The CISO’s 100-Day Plan — A Roadmap for New Security Leaders By CyberDudeBivash • Date: September 21, 2025 (IST)
TL;DR First 72 hours: stop the bleeding (privileged MFA, backups/keys, logging, edge devices), establish comms, review open incidents. Days 1–30 (Stabilize): baselines, crown jewels, identity hygiene, EDR/patch coverage, IR readiness, quick wins. Days 31–60 (Align): risk register, 12-month roadmap & budget, policy refresh, operating model, vendor rationalization. Days 61–100 (Execute): tabletop & DR test, OKRs live, talent plan, secure SDLC rollout, board-level narrative and metrics. The First 72 Hours — “Stop the Bleeding” Objectives: assure the CEO/Board you have control; reduce catastrophic risk quickly. Actions (do now) Privileged access & identity Enforce phishing-resistant MFA for all admins; rotate break-glass creds; restrict legacy auth. Freeze high-risk changes on SSO/IdP and internet-facing devices. Backups & crypto Verify immutable, offline backups for crown jewels (AD/Entra, critical DBs, core apps). C...