First Security Hire: First 90 Days Playbook

The first and only security person in a small company is expected to fix everything at once with no team, little budget and a queue of customer questionnaires, and most fail by spreading themselves across every request instead of choosing the few things that matter. This playbook is for that person: the first security engineer, security lead or IT-and-security generalist in an organisation of roughly 30 to 300 people. It covers how to set scope and decision rights in week one, find the real risks quickly, use free and built-in controls before buying tools, handle the inbound load of questions and questionnaires, decide what to outsource, and protect your own time. Enterprise CISOs inheriting a team should use the CISO Guide: First 90 Days instead; this page assumes you are the team.

Source note: baseline and service references are from CISA, CIS, NIST, the NCSC and Microsoft, as listed under Standards and references; the 90-day plan, headcount thresholds and outsourcing rules are NHI Mgmt Group recommendations. Confirm against the official text before relying on it.

Key takeaways

Agree what you own in writing in week one. A one-page scope that says what you decide, what you advise on and what stays with IT or engineering prevents you becoming the default owner of every problem.
Find the doors an attacker would use first. Internet-facing systems, email and identity admin, production cloud and backups matter more than any policy in the first month.
Turn on what you already pay for. Identity provider defaults, cloud provider guardrails, code hosting security features and free government services close most early gaps at no extra cost.
Turn inbound requests into a queue. A single intake route, an answer library for questionnaires and published standards stop interruptions consuming the week.
Outsource 24x7 work, not judgement. Buy round-the-clock monitoring and incident response retainers; keep risk decisions, priorities and relationships in-house.

What makes the solo role different

A security leader with a team delegates; a solo security person must choose. The differences shape every decision in the first 90 days.

Dimension	Enterprise CISO	First security hire	What it means for you
Capacity	Team of specialists, managed services	One person, often part of their time on IT or engineering work	Pick three priorities per quarter and say no to the rest, in writing
Budget	Annual security budget line	None, or a share of IT or engineering spend	Use built-in and free controls first; tie every purchase to a deal, a contract or a named risk
Authority	Defined mandate and board access	Influence through the CTO, COO or CEO	Get decision rights confirmed by your manager and announced to the company
Main pressure	Board, regulators, audit	Customer questionnaires, audits for sales, incidents	Build reusable answers and evidence early
Hands-on work	Rarely	Daily: configuring, scripting, investigating	Automate repeat checks so you can step away

Week one: scope, decision rights and allies

Write a one-page scope with your manager: what you own (security standards, risk register, incident coordination, customer security assurance), what you advise on (architecture, supplier choice), and what others own (laptops and accounts with IT, production changes with engineering). See the Security Programme Charter Template for headings.
Confirm incident authority: who can declare an incident, who can take a system offline, who talks to customers and who calls legal or the insurer. Write the names on one page.
Get admin visibility, not just admin rights: read access to the identity provider, cloud accounts, code hosting organisation, email security console and device management, so you can see before you change.
Meet the people who run things: the IT lead, engineering leads, finance (payments and suppliers), people team (joiners and leavers), sales (questionnaires) and customer support (account recovery). Ask each what worries them and what security has ever blocked.
Find the history: past incidents, penetration test reports, audit reports, questionnaires already sent and any cyber insurance proposal form. These tell you what has been promised.

Days 1 to 30: find the real risks fast

Do not start with a framework assessment of every control. Start with the questions an attacker would answer first, test them with evidence, and record what you find in a simple risk register.

Question	How to check quickly	Typical first fix
What is exposed to the internet?	Cloud console listings, DNS records, an external scan; in the US, CISA's free Cyber Hygiene vulnerability scanning of internet-facing systems where eligible; in the UK, NCSC Check your Cyber Security	Close unowned services; patch known exploited vulnerabilities first
Can a stolen password open email, cloud or code?	Identity provider reports of MFA registration and legacy authentication sign-ins	Enforce MFA for all, phishing-resistant for admins; block legacy authentication
Who has admin rights?	Role assignments in the identity provider, cloud and code hosting	Remove standing admin where possible; separate admin accounts
Can we recover production data?	Backup configuration and the date of the last restore test	Isolated backup copy and a timed restore
Would we notice an intrusion?	Which logs exist, where they go and who reads alerts	Centralise identity, cloud and endpoint alerts; agree who watches them
What have we promised customers?	Contracts, questionnaire answers, trust page	List commitments you cannot yet meet and plan them

