A CISO’s
first 100 days.

The 100-day sequence

1. Days 1–30

   Understand and align

   Meet business and technical stakeholders, identify critical assets and dependencies, and establish the baseline. Assign an accountable owner, review date, and success measure to each of the top five cyber risks. Agree on testing scope and recovery objectives.

2. Days 31–60

   Assess and prioritize

   Assess controls, review privileged access and multifactor authentication, and deliver agreed quick wins. Complete initial authorized adversary, penetration, and live recovery tests by day 60. Proposed targets include completing at least 70% of agreed quick wins and 95% of high-risk role training.

3. Days 61–100

   Execute and measure

   Validate fixes, complete scheduled initial-finding retests and a leadership tabletop by day 90, and report unresolved risks openly. By day 100, present the results, corrective-action owners, and a funded roadmap for the next 6–12 months.

Urgent risks, ownership, remediation tracking, and measurement start in the first month and continue across all three phases.

A proposed organization

The proposed reporting structure connects the CEO, Chief Information and Digital Officer, and CISO with 13 cybersecurity functions. The plan groups those functions into four areas:

• Governance and assurance: governance, architecture, access control, and compliance and audit.
• Security operations: operations, incident response, forensics and investigations, and metrics and reporting.
• Technology and data protection: network security and data protection.
• People and external risk: awareness and training, privacy, and vendor risk management.

This proposed structure gives each function a defined place in the leadership and reporting model.

Testing and evidence

The plan pairs each improvement target with a baseline, an owner, and evidence. Initial authorized technical and live recovery testing finishes by day 60. Critical and high findings have a proposed 14-day repair target, with independently scheduled retests 15–30 days after notification. Those initial-finding retests are scheduled to finish by day 90; unresolved or new failures remain visible in the day-100 report.

Detection and remediation measures use the same approved scenarios, event clocks, and comparison conditions. The proposed target is a 30% reduction from the day-30 baseline. Missed detections, sample counts, and unresolved cases are reported alongside the averages.

Recovery tests require a timed restore or failover, verification of service and data integrity, and business acceptance against approved recovery time and recovery point objectives. A leadership tabletop supports decision practice; the live test supplies recovery evidence.

Resources and the approval decision

The incremental resource model separates the 100-day allocation, a proposed reserve, and recurring costs. These planning estimates require validation of existing entitlements, scope, and vendor terms.

An allocated expense is different from cash due or a minimum contract commitment. Procurement would need to validate licenses, prerequisites, quote-dependent services, and contract terms before approving a purchase.

Source material

Selected sources informing the plan:

• Northrop Grumman — 2025 Form 10-K
• NIST Cybersecurity Framework 2.0
• NIST SP 800-115 — Technical Guide to Information Security Testing and Assessment
• NIST SP 800-55 Volume 1 — Identifying and Selecting Measures
• NIST SP 800-34 Revision 1 — Contingency Planning Guide