A Stack of Audit Findings on Day Three: The CISO Priorities Checklist for Your First 30 Days, Six Months, and Year

The views expressed are my own and do not represent those of my employer.

Picture a CISO on day three. She is fictional, but you may know her. She started Monday. By Wednesday afternoon, internal audit has dropped a stack of open findings on her desk, some of them two years old, and the CFO wants to know when they will close. Her mandate, as the CEO put it during the interview, was to make the company more secure. Nothing about that is written down.

She does what most of us would do. She reads the findings, sorts them by severity as the auditors labeled them, and starts assigning owners. By Friday she has a tidy plan. Six weeks later she has closed a handful and stalled on the rest. One finding requires retiring a legacy integration, and the plant manager says security has no authority to touch it. Another sits at the top of her list only because the auditors scored it high, while the exposure that could actually hurt the company was never on her list because nobody had built a risk register.

She did not lack effort. She lacked order. The charter and the risk register had to come before the triage of the findings, and she skipped both because the findings were loud and the other two were quiet. This post is about getting that order right across a full year.

Why Order Beats Effort in Year One

New CISOs inherit three things on arrival: audit findings, a vague mandate, and a budget that will not move. The budget part is not a feeling. The IANS 2026 Security Budget Benchmark found median growth hit 0% for the second straight year, and 55% of security leaders saw flat or shrinking budgets. The same data shows a gap between asking and getting: 64% of CISOs asked for an increase, and only 45% received one. The IANS and Artico Search report drew on over 500 security executives surveyed between April and August 2026.

Flat money changes how you plan. You cannot buy your way out of a bad sequence. If you spend your first six months on the wrong work, you do not get a second budget to fix it. Order becomes your most valuable resource.

A word on where this checklist comes from. IANS publishes a well known New CISO Priority Checklist, and if you have seen it, some of the items below will look familiar. A new CISO checklist has to cover the same ground: charter, risk, third parties, incidents, audit findings, identity. What I add is the sequencing, the dependencies between items, a short list of things I refuse to skip at each stage, and a 2026 refresh with current budget data and breach lessons.

I am also not going to rebuild the day by day detail here. That lives in my posts on the first 30 days, days 31 to 60, and days 61 to 90. This post is the full year view: nineteen items in three horizons, plus one I added for 2026. Each horizon ends with a refuse to skip line and a note on what depends on what.

A charter makes every later decision defensible. Without one, every decision is a negotiation you have to win again.

Days 1 to 30: Write Down Who Decides Before You Decide Anything

The first horizon has four items. Item 1 is the charter. Item 2 is the risk register. Item 3 is a policy review. Item 4 is a working definition of your data. None of these will impress anyone in week two. All of them decide whether weeks twenty and forty go well.

Item 1: The charter. A charter is a short document, signed by someone with real authority, that says what security owns, what it advises on, where it reports, and what it can stop. NIST CSF 2.0 is direct about the expectation. GV.RR-02 says roles, responsibilities, and authorities related to cybersecurity risk management are established, communicated, understood, and enforced. Read the four verbs again. Established is the easy one. Enforced is where most charters die. GV.RR-03 adds that adequate resources are allocated commensurate with the cybersecurity risk strategy, roles, responsibilities, and policies. In plain terms, your authority and your resources have to match your mandate.

Item 2: The risk register. Start small. Ten to fifteen real risks, each with a named business owner, a plain language description of the loss, and a rough sense of likelihood and impact. Do not wait for a perfect scoring model. A rough register that executives recognize beats a precise one nobody has read. While you build it, ask who has defined the company's risk appetite. In most organizations the honest answer is nobody, and finding that out early is useful.

Item 3: Policy review. Read what exists. Note what is outdated, what contradicts something else, and what nobody follows. Do not rewrite anything yet. You are collecting evidence for item 17, the gap between what policy says and what people do.

Item 4: Data definition. Get agreement on what counts as sensitive data, where it lives, and who owns it. Without that, your risk register is guessing at impact.

Refuse to skip: the charter. It is the item most likely to get pushed because it feels like paperwork. Hold the line. If your authority is unclear, every later conflict, from a finding that needs a system shut down to a headcount request, becomes a debate about whether you are allowed to ask.

