How I Plan the First Ninety Days
Most ninety-day plans are written to win a job and then quietly abandoned in week two. This is a method I actually run. The worked example below is a semiconductor manufacturer, because that is where I last applied it, but the structure holds for any regulated business where operations come first and security has to earn its place at the table.
The argument
A security executive joining a manufacturer, a utility or a bank arrives with a problem of sequence rather than a problem of knowledge. The gaps are usually visible within a fortnight. Acting on them in that fortnight is how a program dies, because the organization has not yet decided whether to trust the person proposing the change.
So the first ninety days are not a delivery schedule. They are a deliberate sequence for earning the standing required to deliver. The plan commits to listening before proposing, to sequencing before building, and to reporting outcomes in the language the business already uses.
Days 1 to 30: listen, learn and map
Nothing is proposed in the first thirty days. The commitment is to understand the operating environment before assessing its security, which in a manufacturing business means walking the floor before writing anything down.
Three things get mapped. The people: the hiring executive and their stated priorities, the CEO, CFO, General Counsel and the Board audit liaison, every direct report, and the cross-functional partners where security either enables throughput or becomes friction. The environment: operational technology architecture, the IT and OT convergence boundary, remote access posture, every vendor and contractor access path, and the data pipeline from the plant floor to the cloud. The landscape: what security exists, what is effective, and what the regulatory obligations actually require rather than what the last assessment said they required.
The phase closes with a written current-state assessment and a prioritized risk map, presented in week five. That date is the point. A deadline inside the listening phase is what stops it becoming an indefinite tour.
Days 31 to 60: prioritize, align and begin
The assessment becomes a sequenced, capital-disciplined plan. Sequencing is the hard part and the place most programs fail: everything is urgent, so nothing is.
The ordering rule is that the irreplaceable comes first. Intellectual property, and the operational technology that produces it, cannot be restored from backup and cannot be re-earned once a nation-state actor has a copy. Data protection and supply chain risk run in parallel, because they share the same discovery work. Governance threads through everything rather than standing as a phase of its own, because governance introduced after a program is built is experienced as bureaucracy.
Execution begins inside this phase, on the initiatives with the highest value and the lowest friction. Waiting for a complete plan before starting anything spends the goodwill earned in phase one.
The phase closes with a twelve-month roadmap carrying an investment case, not a wish list.
Days 61 to 90: execute, measure and communicate
Visible progress, in business terms. The measure of success is not the number of controls implemented. It is the risk reduced, the capability created, and the business enabled.
This phase establishes the reporting rhythm that outlasts it: an executive dashboard carrying security posture alongside the operational metrics leadership already tracks, and security inside the business planning cycle as a participant rather than a gate at the end of it.
It closes with a strategic briefing. What was learned, what was built, and what the twelve-month program looks like.
What makes this a method and not a template
Five rules carry across every use of it.
- The listening phase gets a deadline and a deliverable. Otherwise it expands, and the credibility it was meant to build leaks away.
- The hiring executive's own priorities are named and threaded through all three phases. A security plan that does not visibly serve the mandate of the person who hired you is a plan about security rather than about the business.
- Each phase ends in an artifact with a named recipient and a date. Three commitments a reader can hold you to are worth more than thirty activities they cannot.
- Sequence by what cannot be recovered. Not by what is easiest, and not by whatever the last audit flagged.
- Every section answers the same four questions. Why leadership, the Board or the regulator cared. What capability was created. What risk was reduced. How the business was enabled. A line that answers none of them does not belong on the page.
Using this yourself
The structure is free to take. The three phase titles, the deliverable at the close of each phase, and the five rules above are the whole of it. What does not transfer is the content. The priorities, the risk ordering and the deliverables have to come from that business, in its language, after you have listened.
Illustrative example. The company, the individuals and all internal details have been generalized. Copyright 2026 Ed Goff. All rights reserved.
Back to How I Work