The month between signing and starting is the highest-leverage month of your entire tenure, and almost everyone wastes it on garden furniture and LinkedIn announcements. Think about what you hold in that window: maximum goodwill, because everyone who hired you is still congratulating themselves on the decision. Zero accountability, because nothing that is broken is yours yet. And the clearest eyes you will ever have about this company, because you have not yet absorbed its assumptions, its politics, or its explanations for why things are the way they are.
Every month after this one, at least one of those three assets depreciates. I have watched enough security leadership transitions from the hiring side, including the loops I am running right now, to say this plainly: the executives who arrive on day one already oriented perform visibly differently in their first quarter than the ones who treat the gap as vacation. This guide covers what to actually do with those 30 days.
Finish the Paper Before Day One
Start with the unglamorous part. Everything you negotiated exists in one of two states: written and countersigned, or a pleasant memory. Before your start date, audit which state each term is in.
The checklist, in priority order:
- D&O certificate of insurance, in hand. Not “you’ll be covered under our policy,” which is what everyone says. The actual certificate of insurance naming the policy, the carrier, and the limits, sitting in your personal files. If you did not ask for this during negotiation, ask for it now. The offer red flags guide covers why this matters more for CISOs than for almost any other executive: you are the officer most likely to be personally named after an incident.
- Indemnification agreement, countersigned. A promise to indemnify you is not an agreement to indemnify you. You want your signature and theirs on the same document. If the company says “it’s in the bylaws,” get the relevant bylaws excerpt and a written confirmation that they apply to your role, because bylaws can be amended without your consent and an individual agreement cannot.
- Plan-of-record email, confirmed. If you followed the compensation negotiation guide, you sent a summary email after the verbal offer listing every agreed term: base, bonus target, equity grant size and vesting, sign-on, severance, reporting line, budget commitments, headcount promises. If you never sent it, send it now, belatedly. It is slightly awkward and vastly better than the alternative. Verbal promises have a habit of evaporating precisely when the people who made them roll off: the recruiter closes the file, the hiring manager changes roles, and suddenly nobody remembers the two headcount you were promised in the final call.
- Equity paperwork. Grant date, board approval status, and the actual grant agreement. “Subject to board approval” is normal; a grant that still has not been approved two board meetings after your start is not.
If something promised verbally has not landed in writing, escalate before day one, and do it gracefully. The move is a short email to your hiring manager: “Doing my pre-start paperwork sweep and I noticed the [term] we agreed on the final call isn’t reflected in the documents I have. Can you confirm, or point me to whoever can get it added?” That framing matters. You are not reopening negotiation, you are doing administrative hygiene, and any reasonable manager treats it that way. The insider reality: pre-start, this is a ten-minute paperwork fix handled by someone who wants to keep you happy. Post-start, the same request becomes a political event that makes you look like you are renegotiating from inside, and it will be remembered.
The Four Conversations Worth Having
Pre-start relationship work is a small, deliberate list. Four conversations, each with a specific purpose.
Your manager, on the 90 days. One call, 45 minutes. Two questions do most of the work. First: “When we sit down at day 90, what would make you say this hire is working?” You are extracting their private success criteria, which are never fully captured in the job description and frequently differ from what the panel told you. Second, and this is the one most people skip: “How do you want bad news delivered? Channel, timing, level of detail.” Every executive has a strong preference here, and most new CISOs discover it only by violating it. Some want a heads-up text before the meeting where it surfaces; some want a written pre-read; some want to hear it raw and immediately. You will be delivering bad news within your first quarter. Know the delivery format before you need it.
The general counsel, on privilege ground rules. Thirty minutes, and worth more than any other single pre-start call. Ask how the company handles privilege for security work: when assessments are run under privilege, how incident communications are structured, what the GC wants routed through legal versus handled directly. Every company draws these lines differently, and the CISO who learns the local rules in a calm pre-start call is in a very different position than the one who learns them mid-incident. This call also starts the single relationship that most determines whether your worst week at this company goes tolerably or catastrophically.
The predecessor, if reachable. Most incoming CISOs skip this out of some territorial instinct, which is a mistake I flagged in the 90-day plan guide and will repeat here because the pre-start window is the best time to make the call. Ask what they could never get funded, what they would do differently, and who actually helped them get things done. Thirty minutes, a quarter of discovery saved. If they left badly and will not talk, the way people inside the company describe their departure is itself useful data.
Your inherited leads, informally. A short introductory call with each direct report before day one. Twenty minutes, cameras optional, agenda: “I wanted to say hello before I show up in your calendar as a meeting invite.” You are signaling respect and taking an early read on energy and morale. That is all.
What Not to Do Before You Start
The pre-start conversations have hard boundaries, and crossing them costs more than skipping the calls entirely.
No decisions. You do not have the information, you do not have the authority, and any decision you make pre-start will be relitigated on day one by people who were not consulted.
No opinions on the team. In the calls with your leads, you will be probed, sometimes subtly, for your views on the org, on individuals, on the previous regime. Deflect all of it. Anything evaluative you say before day one travels at remarkable speed and arrives distorted. The team is deciding whether you are safe to talk to; give them evidence that you are.
No vendor meetings. The moment your hire becomes public, your inbox fills with congratulations from salespeople. Take none of the meetings. You do not know the environment, you do not own a budget yet, and every vendor conversation you have pre-start creates an expectation you will have to unwind. The polite version: “Happy to talk after my first 90 days.” The vendors who respect that are the ones worth talking to later.