Use CISA's Cross-Sector Cybersecurity Performance Goals as a cross-check: they are a voluntary baseline aimed especially at small and medium organisations, and include an asset inventory refreshed at least monthly (goal 1.A), mitigation of known exploited vulnerabilities on internet-facing systems (1.E) and phishing-resistant MFA, with SMS or voice as a last resort (2.H). For the full baseline, CIS Controls v8.1 Implementation Group 1 lists 56 safeguards designed for organisations with limited IT and security expertise. See the Security Programme Building Guide for how these fit a longer programme.

Days 30 to 60: free and built-in controls first

Most small companies already pay for platforms with strong security features that are switched off. Turning them on is faster and cheaper than buying new tools, and easier to defend when budget is zero.

Identity provider: on Microsoft Entra ID free tier, security defaults enforce MFA registration for all users with Microsoft Authenticator number matching, MFA for administrators on every sign-in, and block legacy authentication and device code flow, at no extra cost. Microsoft's documentation says security defaults are probably not right for organisations with Entra ID P1 or P2, which should consider Conditional Access, and that security defaults must be disabled when Conditional Access policies replace them. Test the change with a pilot group and keep an emergency access account. See the Small Business Identity and Access Security Guide.
Google Workspace: enforce 2-Step Verification and review admin roles. See Google Workspace for Small Business.
Email domain: SPF, DKIM and DMARC, moving DMARC to enforcement once reports are clean. See the DMARC, SPF and DKIM Guide.
Devices: the device management service you already license for disk encryption, screen lock, updates and remote wipe. See the Small Business Device Management Guide.
Cloud: the provider's native audit logging and security posture service, with alerts for root or owner account use. See the AWS Security Checklist if you run on AWS.
Code hosting: branch protection, secret scanning and dependency alerts. See the CI/CD Security Guide.
Machine credentials: list service accounts, API keys and integration tokens with an owner each; they are often the least visible access in a small company. See the CI/CD Pipeline Identity Security Guide.
Government services: CISA maintains a catalogue of free cybersecurity services and tools, mapped to the performance goals, including Cyber Hygiene scanning and CPG assessments for small and medium organisations. In the UK, the NCSC Small Business Guide covers email, accounts, devices, backups and spotting attacks, and Exercise in a Box supports incident rehearsal.

Rolling out safely: run each change in report or audit mode first where the platform supports it, pilot with IT and engineering, announce changes a week ahead, record exceptions with an owner and an end date, and know how to reverse the change in minutes. Brief the service desk before enforcement day.

Handle the inbound load

In many small companies the first security hire spends more time answering questions than fixing risks. Treat inbound work as a product with a queue.

One intake route: a channel or ticket form for security questions, access requests and suspected phishing, with a stated response time. Direct messages get redirected politely.
Answer library: a maintained set of approved answers for customer questionnaires, with evidence links. Sales can answer the routine 80% themselves; you review only the rest.
Trust page and standard documents: a public overview, a shareable policy summary and the latest penetration test letter reduce questionnaires before they arrive.
Published standards: short rules for common decisions (approved file sharing, how to request admin, how to onboard a new SaaS tool) so teams do not need to ask.
Honest answers: never answer "yes" for a planned control; write "planned for [quarter]". Overstated answers become contract terms. See the How to Read a SOC 2 Report Guide for what auditors and buyers look for.

Days 60 to 90: the plan, the budget and what to outsource

By day 60 you know enough to propose a 12-month plan. Keep it to one page: the top five risks, what you will do about each by quarter, what it costs, and what you are explicitly not doing yet.

