ONBOARDING AND INTEGRATION PROGRAM

30/60/90-Day Plans · CERG 101 · Buddy System · First Contribution

Table of Contents

1. Purpose and Scope
2. Onboarding Philosophy
3. Before Day One: Manager Preparation
4. Week One: Orientation and Access
5. The 30/60/90-Day Model
6. CERG 101: The Core Curriculum
7. The Buddy System
8. The First Contribution Milestone
9. Cross-Pillar Rotation
10. Role-Specific Onboarding by Family
11. Onboarding for Managers
12. Measuring Onboarding Effectiveness
13. Document Control

1. Purpose and Scope

A new Cloud Security Engineer can take six to nine months to understand their environment well enough to contribute independently. During those months, they are learning where the architecture diagrams live, who owns which platform, what a “normal” alert looks like, and how CERG’s pillars interact. They are not yet producing at the level of their grade, and they feel it. The gap between their capability and their output is stressful for them and expensive for the organization.

This document closes that gap. It defines a structured onboarding program that cuts time-to-productivity from a typical six-to-nine months to a target of three to four. It provides role-specific 30/60/90-day plans for each role family, a CERG 101 curriculum that ensures every new hire understands the framework, a cross-pillar buddy system, a first-contribution milestone that builds confidence and visibility, and a cross-pillar rotation that makes the left-right knowledge model real from day one.

It applies to every new CERG hire, regardless of role, grade, or prior experience. A seasoned Sr. Advisor joining from another organization moves through the same structure faster than a new Specialist, but they move through the same structure. The program also applies to internal transfers joining CERG from another function, with adjustments for their existing organizational knowledge. It does not apply to contractors and consultants, who follow the condensed onboarding defined in CERG-GOV-CON-001 (Planned, V1.x).

Onboarding Is a Program, Not a Checklist

The CERG Framework (FRM-001 §9.2) describes the left-right knowledge model: a new engineer can learn the organization’s standards from Governance, understand the current threat environment from Risk, and have context for every major system from Engineering’s project documentation. That describes the resources available. It does not describe a program. This document is the program. A new hire who spends their first month reading documents alone is not being onboarded; they are being oriented to a library. Onboarding requires structured exposure, guided practice, and human connection.

2. Onboarding Philosophy

1. Productivity is a gradient, not a switch. The goal is not that the person is fully productive on day 30. It is that on day 30 they have made a concrete contribution; on day 60 they are contributing to their pillar’s standing work with decreasing supervision; on day 90 they own a defined work stream and their teammates feel the difference.

2. The pillar owns the person; the program owns the first 90 days. The hiring manager is accountable for the new hire’s success. The onboarding program provides the structure; the manager executes it.

3. Cross-pillar fluency starts on day one, not year three. Every new hire spends structured time in the other two pillars during their first 90 days. The left-right knowledge model in FRM-001 §9.2 is not an aspirational goal for senior practitioners; it is built into how every person enters the organization.

4. The buddy is not the manager. Every new hire has a peer buddy from a different pillar. The buddy provides the unvarnished perspective a manager cannot: where the documentation is wrong, which team has a feud with which other team, how the espresso machine actually works.

5. The first contribution is the inflection point. Within 30 days, every new hire makes a concrete, visible contribution and presents it to their pillar. This is not a test. It is the moment the person transitions from “learning the environment” to “operating in it.” It is psychologically important and it should be celebrated.

3. Before Day One: Manager Preparation

The hiring manager completes the following before the new hire’s first day. If these items are not complete, the new hire spends their first week waiting for access and losing momentum that is difficult to regain.

The First-Day Test

A new hire should be able to log in, access their email, read their first-week schedule, open the CERG document library, and start reading the Framework by 10:00 AM on day one. If they spend their first morning waiting for account provisioning, the manager has not prepared. The cost of a lost first morning is not the four hours of productivity; it is the message that the organization does not have its act together. That message is hard to undo.

