30-60-90 day plan for systems administrators

A 30-60-90 day plan for a new systems administrator should inventory servers, identity and administrator accounts and prove that backups actually restore in the first 30 days; take over the monthly patch cycle, account changes and a share of on-call with review in days 31-60; and by day 90 own a lifecycle and certificate calendar with one measured risk removed. As of November 2026, two dates belong on that calendar: Microsoft ends support for Windows Server 2016 on January 12, 2027, and the CA/Browser Forum's rules cut the maximum life of a public TLS certificate to 200 days for certificates issued since March 15, 2026, and to 100 days from March 15, 2027.

This page is for the IT manager or infrastructure lead hiring a systems administrator, systems engineer or server administrator into an internal IT team. Users, devices and the service desk are in the 30-60-90 day plan for IT support specialists; routing, firewalls and circuits in the 30-60-90 day plan for network engineers; SLOs and error budgets in the 30-60-90 day plan for site reliability engineers. The manager's own first months, including the risk register and vendor renewals, are in the 30-60-90 day plan for IT managers.

What does a systems administrator own that IT support does not?

What does the 30-60-90 day plan look like?

30-60-90 day plan — [Name], Systems Administrator, [company]
Reports to: [IT manager / infrastructure lead]    Start date: [date]
Servers / VMs / cloud instances: [N]    Sites or data centers: [N]
Platforms: [Windows Server, Linux, virtualization, cloud]
Tools: [directory, backup, patching, monitoring, ticketing, change]
On-call: [rotation]

DAYS 1-30 — Inventory, accounts and a real restore
Goals:
- Read access to every admin tool; a separate admin account for
  the new hire, never their everyday account
- Inventory check: each server, its role, owner, operating system,
  support end date and backup job
- List every administrator and service account: owner, purpose,
  last used, MFA status
- Restore [one critical system] in a test environment; time it
- Watch one monthly patch cycle end to end
- Certificate inventory: every public and internal certificate
  and its expiry date
Deliverables by day 30:
- Risk list ranked by impact, agreed with the IT manager
- Restore test result: what worked, what failed, how long it took

DAYS 31-60 — Take over the routine with review
Goals:
- Run the next patch cycle: test group, schedule, exceptions,
  report of what did not patch and why
- Handle account and access changes through the request process
- Secondary on-call for one rotation
- Remove or disable [example: unused] admin and service accounts
  with their owners' agreement
- Draft the lifecycle calendar: support end dates, certificate
  expiries, license and hardware renewals
Deliverables by day 60:
- Patch report with exceptions and owners
- Account clean-up list, done or scheduled

DAYS 61-90 — Own the calendar; remove one risk
Goals:
- Own the patch cycle and the lifecycle calendar
- Fix one risk from the day-30 list (example: automate renewal for
  the certificates that expire most often, or replace a server
  whose support ends next)
- Primary on-call
- Write or update runbooks for restores and the [3] most common
  infrastructure alerts
Deliverables by day 90:
- Lifecycle calendar the IT manager uses for budgeting
- One risk removed, measured against the day-30 list

Check-ins: weekly with [IT manager]; reviews at day 30, 60 and 90.

Numbers in brackets are examples; size them to the estate.

Which dates belong on a new systems administrator's calendar?

The items below are stated as of November 2026 from the publishers' own pages. Which apply depends on the platforms in use; federal directives bind only federal civilian agencies.

The certificate change is the one most teams underestimate. A certificate renewed by hand once a year becomes two renewals a year in 2026 and close to four from 2027. The day-90 fix in many plans will be automated renewal for public certificates, starting with the ones that have expired unnoticed before.

What should the day-30 restore test show?

A backup report that says "success" proves that a job ran, not that the business can get its systems back. The restore test is the most important item in month one, and it should answer:

• Can it be restored at all? A whole server or application, not just a file, into an isolated environment.
• How long did it take? Compare the time with what the business owner of the system expects. If nobody has said what they expect, that is a finding.
• How much data would be lost? The age of the newest good copy at the moment of the test.
• Is the backup protected? Whether an attacker with domain admin rights could delete or encrypt the backups, and whether at least one copy is offline or immutable.
• Is it written down? A restore runbook someone else could follow at 3 a.m.

Which numbers should a new systems administrator baseline?

The measures are examples. Take them from the inventory, patching, backup and monitoring tools in month one, and set targets once the new administrator owns the routine.

What does "on track" look like at day 30, 60 and 90?

A filled example

How should the hiring manager use this plan in the final interview?

Give every finalist the same brief: the estate, the main platforms, the backup and patch tools and one known problem. Score the plans with the rubric in how to evaluate a 30-60-90 day plan in an interview. A strong sysadmin plan proves restores and maps accounts before changing anything, and treats lifecycle dates as work to schedule, not news. Questions that test it:

• "Last night's patch broke a line-of-business application on two servers. What do you do this morning?"
• "You find a service account with domain admin rights that nobody claims. How do you deal with it safely?"
• "Our backups report success every night. How would you find out whether we could actually recover?"
• "Certificate lifetimes are getting shorter. What would you change in how we manage them?"

The systems administrator screening questions cover restore, offboarding and patching experience earlier in the process.

What should the IT manager ask at the check-ins?

• Day 30: What would we lose, and for how long, if our most important server failed today? Which account worries you most?
• Day 60: What did not patch, and why? Which accounts did you remove, and who agreed?
• Day 90: What is on the calendar for the next 12 months, and what will it cost? Which risk is gone, and how do we know?

What the IT manager owes a new systems administrator

• A separate administrator account on day one, with access granted in stages tied to reviewed work.
• A test environment where restores and patches can be tried without touching production.
• The change process, the maintenance windows and who can approve emergency changes.
• Business owners for each critical system, so recovery expectations and patch windows can be agreed.

Common mistakes

• Daily work on an admin account. A phishing email opened on that account reaches everything.
• Trusting the backup report. Only a restore proves recovery.
• Patching everything at once. A test group and a schedule turn a bad patch into a small incident instead of a big one.
• Deleting accounts nobody claims. Disable, wait, then delete; some service accounts run once a quarter.
• Treating support end dates as news. Replacements take budget and time, so they belong on a calendar a year ahead.

Adapting the plan

• Healthcare: the HIPAA Security Rule's contingency plan standard, 45 CFR 164.308(a)(7), requires a data backup plan, a disaster recovery plan and an emergency mode operation plan, and lists periodic testing and revision as addressable, as of November 2026; make the restore test evidence for that plan. This is not legal advice.
• Cloud-heavy estates: the inventory becomes cloud accounts, instances and managed services, and drift between infrastructure code and what is deployed; borrow the staged access path from the 30-60-90 day plan for DevOps engineers.
• Sole administrator at a small company: there is no second person to review changes; agree with the IT manager or an outside provider who reviews the first production changes and who covers holidays.
• Federal agencies and contractors: put the BOD 26-04 remediation and reporting duties on the calendar from week one, and check which ones the contract passes down.