Starting a new IT role? Ten cybersecurity checks for your first 90 days

Starting a senior IT role rarely means starting with a clean slate.

In a mid-sized organisation, you inherit years of technology decisions, supplier relationships, exceptions and workarounds. Some will be well documented. Others will exist because nobody is completely sure what will happen if they change them.

The challenge isn’t finding things you could improve. It’s working out what matters, what can wait and where the business may be more exposed than it realises.

Here are ten useful checks to complete during your first 90 days.

1. Build the real asset list, not just the official one

There is usually a spreadsheet or CMDB that is supposed to list everything. It rarely does.

Cross-check it against SaaS billing, expense claims and DNS records. You may uncover departmental applications nobody mentioned, forgotten subscriptions or a server everyone knows about but nobody wants to touch.

2. Find every account with administrative access

Privileged access tends to accumulate over time.

Look for previous employees, old contractors, supplier support accounts and “temporary” access that was never removed. Include service accounts and emergency accounts, not just named users.

You need to know who could make a significant change—or cause significant damage—before deciding whether access is justified.

3. Read the cyber insurance policy properly

Don’t stop at the coverage summary. Read the conditions and exclusions.

Some policies require specific controls to be operating, such as MFA, regular patching and tested backups. Check whether the answers provided when the policy was taken out still reflect the environment today.

A policy is far less reassuring if the business cannot demonstrate that it met the insurer’s requirements when an incident occurred.

4. Restore something from backup

A successful backup notification confirms that a job ran. It does not prove that the data can be recovered.

Choose an important but unremarkable system and restore it. Record how long it takes, what information is missing and who needs to be involved. Better to discover a problem during a planned test than during an incident.

5. Check whether the incident plan still describes the business

Incident plans often name employees who have left, suppliers that have changed and systems that are no longer used.

Review the plan and run a short tabletop exercise during your first month. It will quickly show whether people understand their roles and where the response is likely to stall.