4. Week One: Orientation and Access

The first week is structured but not overloaded. The goal is orientation to the environment, the people, and the framework, not task execution.

4.1 Day One

4.2 Days Two Through Five

By the end of week one, the new hire has:

• Met every member of their immediate team and their pillar leader
• Met at least one person from each of the other two pillars
• Read the CERG Framework (FRM-001) and the CERG Operating Model (OM-001)
• Read their own job description (JD-001)
• Read the competency model for their role family (CMP-001 §§4-6)
• Understood the performance management cadence and what their first review will evaluate (PERF-001 §3-4)
• Completed any mandatory organizational training (security awareness, code of conduct, compliance)
• Had a daily 15-minute check-in with their manager
• Had at least one informal conversation with their buddy
• Started the CERG 101 curriculum (§6)

The manager sends a Friday-afternoon email to the pillar summarizing the new hire’s first week (with the new hire’s consent) and noting one thing the new hire observed that the team may find useful. This is the first signal that the new hire’s perspective is valued.

5. The 30/60/90-Day Model

5.1 Days 1-30: Learn and Contribute

Goal: Understand the environment, meet the people, make a first contribution.

Key activities:

• Complete the CERG 101 curriculum (§6)
• Shadow at least two standing meetings: one within the home pillar, one cross-pillar
• Pair with a senior team member on one active work item: observe, ask questions, understand the workflow end to end
• Identify a task the person can complete independently and complete it: this becomes the First Contribution (§8)
• Spend one day with the buddy’s pillar, observing how that pillar operates (this is the first third of the cross-pillar rotation; §9)
• Daily 15-minute manager check-in (weeks 1-2); every-other-day (weeks 3-4)
• Weekly informal check-in with the buddy

Success indicators at day 30:

• The person can describe CERG’s three-pillar model, their role’s place in it, and how their pillar interacts with the other two
• The person has completed their First Contribution and presented it to the pillar
• The person has met everyone in their pillar and key people in the other two
• The person can navigate the document library: they know where to find the policy, standards, procedures, and templates relevant to their role
• The person has access to all tools and has used at least the primary ones in a supervised context
• The manager has observed the person demonstrate at least one competency from CMP-001 in an authentic work context

5.2 Days 31-60: Practice and Deepen

Goal: Contribute independently to pillar work; develop cross-pillar understanding; identify development priorities.

Key activities:

• Own one defined work stream within the pillar with decreasing supervision (e.g., triage a subset of CSPM alerts, manage evidence collection for a control family, perform supervised architecture reviews for low-complexity projects)
• Complete the second cross-pillar rotation day (§9)
• Participate in at least one cross-pillar working group or project as an observer-contributor
• Review the CMP-001 competency matrix for their role family with their manager. Identify 2-3 development priorities for the first year
• Begin the technical onboarding for their role family per §10
• Weekly manager check-in (30 minutes)
• Bi-weekly buddy check-in

Success indicators at day 60:

• The person completes assigned work with minimal rework; their output is consistent with grade expectations for routine tasks
• The person has contributed to a cross-pillar discussion with a relevant observation or question
• The person has a documented development plan with 2-3 priorities aligned to CMP-001
• The person’s teammates report that the person is “starting to be useful” (this is a higher bar than it sounds: it means the person is reducing the team’s load, not adding to it)
• The manager has observed the person demonstrate at least three CMP-001 competencies in authentic work contexts

5.3 Days 61-90: Own and Integrate

Goal: Own a defined scope; demonstrate cross-pillar fluency; establish the performance baseline for the first formal review.

