Bryan Construction For Brian

General Contractor: A 90-Day CTO Plan

Brian, here’s your new IT Director’s first 90 days. What to fix first, where AI pays off soonest, and what the hire should own.

If the IT Director seat can stay open another quarter, ignore this. If it can’t, the next two minutes are worth it.

What we noticed

A 100% employee-owned general contractor on the ENR Top 400, with 47 years of federal work and secure-facility experience that includes SCIFs.

Your IT Director posting went up on November 2, and it asks one person to hold IT operations, CMMC and NIST 800-171 compliance, vendors and the multi-year plan, with a single IT Specialist reporting in.

Your own work Federal and secure-facility construction, from barracks to SCIFs. The same customers that hand you CUI are why the posting leads with CMMC. Federal construction page
Your own data BIM and virtual design for clash detection and virtual mock-ups, with tablets in the field. That is the project data an IT Director has to keep available and secure. Building Information Modeling page
Your team The IT Director supervises one IT Specialist plus managed service providers, so the first job is knowing what each carries. IT Director posting
Your tech The posting names GCC High and secure enclaves, with Microsoft security and ERP work on the preferred list. The public site runs on WordPress. IT Director posting

Seen in your stack: WordPress · Elementor · Gravity Forms · GCC High · Microsoft 365 · Azure · ERP

What your posting asks for

“Lead the organization’s IT operations and cybersecurity posture, ensuring systems, policies, and practices meet CMMC, NIST 800-171, and DFARS requirements for handling CUI.”
“Manage continuous compliance and audit readiness by implementing required security controls, maintaining documentation, and coordinating incident response, training, and cross-department collaboration.”
“Establish a multi-year vision and strategic plan, optimizing resource allocations, and ensuring the organization accomplishes annual goals and strategic initiatives.”
“Evaluate recurring support trends and issues identified by the IT Specialist and convert them into process improvements, technology upgrades, or strategic initiatives.”
“Manage relationships with IT vendors, negotiating contracts and ensuring that vendors provide the necessary support and services.”

From your IT Director posting, posted November 2, 2026.

What changes for your new IT Director

Your new IT Director starts with a plan: the compliance gaps to close first in order, where the support load comes from, where AI saves time without touching controlled data, and a clear line between what they own and what a fractional lead can carry while they settle in.

Your new IT Director’s first 90 days

Three phases, each item with the reason it’s there and where that came from.

Days 1 to 30

Learn the sites, the CUI boundary and the vendors

1
Map where CUI lives and who touches it
Your posting’s first ask is systems that meet CMMC, NIST 800-171 and DFARS for CUI. A map of where the data sits comes before every control.
Source: IT Director posting
2
Read the System Security Plan and incident response plan as they stand
The posting expects SSPs, incident response plans and access policies to be developed and maintained. Day one is finding what exists and how current it is.
Source: IT Director posting
3
Sit with the IT Specialist and read the support trends
The posting wants recurring support issues turned into improvements, so the first list is where tickets keep coming from.
Source: IT Director posting
4
List every IT vendor, managed provider and contract
Vendors and managed providers do daily work for you. Who does what, and on what terms, decides what the new Director can change.
Source: IT Director posting

Days 31 to 60

Close the compliance gaps in order

5
Rank the gaps against CMMC Level 2 and set the audit calendar
Audit readiness is a standing duty in the posting. A ranked gap list puts the work in an order your Director can defend.
Source: IT Director posting
6
Decide what runs inside the secure enclave
The posting asks for familiarity with GCC High and enclaves. Deciding which systems and people sit inside shapes cost and effort for the next year.
Source: IT Director posting
7
Set one standard for workstations and devices at every location
The Director sets the standards that the Specialist and vendors then follow, across every location.
Source: IT Director posting
8
Write the continuity protocol
Business continuity protocols for emergencies and data loss are a named duty, and a federal customer will ask for them.
Source: IT Director posting

Days 61 to 90

Write the multi-year plan

9
Write the multi-year IT vision with the executive team
A multi-year vision and strategic plan is the posting’s second ask, tied to annual goals.
Source: IT Director posting
10
Decide whether an ERP move belongs in the plan
ERP migrations are on the preferred list. One decision on timing, made with the executives, keeps it from interrupting the compliance work.
Source: IT Director posting
11
Set the IT budget and technology lifecycle
Budgets and lifecycle planning are a minimum qualification, and the compliance work needs funding before it starts.
Source: IT Director posting

Where AI pays off soonest

Workflows from your own business, in the order they save your team time.

