A CIO's First 90 Days: What a New or Interim CIO Should Do, Phase by Phase

The short answer

A new or interim CIO should spend the first 90 days in three phases: listen and assess (days 1 to 30), stabilise and prioritise (days 31 to 60), and commit to a plan (days 61 to 90). The goal is not to launch a transformation in week one, but to understand the business, remove the biggest risks, secure a few visible wins and earn the authority to lead change.

Why do the first 90 days matter so much?

A CIO's early decisions set the tone for everything that follows. Move too fast and you risk changing things you do not yet understand. Move too slowly and the organisation decides you are not going to make a difference.

The first 90 days are also when you have the most licence to ask basic questions, challenge assumptions and request information. That window closes quickly.

For an interim CIO, the timeline is compressed. The same phases apply, but stabilisation often starts in the first fortnight, particularly if the role exists because of a departure, an incident or a failing project. See when to hire an interim CIO for the common triggers.

The 90-day plan at a glance

Days 1 to 30: listen and assess

Meet the business before the technology

Start with the CEO, executive team and key operational leaders. Ask each of them:

• What does technology do well for your team today?
• What slows you down or frustrates you most?
• What would you change if you could change one thing?
• What is coming up in the next year that technology needs to support?

These conversations tell you where technology is creating or destroying value, which matters more than any infrastructure diagram.

Understand the IT team and providers

Meet every member of the IT team and the account managers for major providers. Look for capability gaps, single points of failure and unclear responsibilities. Note where the managed service provider is fixing tickets but no one owns strategy, a pattern discussed in this guide.

Build a factual baseline

Gather the essentials:

1. Systems inventory. Core applications, who owns them, and how they connect.
2. Contracts and spend. Every significant vendor, renewal date, notice period and annual cost.
3. Projects in flight. Status, budget, sponsor and honest health.
4. Security posture. Identity management, backups, patching, incident response, recent audit findings.
5. Operational health. Outages, ticket trends, user satisfaction.

Identify the risks that cannot wait

By the end of the first month you should know whether there is anything that could seriously hurt the business: untested backups, an expired support contract on a critical system, a project about to fail, or a security gap with obvious exposure.

Days 31 to 60: stabilise and prioritise

Address the urgent risks

Act on the issues that cannot wait. This might mean testing and fixing backups, tightening administrator access, enabling multi-factor authentication everywhere, or pausing a project that is heading for failure. For Microsoft-centric environments, a focused Microsoft 365 security review can quickly surface the most common gaps.

Deliver a few visible quick wins

Pick two or three improvements that matter to the business and can be delivered within weeks. Examples:

• Fixing a recurring outage that frustrates a key team
• Cancelling unused licences or duplicate subscriptions
• Simplifying a painful approval or onboarding process
• Giving executives a clear monthly view of IT spend and risk

Quick wins build credibility. They show you listened during the first month.

Set up governance

Establish a simple rhythm:

• A monthly technology report for the executive team
• A regular review cadence with major providers against service levels
• A clear process for approving new technology spend and projects
• A risk register that is actually maintained

Governance does not need to be heavy. It needs to make decisions visible and accountable.

Make early people decisions

You will have formed views on the team and providers. Some decisions can wait; others, such as an underperforming provider on a critical service, may need action. Be fair, be clear and document your reasoning.

Days 61 to 90: commit to a plan

Agree the technology direction

Translate what you have learned into a short, business-focused plan:

• Where technology needs to support the business strategy
• What must be fixed, replaced or retired
• Which investments matter most and in what order
• What it will cost and what the business should expect in return

Keep it readable. A ten-page roadmap that executives understand beats a hundred-page document no one reads.

Align budget and resourcing

Present a realistic budget view that separates run costs, risk remediation and growth investment. Show where savings have been or can be found, so new investment is not seen purely as additional cost.

Report to the board

Give the board a clear, plain-English update on technology risk, priorities and progress. Boards increasingly expect this, particularly on cyber security.

Common mistakes to avoid

• Announcing a transformation in week two. You do not yet know enough.
• Ignoring the existing team. They know where the problems are, even if they have not been heard.
• Focusing only on infrastructure. Business outcomes matter more than technical neatness.
• Accepting project status reports at face value. Verify health independently.
• Leaving contracts until later. Renewal dates can lock you in for years.

What changes for an interim CIO?

An interim CIO usually has a narrower mandate and less time. The priorities shift:

• Stabilisation often comes first, in parallel with assessment.
• The plan should include a clear handover, including to a permanent CIO if one is being recruited.
• Documentation matters more, because the next leader will need it.

How The Technology Office supports a CIO's first 90 days

The Technology Office provides interim CIO and fractional CIO leadership to businesses of any size and industry across Australia, and this structured first 90 days is how we start most engagements. Because we are independent and vendor-neutral, with no software or managed services to resell, the assessment and recommendations are focused on your cost, delivery and risk outcomes.

Whether you need a senior CIO to step in during a gap, stabilise a difficult situation, or build a plan your board can back, we provide executive technology leadership on flexible terms with measurable results from the first month.