Key activities:

• Own a defined work stream independently: the manager sets outcomes; the person determines the path
• Complete the third cross-pillar rotation day (§9)
• Lead one item in a standing meeting: present a finding, a status update, or a recommendation to the group
• Complete the role-specific technical onboarding per §10
• Conduct a 90-day retrospective with the manager: what worked, what did not, what support the person needs going forward
• The manager prepares the first quarterly check-in notes per PERF-001 §3.2

Success indicators at day 90:

• The person owns at least one defined work stream. Their manager reviews outcomes, not tasks
• The person has worked directly with at least one person from each pillar on a shared objective
• The person can explain how a decision in their domain affects the other two pillars
• The person has identified at least one improvement to a procedure, tool configuration, or documentation item and raised it
• The person’s teammates would notice if the person were absent
• The manager can write a credible first quarterly check-in with evidence across at least four of the six SME evaluation dimensions

90 Days Is a Target, Not a Deadline

A new Specialist with no prior cybersecurity experience may need 120 days to reach the day-90 success indicators. A Sr. Advisor joining from another CERG-adopting organization may hit them at day 45. The structure is the same; the pace varies. The manager adjusts the timeline, not the expectations.

6. CERG 101: The Core Curriculum

Every new hire, regardless of role, grade, or prior experience, completes the CERG 101 curriculum within their first 30 days. The curriculum is a guided reading of the CERG document library, not a passive document dump. For each document, the new hire reads it, writes three questions or observations, and discusses them with their manager or buddy.

6.1 Required Reading (First 30 Days)

6.2 Role-Specific Reading (Days 10-30)

6.3 The CERG 101 Discussion

Within the first two weeks, the new hire and their manager have a 60-minute CERG 101 discussion. The agenda:

1. What was familiar? What parts of CERG resemble how the new hire’s previous organization operated?
2. What was different? What parts of CERG are novel, surprising, or challenging to the new hire’s mental model of how cybersecurity should work?
3. What was unclear? The manager answers questions and clarifies.
4. What should CERG 101 teach that it currently does not? The new hire’s fresh perspective is valuable. The manager records suggestions for curriculum improvement.

7. The Buddy System

7.1 Buddy Selection

Every new hire is assigned a buddy before day one. The buddy is:

• A peer (similar grade, not the new hire’s manager or the manager’s manager)
• From a different pillar than the new hire
• Not on the new hire’s immediate team
• Has been with CERG for at least six months (so they have completed their own onboarding and have an informed perspective)
• Volunteers or is selected by their manager; nobody is conscripted into buddy duty

7.2 Buddy Responsibilities

The buddy’s role is social, practical, and informational. It is not supervisory. The buddy does not evaluate the new hire’s performance or report to the manager (except to flag serious concerns, e.g., the new hire seems profoundly unhappy or has disclosed a compliance violation).

7.3 The Buddy Is Not

• A substitute for the manager. The manager owns the new hire’s success. The buddy supplements, not replaces.
• A performance evaluator. The buddy does not contribute to the new hire’s performance review unless the new hire specifically requests their perspective.
• An IT help desk. The buddy can point the new hire to the right resource; they are not expected to troubleshoot the new hire’s development environment.
• A therapist. The buddy is a peer. If the new hire is experiencing harassment, discrimination, or serious mental health concerns, the buddy directs them to HR or the employee assistance program, not to another coffee chat.

8. The First Contribution Milestone

8.1 What Counts

Within 30 days, every new hire makes a concrete, visible contribution to CERG and presents it to their pillar. The contribution must be:

• Real, not simulated. It addresses an actual need, not a fabricated exercise.
• Complete, not in-progress. The contribution is delivered, not described as “I started working on.”
• Presented, not just submitted. The new hire presents the contribution to their pillar in a standing meeting or a dedicated session. They explain what they did, why, and what they learned.

Acceptable first contributions include, but are not limited to:

8.2 The First Contribution Presentation

The presentation is 5-10 minutes and follows a simple structure:

1. What I did. The contribution, in plain language.
2. How I did it. The tools, procedures, and people involved.
3. What I learned. One thing about CERG, the technology, or the team that the new hire now understands that they did not understand before.
4. What I would do differently. Self-reflection, not self-criticism. Demonstrates that the person is thinking about improvement, not just execution.

The pillar responds with recognition, not evaluation. The point is to make the new hire visible as a contributor, not to grade their first work product. The manager ensures that the presentation is scheduled in a standing meeting that the pillar leader attends.

