Your First 90 Days as a CIO: The Second Month Decides What You Get to Transform

A new chief information officer walks into a business that is already running. The budget is mostly committed, the largest contracts carry your predecessor's signature and the business made up its mind about IT years ago. Whoever you report to, the chief executive officer, the CFO or the COO, judges your first 90 days on whether IT can be trusted with cost, service and risk.

The standard onboarding plan for a new role says learn the systems, stabilize and find an early win. Michael D. Watkins set the 90-day frame; some boards say 100 days, and the clock is the same. Nobody grades a new CIO on the inventory of systems that plan produces. The goal by day 90 is a few pages the business can sign.

This is for CIOs and VPs of IT stepping into the seat where enterprise technology runs the business.

What a CIO Inherits That CTOs Do Not

A CIO inherits the systems the company runs on and the money already committed to them: enterprise resource planning, finance and HR systems, identity, networks, the service desk and the contracts around all of it. Most of that spend keeps things running.

The reporting line shapes the CIO role more than any template admits. In the Society for Information Management's 2025 IT Issues and Trends Study, 46.2% of CIOs reported to the CEO, so more than half negotiate the mandate with someone else. Under the CEO you are a peer of the CFO. Under the CFO, the first conversation is cost and control before capability; under the COO, it is reliability and throughput.

It goes wrong when you answer the CFO in technology terms: the CFO asks for more data, the technologist designs a better system and neither answers the other.

The chief technology officer has a different job. A CTO owns product development and the software development behind what the company sells; the CIO runs what the company runs on. Shared ground, like the board story, the bench and a position on AI, is covered in the CTO's side of the same 90 days.

The failure mode particular to this seat is becoming a service provider that takes orders from finance, operations and the business units. Nobody inside the company sits on both sides of that conversation with you, which is the gap CIO coaching works on.

Five areas, from what you inherit to what you put on paper by day 90:

Days 1 to 30: Agree the Mandate, Then Ask Each Stakeholder What They Work Around

Spend the first 30 days on two things: a mandate agreed with your boss and a listening tour that asks your key stakeholders what they rely on and what they work around. Both feed one page, and both help you first understand the business as it already sees IT.

Put the mandate on one page by day 30. In week one, ask your boss what the business needs from IT this year, what the last CIO was judged on, how they want bad news delivered, how much innovation they expect next to cost control and what the board believes about technology risk. If this is your first top seat, learn what changes when you join the executive team before that meeting.

The listening tour asks each person two questions. What does IT do well that you rely on? What do you work around? Workarounds expose shadow IT, unlogged spend and the misalignment between what IT thinks it delivers and what the business experiences. Ask for recent incident reviews and open audit findings too. The complaints show where its business priorities sit.

The most useful answer is a workaround with its own budget: a business unit paying for its own software or contractor because IT was too slow. It adds cost and risk you didn't know you owned, such as data outside IT's controls and a contract outside the renewal calendar. And it names the peer to win first, which is where earning credibility outside the technology team starts.

Don't shut it down in month one. Put it on the mandate page as a decision to make with that peer in days 31 to 60.

By day 30 the page says what IT is measured on and where it has autonomy: what IT decides alone, what it decides with the business and what goes to the board, with decision-making rights named for each. If you report to the CFO or the COO, it also lists what IT takes to the CEO directly. Better to learn in month one that your boss won't grant that line than in month six.

Hold the transformation announcement. The business won't believe IT can change what it can't yet run well.

Days 31 to 60: Read the Run Budget and the Contract Calendar

The second month is when the CFO asks why IT costs this much. The page you answer with decides how much change money and room IT gets for the rest of the year, so build it in the CFO's terms: run cost by service, the contract calendar and the few decisions that move either one.

Show run cost by service. For each business capability, show what it costs a year to keep running and what moves the number: users, volume, licenses, hosting. Data and analytics platforms are usually the line growing fastest. Business units read IT cost as a hit to their profitability, so show it the way they already read it.

Then the contract estate. List the top twenty contracts by value with their renewal and notice dates over the next eighteen months, plus the auto-renewals, the shelfware and the software-as-a-service (SaaS) sprawl that arrived one credit card at a time. A calendar of notice dates is the most useful thing a new CIO builds in the second month, because it shows where cost can move and when.

Say you're five weeks in and the largest outsourcing contract has a notice date in month four. Finance reads a vendor decision in three numbers: what we pay now, what we're committed to and what it costs to leave. The first question back is usually what breaks if we don't renew. A new CIO who can't answer that hasn't earned the right to renegotiate yet.

Dependencies first, leverage second. Before you optimize a contract, map what runs on it, because cost optimization on a vendor you haven't mapped buys an outage. Your vendors also advise you on the estate they run, so keep that relationship apart from the commercial position.

The initiatives in flight get the same treatment: what each one costs to finish, what it was for and whether its business case still holds. Some won't.

The end state is one page finance reads in full:

1. The current state in money
2. Run cost by service
3. The contract calendar
4. The three decisions that save money or reduce risk, and when each falls due
5. What IT will stop paying for

Put the Risk Position in Writing, as a Business Matter

The board reads technology risk as business exposure: what stops business operations, what becomes a headline, what a regulator will ask about. Your job in the first quarter is a written risk position in those terms, signed by the people who own the business processes at risk.

Translate the estate into three or four exposures, each with a likelihood, a cost and a recovery time. The usual candidates are end-of-life systems, a key supplier failing, an outage of a revenue system that hits the customer experience and a data breach.