Work	Do it yourself	Outsource	Decision rule
24x7 alert monitoring	Not realistic alone	Managed detection and response (MDR)	Outsource once endpoint and identity alerts exist and nobody watches them out of hours. See the MDR Guide.
Incident response for a major breach	Coordination, decisions, communications	Incident response retainer	Agree a retainer before you need it; check the insurer's panel first
Penetration testing	Scoping, fix tracking	Independent tester	Annually and after major changes; buyers expect independence
Strategy and board advice	Day-to-day priorities	vCISO for a few days a month	When leadership wants senior direction you cannot yet give. See the vCISO Guide.
Policy writing	Yes, from templates	Rarely needed	Write what you actually do, in short documents
Awareness training	Targeted briefings for finance, admins and support	Platform for baseline modules	Buy only when headcount makes live briefings impractical

Small versus larger: at 30 to 80 people, a solo lead can run the whole plan with an MDR service and a retainer. Above about 150 people, or with regulated customers, plan the second hire, usually a security engineer to take hands-on work so the lead can focus on risk, assurance and incidents.

Protect your own time and resilience

Single point of failure: you are one. Document how to reach the MDR provider, the retainer, the cloud provider's support and the registrar, and give a deputy in IT or engineering the ability to act if you are away. See the CISO Succession guide.
On-call boundaries: agree what genuinely needs you out of hours, and route everything else to the MDR provider or the next working day.
Champions: one interested engineer per team who reviews security-relevant changes extends your reach. See the Security Champions Programme Guide.
Visible wins: report monthly in a short note so leadership sees progress and understands the trade-offs you made.

Measuring the first 90 days

MFA coverage: percentage of human accounts with MFA, and of admins with phishing-resistant methods.
Exposure: number of internet-facing services without an owner, and known exploited vulnerabilities open on internet-facing systems.
Standing admin: count of accounts with permanent global or owner rights, trending down.
Restore test: date and duration of the last successful restore of production data.
Questionnaire load: share of questionnaires answered from the library without your involvement.
Risk register: top five risks with an owner and a dated action, reviewed monthly with your manager.

Framework mapping

Activity	NIST CSF 2.0	NIST SP 800-53 Rev. 5	CIS Controls v8.1
Scope, decision rights, incident authority	GV.RR-02	PM-2	Control 17
Risk register and 12-month plan	GV.RM-02, ID.IM-01	RA-3, PM-1	Not covered directly
Internet exposure and inventory	ID.AM-01, ID.AM-02	CM-8	Controls 1 and 2
Known exploited vulnerability fixes	ID.RA-01, PR.PS-02	SI-2	Control 7
MFA and admin control	PR.AA-01, PR.AA-05	IA-2, AC-6	Controls 5 and 6
Backups and restore	PR.DS-11	CP-9	Control 11
Monitoring and MDR	DE.CM-01	SI-4	Control 13
Supplier and service provider choice	GV.SC-05	SA-9	Control 15

Common failure patterns

Saying yes to everything: becoming the help desk for every access request and the reviewer of every contract, with no time left for the top risks.
Buying tools before turning on features: purchasing a product that duplicates controls already licensed in the identity provider or cloud platform.
Policy first: spending the first two months writing a full policy set while MFA gaps and exposed services remain.
Owning without authority: accepting accountability for incidents without the right to take systems offline or require fixes.
Forgetting machine access: securing every employee login while long-lived API keys and integration tokens with broad rights stay unowned.
No deputy: an incident during the security lead's holiday with nobody else able to call the MDR provider or the retainer.

Practitioner checklist

Agree a one-page scope and incident authority with your manager in week one, and announce it.
Get read access to identity, cloud, code hosting, email security and device management consoles.
Answer the six attacker questions with evidence and record the results in a risk register.
Enforce MFA, block legacy authentication and reduce standing admin using features already licensed.
Confirm an isolated backup and complete a timed restore of production data.
Set up one intake route and an answer library for customer questionnaires.
Arrange MDR and an incident response retainer once alerts exist that nobody watches out of hours.
Present a one-page 12-month plan by day 90, including what you are not doing yet.
Name a deputy and document the emergency contacts they would need.

Standards and references

Related NHI Mgmt Group resources: CISO Guide: First 90 Days · Startup Security Roadmap · vCISO Guide · Security Programme Charter Template

First Security Hire: Your First 90 Days as the Only Security Person