First 90 days solo IT plan

Days	Focus
0 to 10	Access and facts
11 to 30	Test what you inherited
31 to 60	Exceptions and end-of-support dates
61 to 90	A record someone else can run from

The estate is yours now

You are the IT department. Your predecessor may have left with three days’ notice and folders named “old”. Or six years of decisions may rest on what only you remember.

One solo IT director said, “I’m one person. If I’m sick or on vacation, nothing gets done.”

By day 90, write a record another person can operate from. Check access, restore one system and tie admin accounts to people. Set vendor decision dates and list every claim you must defend.

Buy nothing from this plan. Write the requirement and test the current state first.

Give every fact a status

Almost everything you have been told is an inherited claim. Someone said it, or a 2021 document says it, and nobody has checked since.

That is not a criticism of anyone. Inherited claims fail exactly when they matter, in an incident, an audit, a claim or the week you are ill. So every fact you record gets one of six statuses.

Status	Meaning	What earns it
Inherited claim	A person or document says it, and you have not seen it	Nothing, since it is everything’s default on day one
Confirmed	You saw the setting yourself within the last 30 days	An export, a timestamped screenshot or a console you opened
Tested	It was exercised and produced a result	A restore that worked, a failover that ran, a number a person answered
Unknown	Nobody can say	Writing it down instead of leaving a blank
Blocked	You lack access, credentials or a vendor reply	What blocks it, who can clear it and when you asked
Owner needed	It exists and no person owns it	A record, until it gets a name or is retired

Confirmed and tested differ, and most estates fail in the gap. A backup setting you looked at is confirmed. A backup you restored from is tested, and only that tells you what happens on the bad day.

Put a status beside every line. When a board, auditor, insurer or successor reads it, the status column shows what you stand behind.

Four rules before you change anything

1. Change nothing you cannot restore. You do not yet know what depends on what, and the undocumented scheduled task may run payroll.
2. Buy nothing for thirty days. Vendors will find you within a week of your new title, before you can judge their proposals.
3. Promise no date for anything unchecked. Leaders will ask “are we secure” in week one. Say what you confirmed, what you have not seen and when you will report again.
4. Write down every claim. Note who said it and when. This register of inherited claims will be your most valuable work this quarter.

Days 0 to 10: Access and facts

This block has no projects, rollouts or purchases. Get to where you can see the estate. Write down what you were told before you forget who said it.

Log in to every critical system yourself

Confirmed means you opened it, not that someone said you have access.

System	Why it matters	Status
Identity provider or directory, such as Entra ID, Active Directory, Google Workspace or Okta	Everything else hangs off it
Email admin	Mail is the main attack path and the main recovery path
Endpoint management	The only view of which devices exist
Backup console	Its login often matches production, which is itself a finding
Firewall and edge devices	Including firmware version and support status
Domain registrar	The account most often lost in a handover, and losing it can cost the domain, mail and recovery
DNS host, if separate
The main business system, at admin level	The one the business cannot run without
Cloud billing or subscription owner	Often held by a departed founder or an outside accountant
Phone system admin	Used in fraud and in recovery, and always forgotten
Physical access and alarms, if IT owns them

For each, record how you get in, whether MFA protects it, who else has access and where account recovery goes.

Ask who gets in if your account fails

Ask on day one, and record the answer even when it is bad.

• Is there an emergency admin account that works when the identity provider is down?
• Where are its credentials, physically?
• Who can retrieve them, and does that take two people?
• When was it last used or tested?
• Is its second factor on a device of someone who still works here?

If any answer is unknown, the whole emergency access line is unknown. It tops the next list, as one of the few items that may jump the queue.

Collect the facts

Item	Where it comes from	Status
Every person and vendor with admin access	A directory export, plus a written request to the outsourced provider
Technology spending	13 months of payables and card statements
Incident contacts	The insurer’s claims line, broker, counsel, bank fraud line, outsourced IT after hours and mail platform support
The last restore test	If none exists, write “none on record”, which is common
The last risk assessment, audit answer, insurance application or client questionnaire	These record what the organisation already claimed to outsiders
The five systems the business cannot run without	Ask the business, not IT, since the business is right
Exceptions mentioned in passing	”That machine can’t have the agent.” Write it down that day

The fifth row matters most. Somewhere a signed insurance application or client questionnaire makes claims about your estate. You inherited those claims and must now defend them, so read them in the first ten days.

Deliver the day 10 record

Write one page on what you can and cannot reach, the five critical systems and the incident contacts. List every claim with its source.

