What is the First 90 Days course about?
A step-by-step guide to building credibility in AI and data governance during your first 90 days Each order is checked and updated against the latest insights before delivery. That is why access takes up to 24 hours rather than being instant.
What situation is the First 90 Days for?
Security leaders face recurring cycles of evidence refresh, stakeholder chasing, and last-minute control mapping, especially when new tech like AI introduces ambiguity into established compliance packages.
Who is the First 90 Days course for?
Senior security and GRC leaders stepping into or recently appointed as CISO in highly regulated environments (financial, healthcare, funeral, energy, etc.) with accountability for both IT governance and data protection.
What do you take away from the First 90 Days course?
Produce a self-contained, auditor-ready governance package within 90 days Reduce evidence refresh effort by up to 70% across review cycles Establish personal credibility as the authoritative source on AI governance integration Align ISO 20000 controls with AI and data workflows without overhauling existing compliance programs Build a compounding library of reusable, cross-audit assets.
What's included with your purchase?
12 modules with 12 chapters each (144 chapters) Downloadable templates and worked examples for every module Hand-built implementation playbook delivered alongside course access 30-day money-back guarantee.
What does the First 90 Days cover on delivery and format?
Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access. Time investment: Approximately 90 minutes per week over six weeks, designed for completion on weekends or off-hours.
How does this compare to the alternatives?
Unlike generic compliance courses, this program is tailored to the first 90 days of a CISO in regulated services, with a focus on building reusable, compounding governance assets grounded in ISO 20000 and real-world implementation.
What does the First 90 Days cover on frequently asked?
Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.
Closely related courses: First 90 Days as CISO, First 90 Days as CISO in Pediatric Healthcare, AI-Driven Leadership in the First 90 Days, Building Credibility in Crucial Conversations.
More answers: what you get with every course, refund policy, all help answers.
A tailored course, built for your situation
First 90 Days: Building CISO Credibility in AI and Data Governance for Regulated Services
A step-by-step guide to building credibility in AI and data governance during your first 90 days
Each order is checked and updated against the latest insights before delivery. That is why access takes up to 24 hours rather than being instant.
The situation this course is for
Security leaders face recurring cycles of evidence refresh, stakeholder chasing, and last-minute control mapping, especially when new tech like AI introduces ambiguity into established compliance packages.
Who this is for
Senior security and GRC leaders stepping into or recently appointed as CISO in highly regulated environments (financial, healthcare, funeral, energy, etc.) with accountability for both IT governance and data protection.
Who this is not for
Junior compliance analysts, external auditors, or consultants who do not own internal governance delivery.
What you walk away with
- Produce a self-contained, auditor-ready governance package within 90 days
- Reduce evidence refresh effort by up to 70% across review cycles
- Establish personal credibility as the authoritative source on AI governance integration
- Align ISO 20000 controls with AI and data workflows without overhauling existing compliance programs
- Build a compounding library of reusable, cross-audit assets
The 12 modules (with all 144 chapters)
- Understanding the unique challenges of regulated service environments
- Defining success metrics for the first 90 days as CISO
- Mapping stakeholder expectations across executive, legal, and operational teams
- Building credibility through transparent communication and visibility
- Identifying low-effort, high-impact governance opportunities
- Creating a personal brand of reliability and technical depth
- Establishing baseline control inventory for audit readiness
- Aligning with organizational values and service mission
- Prioritizing risk areas without triggering alarm
- Documenting initial observations for future reference
- Setting up early feedback loops with compliance teams
- Planning your first executive update with confidence
- Overview of ISO 20000 and its relevance to AI service delivery
- Mapping AI workflows to service management processes
- Identifying gaps between AI development cycles and support models
- Applying service level agreements to AI model performance
- Designing incident management protocols for AI anomalies
- Integrating change management for AI model updates
- Using configuration management databases for AI asset tracking
- Ensuring availability and continuity for AI-driven services
- Aligning capacity management with AI compute demands
- Incorporating problem management into AI failure analysis
- Tailoring service request fulfillment for AI access controls
- Reporting service performance with AI-specific KPIs
- Assessing current data classification and handling practices
- Defining roles and responsibilities for data stewardship
- Creating a data inventory aligned with regulated categories
- Implementing metadata tagging for auditability and search
- Setting policies for data access and consent management
- Designing data quality checks for AI training inputs
- Documenting data lineage across systems and transformations
- Securing sensitive data in development and testing environments
- Managing data retention and deletion in line with policy
- Building cross-functional alignment on data ownership
- Integrating data governance with existing GRC tools
- Producing evidence-ready data control documentation
- Defining the scope and structure of your credibility package
- Selecting high-visibility controls for early validation
- Drafting clear, auditor-friendly control descriptions
- Linking controls to regulatory requirements and standards
- Including implementation evidence and system screenshots
- Adding stakeholder attestations and sign-offs
- Versioning and storing the package for future use
