The first 90 days: an execution plan for teams

Foundations · Part 3 of the 80/20 series · 11 min read · Reviewed June 2026

Part 1 made the argument; part 2 gave you the playbooks. This part is for the moment someone says "fine — show me the plan." It turns the five controls into a 90-day schedule with names, dates, a meeting cadence, and the three decisions only leadership can make. It assumes one to three people doing the work alongside their actual jobs, which is the honest operating condition of nearly every small organization.

The plan applies the Pareto principle to the calendar, not just the controls. Three rules keep it from becoming every other failed project plan:

• Finish before starting. Nothing new enters flight until the current item is at its "done means" line. Five controls at full coverage beat twenty at 40% — the same is true of weeks.
• Evidence is captured at completion, not reconstructed later. The export, the screenshot, the dated note — they take two minutes in the moment and two days at audit time.
• Leadership decisions are pre-booked. The plan's three decision points go on executive calendars in week one, so the work never stalls waiting for a meeting that doesn't exist yet.

Three phases: see, lock, prove

Days 0–30 build visibility — you cannot Pareto an environment you can't see. Days 31–60 deploy the locks at full coverage. Days 61–90 prove it: test, document, brief, and convert the project into a routine. Week thirteen is deliberately empty; the unplanned-work tax is real, and a plan with no slack is a promise to disappoint someone.

Who does what

Small-team RACI charts collapse under their own weight, so this plan uses three roles: a driver (does the work, exactly one name), a decider (makes the call when the driver can't), and informed (finds out before it affects them, not after). The most common 90-day failure isn't technical — it's a control stalling for three weeks because nobody was explicitly the driver.

The weekly 25 minutes

One standing meeting, 25 minutes, same time every week, three questions: What reached "done means" since last week? What's blocked, and is it blocked on work or on a decision? What decision do we need from someone in this room? Anything that hasn't moved in two weeks gets named out loud as blocked or abandoned — naming which one is usually the meeting's most useful moment. Keep the notes; dated weekly notes from a security rollout are themselves evidence that the program operates.

The three decisions only leadership can make

Book these in week one. Frame each as a choice between named options — decisions, not dashboards:

• Recovery priorities (week 1–2). "If everything went down tonight, what comes back first, how fast, and how much data loss is survivable?" Their answers size the backup spend — and if the answers are expensive, that's a fact about the business, not a failure of the plan.
• Exceptions and acceptances (weeks 4–7). Every MFA exemption, every account keeping admin rights, every system left out of scope is a risk acceptance. Named owner, written reason, expiry date, leadership signature. The signature is the control.
• The spend rule and its exceptions (week 12). Nothing new gets bought until the five are done — and the briefing is where leadership either re-affirms that rule for quarter two or consciously makes an exception. If money must move early, backups are the one defensible place.

When the plan slips

It will. The Pareto answer is to protect coverage, not the schedule: a finished control two weeks late beats two controls at 70% on time. If you must cut, cut in this order — week-13 buffer first, then stretch the prove phase, then stretch the lock phase. Never trade away full coverage of MFA, legacy auth, or the restore test; those three are where most of the risk reduction lives. And if the slip is caused by unplanned operational work, log the hours — that number is the staffing argument you'll want later.

The 90-day checklist

Every "done means" line from the plan, in one place. It works as a team scoreboard in the weekly 25 minutes — and each ticked box should have a dated artifact behind it in the evidence folder.

Day 91 isn't the end of security — it's the end of security as a project. What remains is a small routine (the quarterly cycle) and a question: is the 20% you locked actually staying locked? Measuring that is part 4.