Your First 100 Days as a New CIO: A Practical Plan

The first 100 days in a CIO role set expectations that can last for years. Move too fast and you may fix the wrong problems and alienate the people you need. Move too slowly and the organization may decide nothing has changed.

The 100-day frame is a convention, not a rule. What matters is the sequence: listen, assess, act on a few visible things, then commit to a strategy that your peers helped shape. The plan below works whether you are an internal promotion or an external hire, and whether your organization has 100 employees or 10,000. Adjust the timing to your situation.

Before day one

Use the time between offer and start date well.

• Clarify your mandate with your new boss. What are the two or three outcomes they expect in the first year? What is explicitly not your job?
• Confirm scope and decision rights. Know whether security, data, and product engineering report to you, and who approves budget changes.
• Request background material: the current IT budget, major contracts and renewal dates, the project portfolio, recent audit findings, and any open incidents.
• Ask for a list of the 15 to 25 people you most need to meet, inside and outside IT.

Days 1 to 30: listen and learn

Your most important job in the first month is to understand, not to decide. Make it clear that you are listening on purpose.

Meet your direct reports one on one. Ask each of them:

• What is working that I should protect?
• What is broken that everyone knows about?
• What would you do first if you were in my seat?
• What do you need from me?

Meet peer executives and key business leaders. Ask what they need from technology, where IT helps them, where it frustrates them, and what a great IT partner would do differently.

Spend time where the work happens. Sit with the service desk, join an operations meeting, and watch frontline employees use core systems. The view from the floor is often different from the view in executive meetings.

Keep a running list of themes. By the end of the month, patterns will emerge. Write them down and share a short summary of what you heard with your team and your boss. Showing people that you listened builds trust before you ask anything of them.

Days 1 to 60: assess the foundation

In parallel with listening, build a fact base in five areas.

1. Portfolio. Inventory major systems and active projects. For each project, note the sponsor, budget, status, and business outcome. Federal law offers a useful model here: under 40 U.S.C. 11315, agency CIOs monitor IT program performance and advise whether to "continue, modify, or terminate" each program. Even outside government, you should be ready to make those calls.
2. Money. Understand the budget, how it compares to demand, and where it goes. List major contracts with renewal dates; an upcoming renewal is both a risk and an opportunity.
3. Security and risk. Get a baseline of the cybersecurity program. NIST's Cybersecurity Framework 2.0 organizes outcomes into six functions: Govern, Identify, Protect, Detect, Respond, and Recover. Its Govern function covers how the organization's cybersecurity risk management strategy, expectations, and policy are "established, communicated, and monitored." Asking how your organization addresses each function is a quick way to find gaps. For smaller organizations, CISA's Cyber Essentials, written for leaders of small businesses and small and local government agencies, offers a simpler starting point.
4. Resilience. Confirm that backups exist, are tested, and can be restored, and that a contingency plan covers critical systems. NIST SP 800-34 Rev. 1, the Contingency Planning Guide for Federal Information Systems, includes a business impact analysis template that can help you identify which systems matter most.
5. People. Map the team's structure and skills against what the strategy will need. The same federal statute asks agency CIOs to assess annually the knowledge and skills their staff need and to develop strategies for hiring and training to close gaps. That is a sound practice anywhere.

Be careful about announcing conclusions too early. Treat this phase as discovery, and verify what you hear before you act on it.

Days 31 to 60: early wins and early decisions

By the second month, you should act on a small number of things. Good early wins are visible, low-risk, and responsive to what people told you. Examples might include:

• Fixing a long-standing irritant that business leaders mentioned repeatedly, such as a slow approval process for new laptops.
• Pausing a project that has no clear sponsor or outcome.
• Clarifying how IT requests are prioritized, so business leaders know where they stand.
• Addressing an urgent security or resilience gap found during your assessment.

Some decisions can't wait. If you find a serious risk, such as untested backups for a critical system, act now and explain why. Waiting for a strategy to fix an urgent exposure is a mistake.

For example, imagine a new CIO at a 900-person regional health system who hears from three department heads that printing prescriptions fails several times a week. Fixing it is not strategic, but it shows that the new CIO listens and delivers, which earns patience for the harder changes ahead.

Days 61 to 100: strategy and roadmap

Now turn your findings into a direction.

• Draft a short strategy: where technology needs to take the organization, the few priorities that matter most, and what you will stop doing.
• Test the draft with peers before presenting it. A strategy your peers helped shape is far easier to fund.
• Propose a governance approach: how projects get approved and funded, how security risk is accepted, and who decides what.
• Set a small number of measures you will report regularly, such as service reliability, project delivery, and progress on top risks.
• Decide on organizational changes, if any. If you need to restructure, do it once, explain why, and move quickly so people are not left in limbo.

End the 100 days with a presentation to your boss and peers covering what you heard, what you found, what you have done, and what comes next.

Common mistakes to avoid

• Bringing your last organization's plan. What worked there may not fit here.
• Criticizing your predecessor. The people who built the current systems may still be on your team.
• Ignoring your own team while courting executives. Your direct reports carry out the strategy.
• Promising too much. Under-commit and deliver.
• Neglecting yourself. A new executive role is demanding; protect time to think.

Key takeaways

• The sequence matters more than the exact timing: listen, assess, act on a few things, then set strategy.
• Assess five foundations: portfolio, money, security, resilience, and people.
• Use recognized frameworks such as NIST CSF 2.0 and NIST SP 800-34 to structure your security and resilience review.
• Choose early wins that are visible, low-risk, and grounded in what people told you, and act immediately on urgent risks.
• Build your strategy with your peers, not for them, and end the 100 days with a clear account of what comes next.

Sources

• National Institute of Standards and Technology, The NIST Cybersecurity Framework (CSF) 2.0 (February 26, 2024)
• National Institute of Standards and Technology, SP 800-34 Rev. 1, Contingency Planning Guide for Federal Information Systems (May 2010, updated November 11, 2010)
• Cybersecurity and Infrastructure Security Agency, Cyber Essentials
• Legal Information Institute, Cornell Law School, 40 U.S. Code 11315: Agency Chief Information Officer