What depends on what: The charter gives you standing to build the register. The register gives you the ranking you will need when you triage audit findings in item 9. The data definition feeds the register's impact scores. The policy review feeds the gap analysis in item 17.

Months Two to Six: Measure, Benchmark, Study, and Plan

The second horizon covers items 5 through 11, and it is where you turn listening into evidence. I am adding a twentieth item here for 2026, an inventory of AI tools and agents. You will see why in a moment.

Item 5: Metrics and dashboard. Build a short dashboard tied to your top register items. Five to eight measures, each one answering a question an executive would ask. Resist the urge to show everything you can measure. I will return to why the order matters when we get to board support.

Item 6: Resource benchmarking. Compare your staffing and spend against peers, and write down the gaps. IANS and Artico Search put security at 10.9% of IT budgets in 2025 and 9.9% in 2026. Use numbers like these as a reference point, adjusted for your size and industry, not as a target. The reason to document gaps early is timing. Budget cycles close before you feel ready, and a gap you recorded in month three is a credible request in month nine. A gap you notice in month ten is a complaint.

Item 7: Third party risk. Inventory the vendors that touch your data, your operations, or your identity systems. Start with the ones you could not run the business without. Ask what each contract requires them to do, and what it requires them to prove. If you want the framework view, CSF 2.0 treats this under its supply chain category, GV.SC.

Item 8: Past incidents and public breaches. Read your own incident history and the public breaches in your industry. Ask what failed, what the detection gap was, and whether the same conditions exist here. This is the cheapest education available to you. It also tells you which register items are real.

Item 9: Audit findings. Now triage the stack. With a charter and a register in hand, you can sort findings by business risk instead of auditor labels, group the ones that share a root cause, and tell the audit committee what you will fix, what you will accept, and what you need help to fix.

Item 10: The roadmap. Build it from the register, the benchmark gaps and the triaged findings, in that order. A roadmap built from a conference agenda is a wish list.

Item 11: Morale. Find out how your team is really doing. Inherited teams carry fatigue, unfair blame, and a long list of things nobody listened to. You cannot run a roadmap on people who have stopped believing the leadership will follow through.

Item 20, the 2026 refresh: AI and agent inventory. Find out which AI tools and agents are in use, sanctioned or not, and what data and permissions they hold. I have written about shadow AI for new CISOs before, and the short version is that you cannot govern what you have not found. This item slots in next to third party risk, because most of what you find will be an outside service.

Refuse to skip: documenting resource gaps early, and the incident and breach study. The first protects your budget case. The second protects your credibility. Item 8 is also the one that quietly shapes the next section of this post.

What depends on what: Item 9 needs items 1 and 2. Item 10 needs items 6, 8 and 9. Item 5 needs the risk appetite conversation from item 2, or your dashboard has nothing to measure against. Item 7 feeds the help desk question below.

The Help Desk Thread: One Lesson Hiding in Five Items

Five items in this checklist, numbers 8, 12, 13, 18 and 19, all circle the same lesson. Help desk identity verification is a systemic risk, not an operations detail.

Start with MGM. Okta published an advisory on August 31, 2023 describing a pattern in which attackers targeted IT service desk staff and persuaded them to reset all MFA factors for highly privileged users. Reports on the MGM incident describe the same technique: attackers used social engineering to trick a help desk agent into resetting MFA for an administrative account. MGM later reported an approximately $100 million impact in an SEC Form 8-K in October 2023.

Now Clorox, and I want to be careful here because this is litigation. In July 2025, Clorox filed suit against Cognizant, its IT services provider, alleging help desk staff handed over network passwords to cybercriminals who simply called and asked. Clorox is seeking $380 million for breach of contract, lost sales and reputational damage, with $49 million of that in direct remediation. Those are Clorox's allegations. Cognizant disputes them. Cognizant told Cybersecurity Dive that it did not manage cybersecurity for Clorox. I did not find a resolved outcome, so treat this as an open case and a useful teaching scenario, not a verdict.

