risk appetite

Code action B.1 asks boards to ensure a cyber strategy is "aligned with, and embedded within" the wider organisational strategy, and B.2 that it matches the agreed risk appetite and regulatory obligations. Build it in four parts:

• Critical services: the five to ten business services whose disruption or data loss would cause material harm, with dependencies. The NCSC Cyber Security Toolkit for Boards opens its risk management principle with identifying critical assets.
• Threat profile: actors and techniques relevant to your sector and incident history. See the Threat Intelligence Guide.
• Current and target state: maturity by framework function today and the target agreed with the board, with the gap expressed as risk reduction, not tool purchases.
• Roadmap: sequenced initiatives with owners, cost and the metric that proves each worked. Fund foundations (asset inventory, identity, logging, recovery) before advanced capabilities.

GV.RM-02 asks that "Risk appetite and risk tolerance statements are established, communicated, and maintained." Appetite is how much risk the board will take; tolerance turns it into measurable limits:

• Availability: "No cyber event may stop order processing for more than 24 hours." Tolerance: tested recovery of order systems within 8 hours.
• Exposure: "Low appetite for internet-facing weaknesses." Tolerance: known exploited vulnerabilities on internet-facing systems fixed within 7 days.
• Identity: "No appetite for privileged access without strong authentication." Tolerance: every privileged human and machine account inventoried, owned and protected.

Risks outside tolerance go to a named business owner who funds remediation or formally accepts the risk for a fixed period. An acceptance that never expires is a decision nobody is making. Quantifying the largest risks helps the CFO compare options; see the Cyber Risk Quantification Guide.

Reporting to the board

Boards need enough understanding to challenge, not a technical briefing. These frameworks set expectations of boards that shape what the CISO supplies:

A board pack that works fits on four pages: risk position against appetite with trend; threat changes and significant incidents; roadmap progress; three to six metrics with tolerances; and the decisions or acceptances requested. Brief the committee chair beforehand and make sure decisions are minuted: they are the evidence that oversight happened. For AI agent risk, see the Board and CISO Briefing.

Metrics that matter

Pick a small, stable set and keep it for at least four quarters so the board sees trend. NIST SP 800-55 Volume 1 (December 2024) covers identifying, selecting and prioritising security measures.

Avoid vanity numbers such as blocked emails or total alerts, which track attacker volume rather than your control. See the Identity Security Metrics Guide.

Budget and team structure

Build the budget from the roadmap, not last year's spend plus inflation: run costs (licences, managed services, staff), change costs (projects tied to risk reduction) and contingency (incident response retainer, forensics, crisis communications).

• Find money before asking: overlapping tools and unused licences are common in an inherited estate; retiring them funds quick wins and earns CFO trust.
• Align with insurance: insurers ask about MFA, backup, EDR and privileged access at renewal. Use the same evidence. See the Cyber Insurance Guide.
• Show options: present at least two funding levels with the residual risk of each, so the board chooses the risk, not just the cost.

At any size, name a deputy who can run an incident when the CISO is unavailable, and remove single points of knowledge on identity and backup platforms. See the MDR Guide.

Regulation and personal liability

• SEC rules (US listed companies): Form 8-K Item 1.05 requires disclosure of a cyber incident the company determines to be material, generally within four business days of that determination, covering "material aspects of the incident's nature, scope, and timing" and likely impact. Delay is possible only where the US Attorney General finds a substantial risk to national security or public safety. Regulation S-K Item 106 requires annual disclosure of risk management, board oversight and management's role and expertise; foreign private issuers use Forms 6-K and 20-F. The CISO's job is to get incidents to the materiality decision fast and make sure the 10-K describes what really happens.
• NIS2 Article 20 (EU essential and important entities): management bodies "approve the cybersecurity risk-management measures" under Article 21, oversee them and "can be held liable for infringements"; members "are required to follow training". Article 32 lets supervisors of essential entities, as a last resort, seek a temporary ban on a person exercising managerial functions. Significant incidents need an early warning within 24 hours, notification within 72 hours and a final report within one month. See the NIS2 Directive Guide and, for financial entities, the DORA Guide.
• UK Cyber Governance Code: voluntary, aimed at directors of medium and large organisations; action D.3 has the board take responsibility for regulatory obligations such as incident reporting.

