Commanding the Crisis: 90-Day Roadmap to Boardroom Confidence

When a new CISO arrives — or when an existing CISO needs to reset the security function's credibility — the first 90 days determine everything. This paper provides a structured roadmap for commanding the crisis: establishing board-level confidence in the organisation's cyber resilience within a compressed 90-day timeline. The roadmap is structured in three 30-day phases: Assess (understanding the current state, identifying critical gaps, and establishing baseline metrics), Architect (designing and initiating the most impactful improvements), and Assure (demonstrating measurable progress to the board and establishing ongoing governance cadence).

Each phase includes specific deliverables, stakeholder engagement strategies, and communication frameworks designed to build confidence progressively. The roadmap draws on the author's experience of multiple CISO transitions across Tier 1 financial institutions.