The Field Guide
The New CISO Field Guide
Practical tools and action items drawn from The CISO Crucible — a novel about a cybersecurity executive’s first 90 days navigating crisis, politics, and organizational transformation. Whether you’re stepping into a new CISO role or strengthening your leadership approach, use these alongside the book or as standalone resources.
How to use it: Start with the Day 5 checkpoint. Work forward. Use the self-assessment questions honestly — they’re designed to cut through the “I’m doing fine” narrative that buries most new CISOs.
Who it’s for: Any security leader starting a new role, whether it’s your first CISO position or your fourth. The crises change. The patterns don’t.
Starting a Security Program — Free Checklist
No Email NeededNew to security programs? Start with the free Starting a Security Program checklist — 3 milestones, no email needed.
The Core Lesson
William Sterling walked into BigCo with a 90-day plan. It didn’t survive Day 1.
That’s not a failure story — it’s the point. Every CISO builds a plan. The ones who succeed treat it as a compass, not a map. This field guide gives you progress markers you can check regardless of what crises have rearranged your calendar.
One question drives everything: Am I making progress, or am I just busy?
Quick-Start: Your First Five Actions
If you do nothing else from this guide, do these five things in your first week.
Start a Delay Log — every time a decision requires cross-departmental permission, write it down. Date, decision, who you needed, how long it took. This single document becomes your most powerful evidence for the structural conversation at Day 30.
Conduct 1-on-1s with every direct report — don’t ask “what’s broken.” Ask “what would you fix if you had air cover?” The gap between those answers reveals your team’s trust level.
Inventory shadow AI usage — send a brief, non-threatening survey to department heads. Assume the real number is 3x whatever they report. You need to know the actual attack surface before you can defend it.
Learn why your predecessor failed — request the exit interview, talk to the people who worked with them, read between the lines. The political fault lines that broke them will try to break you too.
Identify who was passed over for your role — ask HR, ask your boss, ask whoever recruited you. These people are either future allies or active threats, and you need to know which before your first all-hands meeting.
Before Day 1 — Preparation
- Learn why your predecessor failed — request the exit interview, read between the lines, and identify the political fault lines that broke them before they break you (Ch 2)
- Identify who felt passed over for your role — ask HR, ask your new boss, ask the person who recruited you. These people shape your political landscape from minute one (Ch 2)
- Draft your 90-day plan, then hold it loosely — you need a compass, not a map. Write it down so you can measure deviation, not so you can follow it blindly (Ch 1)
- Know your actual timeline — not the one you planned, the one the organization already committed to regulators, partners, and the board. Your deadline might already be set (Ch 2)
- Research the regulatory landscape — what filings are pending? What audits are scheduled? What did the last SEC/regulator communication say? These shape your real timeline (Ch 2, 11)
Week 1 · Days 1–5 — Orientation Under Fire
You’re not implementing anything yet. You’re building situational awareness while everything around you suggests you should be acting. Resist.
- Start a Delay Log — document every decision that required cross-departmental permission. Date, decision, who you needed, how long it took (Ch 1)
- Document reporting structure bottlenecks — map who reports to whom, where security sits in the org chart, and every place where your authority doesn’t match your accountability (Ch 3)
- Conduct 1-on-1s with every direct report — ask “what would you fix if you had air cover?” not “what’s broken?” (Ch 3)
- Inventory shadow AI usage — send a brief, non-threatening survey to department heads. Assume the real number is 3x whatever they report (Ch 2)
- Map who’s documenting your decisions — someone is already building a file. Identify them early and give them nothing to weaponize (Ch 4)
- Respond to every outreach from former employees — institutional knowledge left with them. The ones reaching out are telling you something (Ch 3)
- Write down what confuses you every evening — the pattern hiding in your confusion is the framework you’ll need later (Ch 1, 7)
- Identify your team’s unspoken fears — listen for what wounded teams aren’t saying. Silence is data. The things they won’t tell you matter more than the things they will (Ch 3)
- Protect different working styles immediately — if your best analyst has a “Do Not Disturb” sign, don’t override it. Their focus is your detection capability (Ch 4)
- Separate the confidence you perform from the uncertainty you manage — your team needs to see steadiness. Your journal needs to see honesty (Ch 2)
Day 5 Self-Assessment
Rate yourself honestly. You’re on track if you answer YES to at least four:
- I know why the last person in this role failed or left
- I’ve spoken 1-on-1 with every direct report
- I have a written list of at least three authority/accountability mismatches
- I know who felt passed over for my role and have assessed their current posture
- I’ve started my Delay Log and have entries in it
- I can name the top three things my team is afraid to tell me
Warning signs you’re already off track:
- You’ve made promises about what you’ll fix (you don’t have enough data yet)
- You’ve reorganized anything (it’s Day 5)
- You skipped 1-on-1s because a crisis pulled you in (the crisis is real, but the 1-on-1s are how you survive the next one)
Week 2 · Days 6–14 — Mapping the Terrain
Now you can start asking harder questions — but you’re still in discovery mode, not fix-it mode.
