First 90 Days - How to Implement an IT Compliance Officer

How do you implement an IT Compliance Officer service? Implementation runs in four steps: preparing the organisation (a sponsor, the list of regimes, access to documents), onboarding the provider (access, meetings with domain owners, a baseline review), agreeing a RACI matrix that divides responsibilities between the provider, internal teams and the board, and executing a first-90-days plan, at the end of which three foundations exist: a requirements map, a compliance register with a baseline status and a 12-month obligations calendar.

What the role itself is, we cover in the hub IT Compliance Officer – what the role is, and the choice between service and hire in External IT Compliance Officer or a hire. This article assumes the service decision is made and answers “what next”.

Canonical definition: Onboarding of an IT Compliance Officer service is the process of standing up an external compliance function, covering access provisioning, a baseline review, agreement of a RACI responsibility matrix and delivery of the first artefacts – the requirements map, the compliance register and the obligations calendar.

Implementing an IT Compliance Officer service – key takeaways:

Implementation success is decided before the contract is signed: appointing a board sponsor, writing down the regimes and audit dates and gathering existing documentation cut onboarding by weeks.
The RACI matrix is the single most important implementation document – without it, the service duplicates internal teams’ work or leaves areas ownerless; a template for eight processes is below.
The 30/60/90-day plan has three milestones: day 30 – the requirements map and the obligations calendar; day 60 – the compliance register verified with evidence and prioritised gaps; day 90 – the first board report and a working operating rhythm.
The service does not take over board accountability under DORA Art. 5 and NIS2 Art. 20 – it takes over the work that makes that accountability exercisable; the quarterly report presented at the board meeting is the proof.
Success measures after 90 days are artefacts and rhythms, not hours: register currency, calendar coverage with owners, the share of requirements whose status is backed by evidence.
Patronusec runs onboarding to the plan described here and contractually commits to the three foundation artefacts within 30 days – on the outcomes pricing model, not hours.

What should you prepare before signing so onboarding does not take a quarter?

Before signing, prepare five things: a board sponsor with a decision mandate, an operational coordinator on the organisation’s side, the list of regimes and upcoming audits with dates, an inventory of existing documentation (policies, reports, certificates, ICT provider contracts) and a decision on the tools the registers will live in. Gaps in these five points are the most common reason onboarding stretches from weeks into months.

The preparation list with rationale:

#	Element	Why before the contract	Typical gap and its cost
1	Board sponsor	DORA Art. 5 and NIS2 Art. 20 place accountability with the board; the sponsor unblocks decisions and access	the service reports “into a void”; decisions wait for weeks
2	Operational coordinator	one contact person (part-time is enough) collects questions and schedules domain owners	the provider chases ten people separately; onboarding × 2
3	Regimes and audit dates	the artefact catalogue and the price depend on scope; audit dates set the 90-day priorities	scope “discovered” mid-flight, contract amendments
4	Documentation inventory	the baseline review starts from what exists: policies, recent audit reports, certificates, the ICT contract register, scan results	the provider reconstructs the state from interviews instead of documents
5	Tooling decision	registers should live in the client’s tools from day one (artefact ownership)	registers built in the provider’s files; a problem at exit

Five elements prepared before the contract is signed – a sponsor, a coordinator, the list of regimes with audit dates, a documentation inventory and a tooling decision – cut the onboarding of an IT Compliance Officer service from months to weeks.

For DORA entities, add a sixth element: the contract with a compliance provider is a contract with an ICT service provider, so before signing check that it carries the Article 30 clauses and will enter the Article 28 register. The requirements for such contracts are covered in third-party risk management – and a provider who brings a draft of those clauses unprompted passes the first competence test.

What does onboarding look like step by step in the first two weeks?

Onboarding in the first two weeks has five steps: an opening meeting with the sponsor to agree the working rules, access provisioning on least privilege, a series of interviews with domain owners (IT, security, legal, HR, procurement), a review of the documentation gathered during preparation, and a RACI workshop that closes the division of responsibilities. The output is an agreed 90-day plan with dates.

