First Ninety Days on IO

The first ninety days should establish a trustworthy operating baseline, not manufacture a maturity improvement story. Some practices will not have enough elapsed history to assess by day ninety. Reporting that limitation correctly is part of a successful deployment.

Industry basis and IO position

NIST CSF Profiles, C2M2 self-evaluation concepts and ISO management systems all begin with context, scope, governance and current-state understanding. IO follows that sequence but prioritises execution evidence over questionnaires. The ninety-day plan is an implementation guide, not a promise of certification, compliance or maturity advancement.

Before day 1: agree the contract

• Executive sponsor, programme owner and technical owner named.
• Initial domains and business populations in scope.
• Decisions the deployment must support.
• Required evidence sources and data-processing constraints.
• Existing risk model, appetite, policy sources and reporting cadence identified.
• Demo, pilot and production environments clearly separated.

Days 1-30: establish evidence you can trust

Outcomes

• Authorise the smallest set of high-value, read-only evidence connections.
• Complete identity resolution, history, timestamp, duplicate and schema checks.
• Record source coverage and record completeness separately.
• Classify missing dimensions as not measured with reasons.
• Walk at least one finding back to its original records.
• Confirm the current risk and maturity model versions.

Decisions

Do not do yet

Do not publish an enterprise maturity level from incomplete windows. Do not treat connection health as evidence completeness. Do not calibrate IO thresholds against the tenant or compare synthetic demo values with the customer.

Days 31-60: turn findings into accountable work

Outcomes

• Confirm owners, rules, disposition windows and exception routes.
• Select a small set of material playbooks rather than launching every available action.
• Define verification measures before work begins.
• Capture baselines at the accountability event.
• Establish standing programme cadences where the practice is scheduled.
• Separate urgent actions without a baseline from work eligible for verification.

Quality gate for each accepted action

• The signal and population are named.
• The rule and playbook versions are fixed.
• The owner can make the required decision.
• Baseline, direction, noise threshold and re-measurement window are defined.
• Rival explanations and guardrail measures are recorded where material.
• The action addresses a risk, policy gap or binding constraint, not merely available activity.

Days 61-90: measure, adapt and govern

Outcomes

• Re-measure only actions whose valid window has closed.
• Record Verified, Unverified, Regressed or Inconclusive; keep Pending separate.
• Review the first regressed or unverified playbooks without scoring the practitioner.
• Produce a binding-constraint worksheet for each assessable material practice.
• Draft an IO Reporting™ board update with position, coverage, movement and a named decision.
• Publish open questions: evidence age, uncalibrated thresholds and incomplete windows.

A credible day-90 readout

Report:

1. source coverage and completeness by domain;
2. assessable versus not-yet-assessable practices;
3. accepted work and verification coverage;
4. verification result distribution for eligible completed work;
5. measured residual position and unassessable risks;
6. initial binding constraints; and
7. decisions and commitments for the next quarter.

What success looks like

Success is not a higher score. It is a smaller gap between what the organisation says it does and what the evidence can support: named owners, reconstructable findings, measures defined before work, visible unknowns and at least one closed feedback loop.

Common failure modes

• Connecting every available system before deciding what question each answers.
• Importing incomplete history and calling the first partial window a baseline.
• Launching high-volume playbooks that improve activity metrics rather than exposure.
• Hiding low verification coverage behind a strong pass rate.
• Treating the ninety-day milestone as permission to overstate maturity.
• Publishing a board update with no decision requested and no confidence statement.

Day-90 decision

At day ninety, decide whether to expand scope, deepen measurement in the current scope, or pause and repair evidence quality. Expansion is not the default. A narrow trustworthy deployment is a better foundation than a broad green one no one can reconstruct.