Send it to whoever hired you, noting which items are confirmed and which inherited. That line sets expectations for the ninety days and protects you later.

Days 11 to 30: Test what matters

You cannot check everything, so check first whatever would hurt most if false.

1. Restore one thing for real. Restore a folder, a mailbox, a database or a virtual machine, and time it. Record what was restored, from which backup, how long it took and who watched. It often finds three problems at once: shorter retention, slower restores and backups sharing production credentials.
2. Export the MFA policy with every exclusion. Export the policy, its scope and a count of exclusions, not a screenshot of your own sign-in. Exclusions pile up quietly, from old apps, service accounts and scanners to travelling executives. Give each one an owner and a reason.
3. List every admin account with a person’s name. Cover every system from the day 0 to 10 list. Service accounts need owners too, and your provider’s technician accounts belong on the list.
4. Count devices you can believe. Reconcile the endpoint console, the identity provider’s devices and the network’s DHCP or ARP table. They will disagree, so record the gap as a finding. A believable count with a known margin takes a week, and a perfect one takes a year.
5. Build the renewal calendar. For each recurring contract, record the end date and notice period, work out the decision date and assign an owner. A missed notice window locks in a year you no longer control.
6. Write version one of the continuity record. It is described below. Write it badly on day 25, since a bad one beats none.

The 2025 Verizon Data Breach Investigations Report covered 22,052 incidents and 12,195 confirmed breaches. Ransomware appeared in 44% of breaches and third parties in 30%.

Its data is contributed cases, not a population sample. Treat it as direction, which is enough to justify an afternoon’s restore.

Days 31 to 60: Exceptions and dates

Give every exception an owner and a date

Every estate runs on exceptions. A machine cannot take the agent, an account cannot use MFA, or a vendor keeps remote access. The front desk shares a login, and a 2019 firewall rule stays open.

An undocumented exception looks exactly like a misconfiguration. Writing it down changes nothing technically. It turns a gap into a decision someone made.

Exception	System	Why it exists	Approved by	Date	Compensating control	Review date	Status

If you cannot find the approver, mark it “owner needed” and take it to leadership. Some will be accepted, and some closed within a week once someone with authority sees them.

Put end-of-support dates on the calendar

List everything past its support date, from operating systems, apps and firewalls to switches, printers, phones and the door controller.

Windows 10 support ended on 14 October 2025, with no more help, updates or security fixes. Commercial Extended Security Updates start at US$61 per device in year one and double each year. Show finance that doubling, since it turns “upgrade eventually” into a cost curve.

Test the incident contacts

Call every number in business hours, and tell whoever answers that you are checking it. Confirm your provider’s after-hours path and the insurer’s claims line above all. An untested contact list is an inherited claim about your most urgent asset.

Ask your broker or counsel which notification duties may apply. Timing and scope vary by regulator, entity type and data type, and counsel decides them. Your job is knowing who decides and having their number.

Run one thirty-minute tabletop

Gather the decision-makers and walk one scenario on paper: the accounting system is encrypted at 6am on Monday. Who declares the incident, calls the insurer, decides on payment, and speaks to clients and staff? Then ask what happens if you are unreachable, and watch the room.

Give leaders one dated decision memo

Write one decision properly. Give the request, the business risk and the costs split into known, unknown and modelled.

Add two or three real options including a smaller one, one recommendation and a named owner with a date. Do not lead with fear or bring a tool list.

Days 61 to 90: Close and hand over

Close the unknowns

Revisit every unknown and blocked row. Each becomes confirmed or tested, a written acceptance, or a dated, owned item for next quarter. Nothing stays unknown without a reason and a date.

List the decisions that are not yours

Open decision	What it affects	What I need to decide it	Who decides	Date needed

This list stops you being the bottleneck for choices that were never yours.

Show leaders what one person cannot carry

Within ninety days you will need to say that one person cannot both run and improve the estate. Make the case with facts.

Show the hours spent on routine work, incidents and planned projects. Bring the continuity record and its two-week test, which make the point better than argument.

National projections help, within their limits. The Bureau of Labor Statistics projects about 317,700 yearly openings in computer and IT jobs from 2024 to 2034.

It also projects 29% growth for information security analysts, with about 16,000 openings a year. These figures prove no vacancy at any one employer, including yours.

Keep the case local. Show your hours, what is not getting done and three ways to change it. One way should cut scope instead of adding staff.