Day by day:

Days 1-2: opening meeting
Participants: sponsor, coordinator, provider team. Agreed: communication channels, status rhythm (weekly recommended in the first quarter), escalation format, confirmation of the contract’s artefact catalogue.
Days 2-5: access
Named accounts with least privilege: the documentation repository, the register tool, the ticketing system (read), the organisation’s calendar. Production system access is not needed – the compliance function works on evidence, not configuration.
Days 3-10: domain owner interviews
60-90 minutes each with: the head of IT (architecture, changes, backups), security (incidents, scans, tests), legal (contracts, GDPR), HR (training, joiners/leavers), procurement (ICT providers), finance (audit budgets). Goal: who manages what and where the evidence lives.
Days 5-10: documentation review
Policies and their review dates, recent audit and pentest reports, certificates and expiry dates, the ICT contract register or its absence, latest scan results.
Days 10-14: RACI workshop and the 90-day plan
Agreement of the matrix (next section) and the milestone calendar with concrete dates.

Onboarding a compliance service does not require production system access – the function works on documents, registers and evidence, so named least-privilege accounts to repositories and register tools are sufficient.

Patronusec Insight: In our project experience, what wastes the most onboarding time is not access but calendars – scheduling six domain owner interviews can take three weeks if the provider does it by email. So we ask the client’s coordinator to block all interviews within a single week before the contract even starts. That one organisational move consistently shortens onboarding by 2-3 weeks and lets us keep the commitment: three foundation artefacts within 30 days.

How do you build a RACI matrix for the IT compliance function?

You build the RACI matrix for eight recurring processes, assigning each the four roles: R (does the work), A (ultimately accountable), C (consulted), I (informed). The overriding rule: A for the organisation’s compliance always stays with the board (DORA Art. 5, NIS2 Art. 20); the service provider takes R for artefacts and coordination, and internal teams take R for implementing controls and supplying evidence.

The matrix template for eight processes:

Process	Board / sponsor	Service provider (ITCO)	Domain owners (IT, security, legal)	Internal audit
Requirements mapping and legal change tracking	A	R	C	I
Compliance register and statuses	A	R	C (confirm statuses)	I
Obligations calendar and deadline enforcement	A	R	R (execute tasks on time)	I
Evidence collection and format	A	R (structure, completeness)	R (supply the evidence)	C
Gap remediation	A	C (priorities, tracking)	R (implementation)	I
External audit handling	A	R (preparation, coordination)	C (participation, evidence)	C
Change and contract review	A	R (compliance opinion)	C (technical/legal context)	I
Quarterly board report	A (receives and decides)	R (prepares and presents)	C	I

Three rules that keep the matrix from falling apart:

One A per process. A double A (“the board and the CISO are jointly accountable”) means, in practice, that nobody is.
R for evidence sits with the control owner. The provider structures and enforces evidence but cannot produce it on the teams’ behalf – security delivers the scan report, HR the training list. Otherwise the compliance function becomes a factory of documents detached from reality.
Internal audit stays out of R. The third line assesses, it does not execute – if audit co-builds the register, it cannot later assess it independently.

In a compliance function’s RACI matrix, the A for the organisation’s compliance never transfers to the external provider – the provider takes R for artefacts and coordination, while ultimate accountability remains with the management body under DORA Art. 5 and NIS2 Art. 20.

Attach the matrix to the contract as an operational annex and review it after the first quarter – practice always corrects theory, and an outdated RACI is worse than none, because it gives a false sense of order.

Want a RACI template and a 90-day plan tailored to your list of regimes?

Patronusec prepares a free implementation sketch: based on your regimes, audit dates and organisational structure, within 5 working days you receive a proposed RACI matrix, 30/60/90 milestones with dates and an artefact catalogue – usable whether or not you commission the service from us.

