What should the first 90 days achieve?
An initial vCISO engagement should give leadership a clearer understanding of risk, an agreed set of priorities and a workable way to track progress. The useful outcome is a plan people can act on, supported by evidence and named owners.
The phases below are illustrative. They are not a promise that every organization can complete this work in 90 days or become audit-ready. Access, scope, team capacity and existing controls determine the actual schedule.
Days 1–30: establish the starting point
Discuss business goals, customer requirements and upcoming decisions with the executive sponsor. Identify systems, sensitive information, critical vendors and the people who own them. Review available policies and records with your IT team or MSP.
Example outputs: an agreed scope, an initial responsibility map, a risk register and a list of evidence still needed. Record unknowns separately from confirmed gaps.
Your team contributes: a decision-maker, access to relevant records and people, and the context behind deadlines. Avoid treating incomplete discovery as a complete assessment.
Days 31–60: agree the work and owners
Review the most consequential gaps with leadership. Assign implementation owners, dependencies and realistic target dates. Separate urgent safeguards from longer projects and identify decisions that need funding or formal risk acceptance.
Example outputs: a prioritized roadmap, an action register, policy changes for review and a proposed reporting cadence. An agreed roadmap states who implements each change and how completion will be checked.
Your team contributes: implementation capacity, budget decisions and approval of responsibilities. The vCISO leadership role does not automatically include every technical change.
Days 61–90: review evidence and establish a cadence
Review completed actions against their acceptance criteria. For unfinished work, record the blocker, next decision and owner. Establish recurring leadership reviews that keep the roadmap connected to business changes.
Example outputs: an executive progress brief, updated risks, an evidence index and the next phase of work. A policy being approved is different from a control operating consistently; report those states separately.
Your team contributes: records of completed work, explanation of exceptions and approval of next priorities. Readiness for an external examination requires its own scope and evidence review.
How to assess progress
Choose measures that support decisions: unresolved priority risks, actions with owners and dates, verified control changes, recovery exercises completed, and open evidence requests. Document the baseline before describing an improvement. Activity counts alone do not demonstrate reduced risk.
Review our illustrative risk register and readiness evidence index to see how a decision can connect to its owner and supporting record. NIST also offers a CSF 2.0 small business quick-start guide for organizing cybersecurity risk management.
Agree your first phase
Bring your goals, current team and deadline to a vCISO conversation. Compare the cost drivers and pricing inputs before agreeing deliverables and timing.