The reason it teaches well is the contract angle. Reporting on the complaint says Clorox entered a support agreement with Cognizant in 2013 that included service desk and identity management responsibilities. The complaint also describes policies that included a self reset tool and, as a fallback, a check of the caller's manager name and username. Whatever a court decides, the question for you is portable. Who answers your help desk phone, and what does the contract say they must verify before they reset a credential?

If your help desk can reset a privileged account on a phone call, your MFA program has a back door with a friendly voice.

This is why I pull a slice of the late items forward. Do not wait for month ten to fix this. In the first six months, I want three things in motion. First, self service password reset, so the volume of routine calls drops and the help desk stops being the default path. Second, a way for employees to report phishing and suspicious calls that does not run through the help desk queue. Third, a stricter verification step for resets on privileged accounts: a callback to a number already on file, or an approval through a separate system, and no exceptions for urgency. Urgency is the attacker's favorite tool.

Then ask the outsourcing question in item 7. If the help desk is a vendor, put the verification steps in the contract, test them with a simulated call, and make the results part of vendor reviews. Outsourcing the function does not outsource the loss.

Months Seven to Twelve: Close the Gap Between Policy and Practice

The third horizon has eight items, 12 through 19. By now you have authority, a register, a roadmap, and some credibility. This is the stretch where you test whether the program works outside of slide decks.

Item 12: Complaints. Collect what the business complains about. Slow access, clumsy tools, security reviews that stall projects. Complaints are free research on where controls create friction, and friction is where workarounds, and then incidents, start.

Item 13: Provisioning. Look at how access is granted, changed and removed when people join, move or leave. Orphaned accounts and stacked permissions are among the most common findings I see. If you want ways to prove progress here, my posts on IAM metrics that matter at every level cover what to measure and how to explain it.

Item 14: Relationships. Build working relationships with legal, internal audit, HR, the plant and business unit leaders, key vendors, and peers at other companies. Do this deliberately. The first time you call these people should not be during an incident.

Item 15: Endpoints. Check coverage, health and recovery capability on laptops, servers and any operational devices. Know your real number, not the one in the last report.

Item 16: Secure development. Look at how software gets built and released, who reviews it, and how findings flow back to developers. If your company builds anything customers or plants depend on, this matters more than most boards realize.

Item 17: The policy versus practice gap. Return to your item 3 notes and test them. Pick the policies that matter most, and check what controls actually do. If MFA is policy but legacy applications skip it, say so. This is where an honest assessment earns trust with audit and the board.

Item 18: Single sign on for cloud applications. Bring cloud and SaaS applications behind central authentication. It shrinks the number of places a stolen credential works and makes access reviews possible. It also concentrates risk in your identity provider, which loops straight back to the help desk thread, because the account recovery process becomes the most valuable door you own. My post on IAM metrics in practice shows how to put numbers on that work.

Item 19: Help desk overload. Measure ticket volume, the share that are password or MFA related, and how long privileged resets take. Overloaded desks cut corners. Fix the volume and the verification improves on its own.

Refuse to skip: the policy versus practice gap. It is uncomfortable, and that is the point. A program that only reports what policy says will be surprised by the first serious incident.

What depends on what: Item 17 depends on item 3. Item 18 depends on a clean item 13, because pulling messy access into SSO just centralizes the mess. Item 19 improves once the self service and verification work from the previous horizon is in place. Item 14 makes every other item in this horizon easier.

Getting Support at Every Level, Starting With the Board

None of this works without people who back it. Support is not one conversation. It is three, with three different audiences, and each wants a different language. I covered the executive side in depth in Winning the Room, so here is the short version tied to this checklist.

The board. Talk in business outcomes: revenue at risk, cost of downtime, regulatory penalties. The NACD 2026 Director's Handbook toolkit points boards the same direction. It says directors should treat cyber risk as they would financial or operational reviews, asking about strategic exposures, economic impact, and alignment with business objectives. It also tells boards to establish regular, non crisis communication channels with the CISO. Take that offer. The handbook warns that boards cannot oversee cyber risk effectively if they only interact with the CISO during annual presentations or after a crisis.