Intelligence You Can Gather Legitimately
There is a real difference between pre-start intelligence gathering and jumping the gun. The test: anything public, plus anything the company hands you when asked, is fair game. Anything requiring system access or that puts employees in the position of reporting to you before you are their boss is not.
Five items worth collecting, all of which feed directly into the plan you will rebuild in week one:
- Public breach and incident history. Breach notification databases, state attorney general filings, press coverage, and the company’s own disclosures if it is public. You are not just cataloging incidents; you are reading how the company communicated about them, because that tells you how it will communicate about yours.
- Glassdoor patterns for the security org. Ignore individual reviews and read for patterns across the engineering and security postings: repeated mentions of turnover, of a specific dysfunction, of leadership churn. Three reviews mentioning the same problem across two years is signal. One angry review is noise.
- The audit and regulatory calendar. Ask for it. This is a completely legitimate pre-start request, and almost nobody makes it. Email your manager: “Could someone send me the audit and compliance calendar for the next two quarters?” Knowing that the SOC 2 audit window opens three weeks after your start date, or that a regulator exam lands in your second month, reshapes your entire first-quarter plan, and it is far better to learn it now than in your day-two inbox.
- The customer security-review backlog, by size. Ask how many customer security questionnaires and reviews are currently open. You do not need the contents, just the number and the trend. This single figure is the best pre-start proxy I know for how much of your team’s capacity is being consumed by reactive commercial work, and it predicts whether your first quarter is strategy or firefighting.
- The cyber insurance renewal date. If it lands in your first six months, the renewal questionnaire becomes a forcing function for half your assessment work, and you want your plan built around it rather than surprised by it.
All five of these feed the operating version of your 90-day plan. If you built an interview version during the loop, this is the data that starts converting it into something executable. Several of these items also map to questions you should have asked during the process itself; the questions guide covers which ones panels expect and which ones they remember.
Leave Well
How you exit your current employer is part of your pre-start diligence, because the security community is small and hiring managers check back-channel references after you start, not just before.
Transition documents. Leave behind a real handover: open risks with owners, in-flight projects with status, vendor contracts with renewal dates, the passwords-and-access map for anything only you knew. Not because your current employer has earned it in every case, but because the person inheriting your mess will be asked about you for the next decade.
The no-bad-mouthing rule. From the moment you resign until forever, you have nothing negative to say about the employer you are leaving. Not to your new team, not at conferences, and especially not to recruiters, who are the most efficient gossip network in this industry and who take notes. “It was time for a new challenge” is boring precisely because it is safe.
Counteroffers. You may get one, possibly a startlingly large one, because replacing a security leader mid-year is expensive and your employer knows it. Decline it. The counteroffer fixes the compensation problem and leaves intact every other reason you started looking, and it converts you, permanently, into the person who was leaving. Budget season will remember. Most counteroffer acceptances end in a departure within the year anyway, except now with a torched bridge at the company that originally hired you.
Notice periods and garden leave. In the US, two to four weeks is standard and security leaders should offer the longer end; it costs little and reads well. If you are in the UK or Europe, this section is an entirely different animal: three-to-six-month notice periods, garden leave clauses, and start dates negotiated around them are the norm, and the UK and EU market guide covers the mechanics, including what garden leave means for when you can legally begin the pre-start work described above.
The Logistics That Bite
Three administrative items that generate expensive surprises for executives who assume someone else is tracking them.
The benefits gap. Depending on the two companies’ policies, your old coverage may end on your last day or at month-end, and your new coverage may not begin until your start date or the first of the following month. A three-week gap with a family on your plan is a real exposure. Check both dates before you set your start date, and price COBRA for the gap if one exists.
Equity exercise windows at the old employer. This is the expensive one. If you hold vested options at a private company, most plans give you 90 days after termination to exercise or forfeit them. Exercising can mean writing a six-figure check for the strike price plus, if the spread is large, a tax bill on paper gains you cannot sell. And there is a detail even experienced executives miss: incentive stock options that are not exercised within 90 days of leaving typically convert to non-qualified options, which changes the tax treatment even if the plan allows a longer window. Talk to a tax advisor before you resign, not after, because the clock starts at termination and does not care that you were busy onboarding.
Start-date timing against the fiscal calendar. If you have flexibility on your start date, spend it here. Ask where the new company is in its budget cycle. Starting two weeks before budget lock means you can influence next year’s security spend with fresh eyes and maximum goodwill; starting two weeks after means executing someone else’s budget for a year and explaining variances you did not create. The same logic applies to board meeting timing: starting three weeks before a board meeting hands you an absurd deadline, while starting just after gives you a full cycle to prepare your first appearance. Most candidates pick a start date based on their vacation plans. Pick it based on the fiscal calendar.
Reset the Plan in Week One
Everything above converges here. The plan you built during the interview process, however good, was written from the outside. Your first week’s real job is rebuilding it with inside information: the audit calendar you requested, the backlog number you collected, the success criteria your manager stated, the privilege ground rules the GC drew, whatever the predecessor told you nobody would fund.
Some of your outside assumptions will survive contact. Most will need surgery. That is not a failure of the original plan; the willingness to revise it is exactly what separates the operating document from the interview artifact, a distinction the 90-day plan guide treats at length. If you want a structured starting point, the 90-day plan template is built to be filled in twice: once from the outside during the loop, once from the inside in week one. The rest of the template library covers the artifacts that come due soon after, including the first board readout.
The candidates I remember from debriefs, the ones who made hard decisions easy, all had some version of this instinct: they treated the offer signature as the start of the job, not the end of the process. The 30 days before day one are the only month you will ever get with full goodwill, no accountability, and clear eyes. Spend them like they are worth something, because they are worth more than any month that follows.