- Run a full shadow IT audit — every SaaS subscription, personal device on the network, and workaround someone built because the official tool didn’t work. Track subscriptions as systems — one SaaS purchase can mean 50+ user accounts creating separate attack vectors (Ch 3, 6)
- Map data flows to every external service — APIs, integrations, vendor connections. The volume will be worse than you expect (Ch 6)
- Audit pages 40–150 of every major vendor contract — that’s where AI training rights, data usage clauses, and liability limitations hide (Ch 17)
- Assume your IP is already in AI training models — check which tools have been feeding company data to external models. It’s probably already happened (Ch 6)
- Check physical security basics — walk the building. Broken badge readers, propped-open doors, unlocked server rooms. Broken locks indicate broken culture (Ch 6)
- Accept that shadow IT exists and govern it — banning it drives it underground. Governing it brings it into your visibility (Ch 6)
- Initiate threat hunting — don’t wait for alerts. Assume persistent threats are already present and task your best analyst to go looking (Ch 4)
- Create clean enclaves for business continuity — identify systems you can isolate during incident response so the business keeps running while you contain threats (Ch 4)
- Map the political landscape — observe lunch patterns, meeting invitations, who gets cc’d and who doesn’t. Identify the real decision-makers (Ch 7)
- Give territorial leaders partnership roles — invite IT Ops, Engineering, and Infrastructure leads to co-own security outcomes. Partnership, not subordination (Ch 4)
- Calculate per-hour business impact of downtime — get finance to validate the number. This single figure changes every conversation with the board, with insurance carriers, and with vendors (Ch 5)
- Accept that your company contains multiple incompatible cultures — the engineering floor and the sales floor are different countries. Stop trying to unify them (Ch 7)
- Observe three times longer than feels comfortable before acting — in stakeholder relationships, premature action is more expensive than delayed action (Ch 7)
Week 3 · Days 15–30 — Building Your Case
The listening tour is over. Now you turn what you found into a case leadership will actually fund: the risk narrative, the budget ask, the metrics that prove…
Keep reading — get the full guide
FreeThat's your first two weeks. The rest of the 90 days — building your case, adapting your approach, and proving the system runs without you — plus the full diagnostic toolkit and the Security Champion Program, is in the free guide. Enter your email and we'll send it over. You can also download it right here.
Topical Guides
Deep dives into specific CISO leadership challenges drawn from The CISO Crucible.
Board Communication for Security Leaders
The board doesn’t speak your language. Neither does your CFO. Neither does your digital transformation team. But they all need to understand risk.
Translate Risk Into Business Impact
Security leaders often lead with technical specificity: “We found 437 unpatched systems across 15 subnets.” The board hears noise.
Reframe: “We identified systems that could give attackers access to customer payment data before we can detect them. That’s a breach risk on our largest revenue stream. Here’s what we’re doing and what it costs.”
Different stakeholders need different messages:
- The CFO thinks in metrics: ROI, cost avoidance, financial impact. Show them the downside. “A breach would cost us $X in remediation, regulatory fines, and lost customer trust. This investment prevents that scenario.”
- The Board thinks in narrative and accountability. Give them the story: where you were, where you’re going, and what’s at stake if you don’t get there.
- Your Team needs transparency and context. They need to know you understand the constraints they’re working under and that the plan is realistic.
The Structure That Works
Every board presentation should follow this pattern:
- Status quo. What’s the current state? Be honest. The previous CISO might have oversold progress.
- What changed. What new threats or capabilities have we discovered? What’s the business impact?
