Commanding the Crisis: An Interim CISO's 90-Day Roadmap to Boardroom Confidence

When an organisation faces a cybersecurity crisis — whether a significant breach, regulatory enforcement action, or the sudden departure of security leadership — the appointment of an interim CISO requires a fundamentally different approach than permanent leadership transitions. The interim CISO must simultaneously stabilise immediate threats, establish credibility with the board and executive team, and lay foundations for sustainable security improvement, all within a compressed timeline that typically spans ninety to one hundred and eighty days.

This paper presents a battle-tested framework developed through multiple interim CISO engagements across Tier 1 financial institutions, providing a structured approach to the first ninety days that has consistently delivered boardroom confidence and measurable security improvement. The framework is organised into three thirty-day phases: Assess and Stabilise (Days 1-30), Remediate and Build (Days 31-60), and Transform and Sustain (Days 61-90).

Phase one focuses on rapid situational assessment, including evaluation of existing security controls, team capability assessment, identification of immediate vulnerabilities and compliance gaps, and establishment of communication channels with key stakeholders. The paper provides specific templates for initial board presentations that establish credibility while managing expectations about timeline and resources.

Phase two addresses the most critical remediation activities identified during assessment, the establishment of security governance frameworks, and the development of a strategic roadmap that will guide the organisation beyond the interim engagement. Phase three focuses on building sustainable security capabilities, recruiting or developing permanent leadership, and transitioning from crisis management to strategic programme execution. Throughout all phases, the paper emphasises the critical importance of board communication, providing frameworks for translating technical security concepts into business risk language that resonates with non-technical executives.