The First Contribution Is Psychologically Loaded

A new hire who contributes nothing visible for 90 days believes, correctly, that they have not yet proven their value. A new hire who presents a completed contribution to their pillar at day 25 knows they belong. The difference in confidence, engagement, and retention is material. This is not a ceremonial milestone; it is the single most important moment in the first 90 days.

9. Cross-Pillar Rotation

9.1 Structure

Every new hire spends three dedicated days, one per month during the first 90 days, embedded in a different pillar from their own. The rotation implements the left-right knowledge model (FRM-001 §9.2) from day one, not year three.

9.2 Rotation Day Agenda

Each rotation day is structured:

1. Morning: Observe. The new hire shadows the host through their morning. They attend the host’s standing meetings (read-only), watch the host triage alerts or review evidence or design architecture, and ask questions.
2. Midday: Discuss. The host walks the new hire through one end-to-end workflow in their pillar. For example, how a vulnerability goes from scanner alert to closed finding, or how a regulatory change becomes a policy update. The new hire asks: where does your pillar get its inputs? Where do its outputs go? What frustrates you about how my pillar hands off to yours?
3. Afternoon: Participate. The new hire contributes to one low-stakes activity in the host’s pillar under supervision. The activity should be authentic: review a finding, test a control, walk through an architecture diagram. The output does not need to be perfect; the experience is the point.

9.3 Rotation Debrief

After each rotation day, the new hire writes a one-paragraph debrief and sends it to their manager and the host. The debrief answers:

• What did I learn about this pillar that I did not know before?
• What does my home pillar do that makes this pillar’s work harder?
• What does this pillar do that my home pillar should know about?

The manager reviews the debriefs at the 90-day retrospective. Patterns across debriefs (e.g., “every new hire discovers that Engineering and Risk use different severity language”) are signals that should reach pillar leadership.

10. Role-Specific Onboarding by Family

10.1 Engineering Family

Engineering new hires add the following to the standard 30/60/90-day plan:

10.2 Risk Family

10.3 Governance Family

11. Onboarding for Managers

A new CERG Manager or Pillar Leader adds the following to the standard onboarding program. Their first 90 days focus on understanding the team, the operations, and the stakeholder landscape before making changes.

New Managers: Observe Before You Change

A new Manager who reorganizes the team in their first month is signaling that they value their own preferences over understanding what exists. The team that survived without this Manager for months will survive another 90 days of observation. The Manager who takes the time to understand why things are the way they are before changing them earns trust. The Manager who changes things before understanding them burns trust they will spend years trying to rebuild.

12. Measuring Onboarding Effectiveness

12.1 Metrics

The onboarding program’s effectiveness is measured through:

12.2 Continuous Improvement

The 90-day retrospective (§5.3) includes a structured feedback collection on the onboarding program itself. The manager asks:

1. What part of the onboarding program was most useful?
2. What part was least useful or felt like a waste of time?
3. What was missing that you wish had been included?
4. If you were designing the onboarding program for the next person in your role, what would you change?

Aggregated feedback is reviewed annually by the Governance Pillar Leader as part of this document’s review cycle. A pattern of “the CERG 101 curriculum assumed knowledge I did not have” or “the cross-pillar rotation days were too short to be useful” should result in document updates.

13. Document Control

Revision History

Review Triggers

• Material change to the CERG document library (new or retired documents that affect CERG 101)
• Material change to CERG tooling (new platforms that affect role-specific technical onboarding)
• Organizational restructure affecting pillar composition or reporting lines
• Feedback from 90-day retrospectives indicating systemic onboarding gaps
• Direction from the CISO

Related Documents

Governance owns this document. The Governance Pillar Leader (Policy & Standards) is responsible for initiating reviews, managing the revision cycle, and obtaining CISO endorsement for all changes.

Source: governance/CERG-GOV-ONB-001_Onboarding_and_Integration_Program.md · Download .md · View on GitHub