Personal exposure for security leaders has so far turned on concealment and misleading statements, not on being breached. Uber's former chief security officer was convicted in 2022 of obstructing a Federal Trade Commission proceeding and misprision of a felony over the Uber 2016 breach, in which attackers were paid $100,000 and the breach was not disclosed to the FTC; he was sentenced in May 2023 to three years' probation. Practical protections: confirm D&O insurance and indemnity cover; never sign off a public security statement you cannot evidence; record risk acceptances and dissent in writing; and route every payment, notification and disclosure decision through counsel and the disclosure committee.

Working with legal, finance, IT and vendors

• Legal: agree in advance when counsel engages forensic firms, who decides on regulator and customer notification, and how extortion demands are handled. Keep counsel, insurer and law enforcement contacts in the offline incident pack. See the Incident Response Guide.
• CFO: speak in loss scenarios, ranges and options; involve finance in insurance, payment fraud controls and disclosure materiality.
• CIO: security standards become IT's acceptance criteria. Platform teams own controls on their platforms; security owns the standard, testing and exceptions register.
• Suppliers: tier by access and data held, not spend. Critical tiers need incident notification within set hours, assurance rights, MFA and named accounts. The Marks and Spencer cyberattack began with impersonation of a third-party user. See the Third-Party Access Guide.
• Security vendors: consolidate where overlap is clear, insist on exportable logs and configuration, and bring each tool's admin accounts and API keys under privileged access control.

Identity and AI risk as board topics

Boards grasp "someone logged in as us" faster than any vulnerability taxonomy. Three identity risks deserve named lines on the register:

• Privileged access: one compromised administrator can halt a business. In the Stryker cyberattack, a hijacked admin account used Microsoft Intune to wipe tens of thousands of devices. See the Privileged Access Management Guide.
• Non-human identities: service accounts, API keys, tokens and certificates usually outnumber people and are rarely owned or reviewed. Ask for an inventory and an ownership rate. See the NHI Ownership Guide.
• AI agents: agents act with delegated permissions and their own credentials. Board questions: which agents exist, what can they access, who approves their permissions, how are their actions logged. See the AI Governance Guide and the Agentic AI Security Guide.

Framework mapping

At the operational level, CIS Controls v8.1 Control 15 (Service Provider Management) and Control 17 (Incident Response Management) map to the supplier and incident lines.

Common failure patterns

• Accepting the role without a mandate: accountable in practice, no authority to block risky changes or reach the board, and blamed after the incident.
• Strategy as a shopping list: tools with no link to critical services or appetite get cut first.
• Board metrics that change every quarter: hides trend and erodes trust.
• Treating disruption as an IT problem: the Jaguar Land Rover cyberattack halted global production, a continuity and supply chain event that needed board-level recovery decisions, not only containment.
• The CISO signing risk acceptances: business owners stop caring. Acceptance belongs to them, with an expiry date.
• Handling an incident outside legal process: paying attackers or delaying notification without counsel is where personal liability arises.

Practitioner checklist

• Get a written mandate covering scope, decision rights, incident authority and access to the committee chair.
• Confirm in week one that the response retainer, counsel and insurer hotline are reachable and recorded offline.
• Complete stakeholder interviews within 30 days and keep a stakeholder map.
• Build an evidence-based baseline against NIST CSF 2.0 or the NCSC CAF by day 45.
• Deliver two or three reversible quick wins, each with an agreed rollback plan.
• Get a risk appetite statement with measurable tolerances approved by the board.
• Present strategy, operating model and at least two funding options by day 90.
• Agree a stable quarterly board pack with three to six metrics and a decisions section.
• Confirm D&O cover and indemnity, and agree the disclosure and notification process with legal.
• Put privileged access, non-human identities and AI agents on the risk register with named owners.

Standards and references

• NIST: The NIST Cybersecurity Framework (CSF) 2.0
• DSIT: Cyber Governance Code of Practice
• NCSC: Cyber Security Toolkit for Boards
• US SEC: SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies
• EUR-Lex: Directive (EU) 2022/2555 (NIS2 Directive)
• World Economic Forum: Principles for Board Governance of Cyber Risk
• NIST: SP 800-55 Vol. 1, Measurement Guide for Information Security
• Help Net Security: Former Uber CSO avoids prison for concealing data breach

Related NHI Mgmt Group resources: Identity Security Programme Guide · Board and CISO Briefing · Cyber Risk Quantification Guide · NIS2 Directive Guide · Business Case Guide. This guide summarises regulatory obligations for security leaders and is not legal advice.