Assemble the record

Gather one document covering what was confirmed, what was tested and what remains unknown. Add the exceptions, the renewal calendar, the open decisions and the continuity record. Date it and set the next review.

Nobody here had this ninety days ago. It is a written operating record with a status beside every claim.

The bar for each area

Area	Confirmed looks like	Tested looks like
Admin access	A current export of every admin account, each with a person’s name	Removing one stale admin account and checking nothing broke
Identity	The MFA policy, scope and every exclusion, exported and dated	An in-scope account actually challenged for a second factor
Devices	A count reconciled across three sources, with the gap stated	A device on the network but missing from the console, found and resolved
Backup and restore	Backup settings, retention and deletion protection, seen by you	A restore with date, contents, time taken and a witness
Vendor renewals	End date, notice period and decision date for every contract	A notice sent the way the contract requires
Incident contacts	Names, numbers and after-hours paths	Every number called and answered, with dates
Exceptions	Each one recorded with reason, approver and compensating control	A review that closed or formally accepted each one
Continuity	A current continuity record	Someone else used it for a real task, timed
Open decisions	The list, with what each needs	A decision returned by a named person on a date

The continuity record

This answers “if I’m sick or on vacation, nothing gets done”. It is one or two pages, not a runbook for everything you do. It holds the minimum a capable person needs to keep things running for two weeks without you.

Section	Contents
Who to call	For an outage, a breach or ransomware, the main system failing, a payroll or bank problem and door access failing. Who to call first, second and third, with numbers
Getting in	Where credentials live, the emergency access steps, who holds the second factor and what needs two people. Never the credentials themselves
The five critical systems	Vendor, support contract number, support phone, after-hours path and one line on what each does
Routine work while I am out	The few dated tasks, such as month-end close, a nightly job someone checks, a weekly report or a payroll cutoff. When, how, and how to tell it worked
What not to do while I am out	Changes that break things, the vendor who will push a deal and systems not to reboot in working hours
Known problems we live with	Issues and their workarounds, so nobody rediscovers them
Renewals in the next 60 days	With decision dates and owners, so no window closes while you are away
Where it lives	Somewhere reachable when the network is down. Print it, name its place and put a copy where non-IT staff can find it
Last reviewed	The date and reviewer. Review quarterly and after any big change

Test it on someone else

Give it to someone outside IT, and ask them to find the mail platform’s after-hours number using only the document. Time them.

If it takes over two minutes, the document is unfinished. If they cannot do it, you learned that in a quiet office, not at 11pm on a Friday. Three months later, ask who they would call first in a suspected breach, and expect an answer without much reading.

Why it matters

Continuity failure is a security failure. When the one person who understands the estate is unreachable, people guess and grant access to unblock work. Decisions needed in the first hour come in the eighth.

The record also does most of the work of an audit answer, a client questionnaire and an insurance application. Someone will ask for these facts within a year, so write them once.

When buying is right

Buying is sometimes the answer. Keep this order, so no vendor sets your priorities.

1. Write the requirement. Tie it to an obligation, contract, insurance form, gap you found or need you can state in business terms.
2. Test the current state. Know what you have and whether it works.
3. Check what you own first. Many gaps close with a setting in a platform you already pay for. Check your licence tier before the market.
4. Find two or three real options. Include a smaller one, and doing nothing.
5. Record what the recommender earns. Ask in writing about margin, commission, rebate, partner credit or referral fee. A paid recommendation can be right, but it carries a heavier burden of proof.
6. Know the exit cost. Learn the notice period and renewal term before you sign.

Anything arriving in another order is someone else’s plan.

Five things to expect before day 90

• “We have MFA.” They mean they personally have it. Check the policy and its exclusions, the most consequential inherited claim in most estates.
• A green backup dashboard with nothing ever restored. Green means the job ran, so restore something.
• A vendor’s proposal in week two. They saw your new title too. Meet them if you like, and buy nothing for thirty days.
• An unwritten exception that carries real work. The machine that cannot take the agent runs something vital. Record it, add a compensating control and set a review date.
• The urge to move fast. Speed in month one makes you the only person who knows why things are as they are. That is the problem you were hired to solve, so write as you go.

Keep the record current

This plan is general operating guidance for a solo IT role, not legal advice. It does not set what any regulation, contract, insurance policy or funder requires.

Notice duties, security rules and record retention vary by regulator, entity, state and data type. Counsel decides them.

SBK will review your continuity record and ten-day list if a second view helps. Call (718) 407-4169.