- The plan. Here’s what we’re doing, why it works, and what success looks like in business terms.
- What we need. Budget? Headcount? Structural changes? Be clear and quantified.
- The alternative. What happens if we don’t act? Regulatory consequence? Breach probability? Data loss? Make the cost of inaction real.
The Burnout Warning (from The CISO Crucible)
You’ve inherited a burned-out team. Your board needs to understand this isn’t just morale — it’s a business risk. Burned-out security teams miss critical incidents. They create process debt that becomes expensive later. Include team wellness in your board narrative. “We’re investing in our team because operational security depends on people who can think clearly under pressure.”
Managing CISO Burnout and Team Wellness
Burnout isn’t a personal weakness or a sign of low commitment. It’s an organizational failure. If your team is burned out, it’s because you’ve asked them to do impossible things without the resources, authority, or support to succeed.
Signs to Watch For
In yourself: you’re checking Slack at 11 PM and reading incident tickets before coffee; every decision feels like it might be a career-ending mistake; you’ve stopped thinking strategically because you’re constantly putting out fires; you’re not sleeping, or you’re sleeping badly.
In your team: people are staying late regularly and not taking vacation; the same person is responding to every incident (them becoming indispensable is a red flag, not a sign of excellence); mistakes increase, not decrease, despite everyone working longer hours; new hires leave within 6 months and retention is declining.
What to Do About It
Immediate actions: Give people time off — if someone hasn’t taken vacation in 18 months, make them take a week. Rotate incident response — the same person leading every incident means you have a single point of failure. Reduce meetings — burnout accelerates when people spend 80% of their day in meetings and can’t actually do their work.
Structural actions: Hire — if you have fewer people than the work requires, you will burn them out. Acknowledge the gap and fix it. Automate — find 20% of the workload that’s repetitive and make machines do it. Distribute — use a champion program to push some security work into other parts of the organization.
The Bottom Line
A burned-out team will miss critical security events. They’ll make mistakes under pressure. They’ll leave for competitors. Treating wellness as a security business problem — not an HR problem — is what good CISO leadership looks like.
Templates & Downloads
Practical templates built from the Field Guide’s diagnostic toolkit — .xlsx and Google Sheets versions are coming soon.
The Delay Log
Coming SoonTrack every decision bottleneck from Day 1 — who you needed, how long it took, and the business impact. Includes a summary dashboard with auto-calculated metrics. This single document becomes your most powerful evidence at the Day 30 board meeting.
.xlsx Coming Soon · Google Sheets Coming Soon
Stakeholder Communication Map
Coming SoonMap how each stakeholder makes decisions, builds trust, and measures success — then tailor your security message accordingly. Includes the three diagnostic questions from Chapter 14 and a relationship status guide.
.xlsx Coming Soon · Google Sheets Coming Soon
Single Point of Failure Register
Coming SoonCatalog every human and system single point of failure, assign risk levels, and track backup plans. Includes a summary dashboard counting critical vs. high vs. medium risks and untested backup plans. If the "Backup Plan" column is empty, that's your first action item.
.xlsx Coming Soon · Google Sheets Coming Soon
Vendor Risk Scorecard
Coming SoonScore every vendor on data access, contract terms, and AI training clauses — with defined consequences at each risk level. Includes a risk scale guide so your team scores consistently. A score without a defined consequence is theater.
.xlsx Coming Soon · Google Sheets Coming Soon
Discussion Guides
Book Club Discussion Guide
Coming SoonChapter-by-chapter questions for book clubs, leadership teams, and security practitioners who want to dig deeper. Designed for group conversations, not quizzes.
Leadership Team Workshop Guide
Coming SoonA facilitation guide for using The CISO Crucible in leadership development sessions. Structured exercises around the book's key themes: communication under pressure, framework adoption, and organizational trust.
More Resources
Read Chapter 1 of The CISO Crucible free to see William Sterling’s first day in action.
Browse the full glossary of cybersecurity and leadership terms from the book.
Every item in this field guide comes from The CISO Crucible: A 90-Day Journey in Cybersecurity Leadership. The chapter references point to the full narrative context — the meetings where these lessons were learned the hard way, the crises that forced the adaptation, and the relationships that made the difference.
Plans break. Trajectories don’t have to.