Directors are not satisfied with what they get today. The 2026 CISO-Board Engagement Report from IANS Research, Artico Search and The CAP Group found that just 29% of directors describe cyber updates as very effective.

Executives. Give them a short dashboard tied to the top items in your risk register, each with a named risk owner. The owner matters. A risk without an owner is a worry. A risk with an owner is a project.

Middle management and staff. This is the audience new CISOs forget. These are the people who live with your controls, and they have worries: slower approvals, extra steps, fear of blame. Explain what security is doing about those worries, and keep the dialogue going. It is the same material as item 12, complaints, and it is how item 11, morale, extends beyond your own team.

Why the risk appetite conversation comes first. A Pulse Security report released during Black Hat 2026, titled The CISO-Board Communication Gap, found that more than half of organizations have not formally defined their cyber risk appetite. It also found that most CISOs spend over 10 hours preparing each board cyber risk report. The researchers' conclusion, as reported by eSecurity Planet, is that effective board communication depends more on governance than presentation skills. Coverage of the report points CISOs toward a defined risk appetite, automated data aggregation, and a standing private board session.

That lines up with my sequencing. Define the appetite before you report against it. Agree on escalation thresholds before an incident, so the board knows in advance what triggers a call. Hold recurring private sessions with directors so the first hard conversation does not happen in the middle of a crisis. This is why the register and appetite discussion sit in the first 30 days, and the dashboard waits until the second horizon.

Define risk appetite before you report against it. Otherwise every metric you show is a number without a verdict.

Key Points

• Sequence beats effort. The charter and risk register come before audit finding triage.
• Flat budgets are the norm: IANS 2026 shows 0% median growth for the second year and 55% of leaders flat or cut.
• Days 1 to 30 cover items 1 to 4. Months two to six cover items 5 to 11, plus an AI and agent inventory. Months seven to twelve cover items 12 to 19.
• Help desk identity verification is a systemic risk. Pull self service reset, phishing reporting and privileged reset checks early.
• Present the Clorox case as allegations. Cognizant disputes them, and I found no resolved outcome.
• Win support in each audience's language: business outcomes for the board, a short dashboard with owners for executives, an ongoing dialogue for staff.

Pro Tips

Get the charter signed by the person who can enforce it. A charter signed by someone who cannot back it up is a poster. Aim for the CEO or the audit committee chair, and make sure the reporting line is written, not assumed.

Run one simulated help desk call in your first quarter. Have a trusted colleague call as a locked out executive and see what happens. The result is the most persuasive slide you will make this year, whether the answer is good or bad.

Put resource gaps in writing at month three. Tie each gap to a register item and a named owner. When the budget cycle opens, you are submitting evidence, not opinions.

Ask for the vendor contract language on verification. If your help desk or identity services are outsourced, read the actual service description. Verification steps that live only in a vendor's internal procedure are steps you cannot enforce.

Set escalation thresholds with the board chair early. Agree on what size or type of event triggers a direct call. Write it down, and revisit it twice a year.

Pitfalls to Avoid

Do not start with the audit findings. They are loud, urgent and visible, and they will pull you into closing items in the wrong order. Build the charter and register first, then triage.

Do not treat help desk resets as an IT operations issue. They are an identity control. If you leave them to the end of year one, you have left the most attacked process in your environment for last.

Do not walk into a board meeting before risk appetite is defined. Reporting against an undefined appetite leaves directors to guess whether a number is good or bad.

Do not copy a checklist, including this one, without adapting the sequence to your company. A manufacturer with a plant floor will weigh items 15 and 16 differently from a software firm. Keep the dependencies and change the timing.

Do not state vendor or litigation claims as facts. Quote what a complaint alleges, note who disputes it, and keep your conclusions to the control lesson.

Final Thought

A new CISO is judged on judgment long before results show up, and the quickest way to show judgment is to do the quiet, foundational work first and refuse to be rushed past it.

A companion one page PDF of this checklist, with all the items, horizons and dependencies, is available for download on InfoSec Made Easy. If you have started a new CISO role, tell me in the comments what you did first, what you would reorder, and which item surprised you most. I read every one.