The people who carry the revenue sign the risk. IT doesn't. The position is signed by the owners of the business processes at risk, and it sits inside the governance structure the board already uses, usually the risk or audit committee. Make the exposure legible in their terms: time to recover, money at stake per hour of outage and what has never been tested.

A risk register written in IT's language gets filed. One written in the business owner's language gets signed.

Validate before you repeat anything to the board. A recovery time that has been exercised is worth more than one written in a policy. Ask for the latest restore and failover test results by day 45, and know which core business systems have never been tested.

Public companies have a regulator in the room. Under the U.S. Securities and Exchange Commission's cybersecurity disclosure rules, adopted in July 2023, a company reports a material cybersecurity incident on Form 8-K, generally within four business days of determining that it is material, and describes in its annual report how the board oversees risks from cybersecurity threats and management's role in assessing and managing them. Private companies get the same questions from the audit committee and their insurers.

Whoever runs security reports into this position. The CIO speaks for it.

Earn the Business's Trust in the Service Before You Try to Transform It

Business leaders judge IT first on the service they get, and they remember last year's outages better than you can explain them. Know your service record in their terms before you announce any change program: what stays up, what broke, how requests reach IT and who speaks for IT to each business unit.

Track infrastructure availability for the five systems each executive cares about, with one metric per system the business recognizes. Ticket counts don't qualify.

Then fix the leadership structure under you: one accountable lead for each large business area, one owner for production service, one for architecture and standards. A CIO who is the escalation point for everything has no time left for the board, and how senior IT leaders learn to delegate starts with those three names.

Much of the run team works for vendors and outsourcers, so the org chart shows only part of the people who keep the estate running. By day 60, decide which leaders you keep, judged on their strengths and weaknesses against the mandate, which seats change and which services stay outsourced.

Product versus project funding, agile teams against project management offices, is a decision you can defer past day 90. Say so out loud, so the organization stops waiting for it.

One small visible fix to a pain a peer named in month one is worth more than a strategy deck. Most of what executive coaching from Master Certified Coaches works on in this window sits here: where your attention goes, whom you trust with what and how you say no to the business without losing it.

Days 61 to 90: The Board or Audit Committee, and the AI Question You Will Get

The board or audit committee meeting is the day-90 test. Bring where IT stands, the year's three priorities tied to the business strategy, what you need from the board and what IT will not take on. For a CIO, where IT stands means the run budget page, the contract calendar, the service record and the signed risk position.

A non-technical board gets no architecture. Each page should answer a question a director would ask without help: what are we paying for, what could hurt us and what is the business getting for it.

Then the AI question. For a CIO it is rarely about a new program. The board wants to know where artificial intelligence is already in use, who approved it, what data it touches and what it costs as it shows up in renewals.

The first count usually turns up three things. More use than anyone approved, with staff on generative AI tools under their own accounts. AI features already running inside products the company pays for, workflow software and office suites among them, some switched on at a renewal nobody read for it. And no single owner.

Bring the board an inventory, an owner, a rule and a price. The inventory of where AI runs, one named owner, a rule for which data may go where, and a price for each AI line as it comes up for renewal. A vendor list reads as no answer. Governance comes before the data strategy, and AI governance for executives covers the board-level version of the same questions.

Then give the board something to decide: which business result AI should move, which first bet to fund with a cost and a stopping point, which uses the company rules out. Name which initiatives to accelerate and which to stop. Expect the owner question before the tool question. Boards have seen enough stalled AI spending to know why AI investments stall on leadership.

If the CEO adds the company's AI agenda to your job before day 90, negotiate it as a second mandate. It changes the role itself, which is a larger question about what AI means for CIO careers.

Four Ways New CIOs Lose the First 90 Days

The same 2025 Society for Information Management study puts the average tenure of CIOs at 7.4 years, with a median of five. The first 90 days set the story the rest of that tenure is read against, and new CIOs tend to lose them in one of four ways.

1. Announcing a digital transformation before the business believes IT can run. The plan reads as a new executive defending the hire. Run first, then change what you can show you run.
2. Cutting vendors before mapping dependencies. The saving shows up in one quarter and the outage in the next. Finance remembers both, and the outage longer.
3. Leaving risk as someone else's report. The board hears about an exposure first from an auditor or an incident, then asks why the CIO didn't raise it.
4. Accepting the service-provider role. You take orders from finance and operations and stop bringing the business a view on cost and risk. Within a year the seat is a cost center with a title.

Each of these is a retreat to familiar ground under stress: the incident bridge, the contract re-read, the places you were strong before the promotion. Noticing the pull early is a large part of the transition into the C-suite seat.

Check Your Plan Against the Five Areas Technology Leaders Are Judged On

Technology leaders in a bigger seat get judged on five areas, and each maps onto the first 90 days. Run them as a check at day 90, before your boss runs the same check without you.

• Business and money: the run budget, the contract calendar and what IT stops paying for.
• The CEO and the board: the mandate and the board conversation.
• The leaders under you: service owners and who speaks for IT to each unit.
• Where your week goes: business conversations against escalations.
• Your agenda: AI and cost: the AI count and a position the board can act on.

Your own read on how your first 90 days as a CIO are landing is the least reliable one. Your direct reports and peers know, and few will tell you in month three.

My record is more than 20 years of technology leadership, with roles that include Head of Application Development at Anadarko and SVP and Chief Architect at Citigroup Energy. I'm also an International Coaching Federation (ICF) Master Certified Coach. Coaching tech leaders changes how you decide and how it lands. It doesn't write the IT strategy.

Fifteen statements on the free scorecard for technology executives give you a private first read on the same five areas in about four minutes, with the result on the page.

Frequently Asked Questions