- Creating a summary dashboard for executive review
- Preparing for auditor Q&A with supporting rationale
- Using the package to guide team alignment meetings
- Updating the package incrementally after each cycle
- Scaling the package across business units and systems
- Researching common regulator focus areas in your industry
- Mapping your controls to relevant laws and regulations
- Preparing for inquiry responses with documented workflows
- Conducting internal dry runs of regulator interviews
- Training spokespeople on consistent messaging
- Documenting exceptions and compensating controls
- Maintaining independence in self-assessment processes
- Tracking regulatory changes and updating frameworks
- Engaging legal counsel on interpretation nuances
- Balancing transparency with operational discretion
- Using past findings to strengthen current posture
- Demonstrating continuous improvement over time
- Identifying reusable components in governance documentation
- Standardizing templates for control descriptions and evidence
- Building a central repository for governance assets
- Versioning artifacts to reflect organizational changes
- Tagging artifacts for easy retrieval by topic and system
- Training team members to contribute and maintain content
- Automating data pulls for recurring reports
- Linking artifacts to risk registers and issue logs
- Using artifacts in new hire onboarding and training
- Repurposing content for board-level summaries
- Extending artifacts to third-party vendor assessments
- Measuring reuse frequency and time saved
- Translating technical controls into business impact
- Highlighting risk reduction and cost avoidance
- Presenting progress using consistent visual formats
- Timing communications around key business cycles
- Anticipating executive questions and preparing answers
- Using storytelling techniques to convey progress
- Avoiding jargon while maintaining technical accuracy
- Linking governance to customer trust and reputation
- Balancing transparency with strategic discretion
- Managing expectations around resource needs
- Following up on action items and decisions
- Building a reputation as a clear, reliable communicator
- Identifying key partners in each governance domain
- Establishing regular sync points with peer leaders
- Facilitating joint problem-solving sessions
- Resolving conflicts over control ownership and priority
- Creating shared goals and success metrics
- Documenting agreements and action items
- Using collaborative tools for real-time updates
- Escalating strategically when stuck
- Recognizing contributions from other teams
- Building goodwill through reciprocity
- Maintaining neutrality in interdepartmental disputes
- Tracking cross-functional deliverable status
- Choosing monitoring tools that integrate with existing stack
- Defining thresholds and alerting rules for anomalies
- Scheduling regular control validation checks
- Automating evidence collection where possible
- Reviewing logs and reports for signs of drift
- Conducting spot checks on high-risk processes
- Updating monitoring scope as systems evolve
- Integrating with SIEM and SOAR platforms
- Reporting monitoring results to oversight bodies
- Responding to findings with corrective actions
- Documenting monitoring activities for auditors
- Improving detection accuracy over time
- Understanding the audit schedule and scope
- Assigning responsibilities for evidence collection
- Conducting pre-audit readiness assessments
- Running internal mock audits with sample requests
- Coordinating walkthrough timing across teams
- Responding to findings with root cause analysis
- Negotiating findings using documented rationale
- Tracking open items to closure
- Using auditor feedback to improve processes
- Maintaining professional rapport with auditors
- Capturing lessons learned after each cycle
- Reducing audit burden year over year
- Assessing maturity of governance in other departments
- Identifying champions to lead adoption elsewhere
- Adapting the credibility package for different systems
- Conducting governance gap assessments
- Prioritizing systems based on risk and impact
- Phasing rollout to manage workload
- Providing training and support materials
- Monitoring adoption and addressing resistance
- Celebrating early wins to build momentum
- Integrating with enterprise architecture planning
- Updating policies to reflect expanded scope
- Reporting enterprise-wide progress to leadership
- Scheduling regular self-assessments of your posture
- Tracking changes in regulations and standards
- Updating your credibility package annually
- Staying visible through consistent communication
- Seeking feedback from peers and stakeholders
- Mentoring junior team members in governance practices
- Contributing to industry forums and events
- Publishing internal thought leadership pieces
- Keeping skills current with ongoing learning
- Balancing innovation with compliance obligations
- Defending governance investment during cost reviews
- Leaving a lasting legacy of disciplined execution
How this maps to your situation
- New CISO onboarding
- AI integration into regulated services
- First audit cycle preparation
- Cross-functional governance alignment
Before vs. after
What's included with your purchase
- 12 modules with 12 chapters each (144 chapters)
- Downloadable templates and worked examples for every module
- Hand-built implementation playbook delivered alongside course access
- 30-day money-back guarantee
Delivery and format
- Course and learning environment access provisioned within 24 hours of purchase
- Hand-built implementation playbook delivered alongside course access
Format: Text-based modules and chapters in the Art of Service learning environment, plus downloadable templates and worked examples for every chapter, plus the hand-built implementation playbook delivered alongside course access.
Time investment: Approximately 90 minutes per week over six weeks, designed for completion on weekends or off-hours.
How this compares to the alternatives
Unlike generic compliance courses, this program is tailored to the first 90 days of a CISO in regulated services, with a focus on building reusable, compounding governance assets grounded in ISO 20000 and real-world implementation.
Frequently asked
Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.