1 Weekly support trends summarized for the Director
One IT Specialist sees every ticket. AI can group them into the recurring issues the posting wants turned into process improvements, so the Director reads a one-page summary.
Source: IT Director posting
2 Compliance documents kept current from system records
Audit readiness means maintaining documentation. AI can draft updates to plans and control evidence from logs and change records, run inside the compliant tenant, for the Director to review.
Source: IT Director posting
3 Policy and security questions answered from your own policies
Training and incident response are part of the job. An assistant limited to your written policies answers routine staff questions before they reach IT.
Source: IT Director posting
4 Past-performance write-ups drafted from your federal projects
You publish federal project pages with strong ratings. A first draft of past-performance text from them saves proposal time.
Source: Federal construction page

What the hire owns, and what a fractional lead covers

Your IT Director owns

IT strategy and the multi-year plan
CMMC, NIST 800-171 and DFARS compliance and audit readiness
Supervising the IT Specialist and the managed providers
Vendor contracts and the IT budget
Business continuity and incident response

A fractional lead covers

Where AI pays off, and how to use it without exposing controlled data
An outside read of the gap list before the audit
Construction and project-data integration choices
This 90-day plan, run alongside the hire until it’s theirs

Your first 90 days of tech leadership, planned

The plan above is yours either way.

Email Kash

We build a handful of these a month, for founders hiring now.

90 days

from the first day to a written roadmap

What to fix first, with the reason
Where AI pays off soonest
What the hire owns and what a fractional lead covers
A roadmap your team can run

Who’s building it

Kash Badami was Chief Architect of a national health information network and closed the CMS deal behind Healthcare.gov’s data infrastructure. He runs his own company on AI today.

Chief Architectof a national health information network for HHS, aligning 23 federal agencies

$27MCMS deal that became core Healthcare.gov data infrastructure

“he was singularly responsible for the company’s single largest customer by revenue - the Center for Medicare & Medicaid within the US Department of Health and Human Services.”

RLRobert Liebowitz, worked with Kash on MarkLogic’s Public Sector team; now First Ascent VenturesLinkedIn recommendation, April 2026
“Kash and I built ERT Credit together in 2021. He took my MVP and turned it into a SaaS that hit $10M ARR in twelve months.”

Jordan Anderson, CEO, PayStreetgobridgehead.ai/about

Bryan Construction sales playbook, in brief

Bryan Construction is a 100% employee-owned commercial and federal general contractor on the ENR Top 400, with 47 years of federal work.Company page, Federal construction page

Its IT Director posting asks one leader to own IT operations, CMMC and NIST 800-171 compliance, vendors and a multi-year plan.IT Director posting

The first 90 days: map where CUI lives, read the security plans, rank the gaps and set the audit calendar, then write the multi-year plan.IT Director posting

AI pays off soonest in support-trend summaries, compliance document upkeep, policy Q and A, and past-performance drafts.IT Director posting, Federal construction page

Prepared by Kash Badami at Bridgehead · November 9, 2026 · Every source

Questions

Why a fractional lead instead of waiting for the full-time IT Director?

You don’t have to choose. The hire owns the product and the team; a fractional lead covers the AI and software side and runs this plan until it’s theirs, so nothing waits on the search.

What does it cost?

The first engagement is a fixed price, quoted on a call once we’ve seen what you need. After that there’s an optional monthly retainer, and you can stop at any point.

Will it get in the way of the IT Director we hire?

No. The line between what they own and what a fractional lead covers is on this page, and the plan is handed to them to run.

Where does our data live, and is it secure?

In your own accounts. Nothing runs on our side, and every tool or vendor we suggest is reviewed with you before anyone connects it.

Is this only about AI?

No. AI is one part. Most of the first 90 days is the work your posting describes, and the AI items are the ones that save your team time soonest.