The First 90 Days as CISO

Now that we are set, let's div into your Month 1 of our 90 days roadmap to success

So, let's dive in and explore how you can set yourself up for success from day one! First things first, you've just accepted that job offer—congratulations! Now, before you even step foot in the office, this is your golden opportunity to do some serious homework.

Researching your new company is essential.

Many organizations provide planning documents to help new hires acclimate quickly.

If you have access to these, make sure to review them thoroughly.

This knowledge will empower you to hit the ground running. But don't stop there! Take the time to decipher the organizational culture.

What's the real vibe like? How many hours do people actually work? What are interactions like among employees, both inside and outside the office? Are you expected to be available around the clock? Understanding the hierarchy and the expected protocols for interacting with higher-ups can save you a lot of potential stress down the line.

Mismatched expectations can lead to friction, so it's best to get ahead of this. Next, let's talk about the state of the security team.

It's crucial to familiarize yourself with the current dynamics and identify any weak areas that need addressing.

Dive into the InfoSec, SOC, and GRC teams to assess their effectiveness and alignment with business goals.

Understanding how resources are allocated will help you make informed decisions right from the start.

And here's a pro tip: uncover why the Chief Information Security Officer role was vacated.

If it's a new position, that's one thing, but if someone previously held the role, find out what went wrong.

This knowledge will be invaluable as you build your strategy moving forward. Now, I want you to picture yourself three years down the line.

What achievements do you want to have under your belt? What benchmarks do you hope to meet? Visualizing your goals will help you shape your vision for your program, which can always be refined later.

Let these aspirations guide your actions and decisions. But hold on! Before you jump in with both feet, take a step back and listen.

I know it's tempting to dive right into changes, but this is the time to absorb everything around you.

Get to know your new organization and your team.

Practice active listening—pay attention to both verbal and non-verbal cues.

This will help you gauge underlying sentiments and identify recurring themes or concerns that may need further exploration. And here's where it gets interesting: ask questions! This is your chance to be curious and gather knowledge.

There's a grace period when you can be that "nudge," asking endless questions to extract vital information.

After this period, people will expect you to know certain things, so make the most of it while you can. What should you ask? Start with the initiatives already in process.

What's been done to achieve them, and how do they fit into the overall strategy? Are current processes more proactive or reactive? What are the biggest blind spots? Understanding the security culture is key—does the organization view security as a business enabler or a hindrance to innovation? Also, consider how teams interact.

Is there a common language of risk, or do they work in silos with their own benchmarks? What compliance frameworks does the company adhere to, and when was the last vendor review or risk assessment conducted? Encourage open dialogue with thoughtful questions that prompt deeper discussions.

Seek clarification on current processes and policies to gain a comprehensive understanding of the security landscape.

Challenge assumptions and dig for root causes to uncover potential vulnerabilities or inefficiencies. So, there you have it! By laying a solid foundation, actively listening, and asking the right questions, you'll be well on your way to making a significant impact in your new role.

Remember, this journey is all about growth and learning, and I can't wait to see how you all thrive in your new adventures! Keep pushing the boundaries of what's possible, and let's continue to innovate together!