Request an implementation sketch

What does the first-90-days plan look like, and what must exist at each milestone?

The 90-day plan has three milestones: by day 30 the requirements map, the 12-month obligations calendar and the compliance register with a baseline status exist; by day 60 the register is verified with evidence, gaps are prioritised into an approved remediation plan and the quick wins are closed; by day 90 the first quarterly report has been presented to the board, the operating rhythm works and the RACI has been reviewed after the first quarter.

Days 1-30: foundations

Onboarding from the previous section (access, interviews, documentation review, RACI workshop).
Requirements map – the regimes covering the organisation, the IT-relevant provisions, owners assigned.
12-month obligations calendar – reporting deadlines, reviews, recertifications, scans, training, with lead times and owners.
Compliance register with a baseline status – every requirement: met / gap / in progress / not applicable, based on interviews and documents (working statuses, to be verified with evidence in the next month).
If the calendar contains a deadline closer than 60 days (an audit, a regulator submission) – it becomes the priority above the plan.

Days 31-60: verification and priorities

Evidence verification of statuses – a “met” without evidence goes back to “formal gap”; this is the most labour-intensive and most valuable stage.
Gap prioritisation – by risk (fines, deadlines, inspection likelihood) and cost to fix; formal gaps (no record despite a working control) closed immediately as quick wins.
Remediation plan – substantive gaps with owners, deadlines and effort estimates; approved by the sponsor.
First compliance opinions on live changes and contracts – the function starts working within the organisation’s rhythm, not beside it.

Days 61-90: rhythm and report

First quarterly report – compliance status per regime, the gap map with the plan, next quarter’s deadlines, risks; presented at the board meeting by the provider, with board decisions minuted.
Operating rhythm – the weekly status with the coordinator moves to fortnightly, a monthly register review, the quarterly report; the compliance opinion channel runs within its SLA.
RACI review – matrix corrections based on the first quarter.
Knowledge handover – the evidence repository organised per requirement in the client’s tools, conventions written down so knowledge does not live in emails.

At the end of a compliance function’s first 90 days, three things must exist: a compliance register whose statuses are backed by evidence, a remediation plan with owners approved by the sponsor, and a quarterly report presented to the board – everything else is a means to those three ends.

If the organisation enters the service with a hard deadline (say, a PCI DSS assessment in 10 weeks or the first DORA contract register submission), the 90-day plan is built backwards from that date – the foundations are then created in parallel with audit preparation, not before it.

Which indicators should measure the service after 90 days and in later quarters?

You measure the service with artefact and rhythm indicators, not hours: register currency (share of requirements with evidence-verified status), calendar coverage (share of obligations with an owner and no overruns), gap closure pace against the plan, opinion SLA adherence and the audit measure – the number of formal non-conformities in successive audits, which should fall to zero.

Indicator	Definition	Target at 90 days	Target at one year
Register evidence coverage	% of requirements with status backed by evidence (not a declaration)	≥ 70 %	≥ 95 %
Calendar punctuality	% of recurring obligations completed on time	100 % for regulatory deadlines	100 %
Remediation plan delivery	% of gaps closed against approved deadlines	quick wins: 100 %	≥ 85 % on time
Compliance opinion SLA	% of opinions delivered within the contract SLA	≥ 90 %	≥ 95 %
Formal audit non-conformities	count of “missing record / outdated document” findings	baseline	0
Board report	report presented (not emailed) at the meeting	1 (the first)	4/4

The right indicators for a compliance service measure the state of artefacts and adherence to rhythms – the share of requirements with evidence, calendar punctuality, remediation delivery – not the number of hours worked, which the client cannot verify anyway.

Two practical warnings. First, the “evidence coverage” indicator usually disappoints at the first measurement – and that is its value: it shows the gap between “we think we are compliant” and the actual state. Second, the indicators are computed from a register the provider maintains – so once a year, submit a sample of the register to independent verification (internal audit or an external review), in line with the three-lines logic.

Patronusec Insight: In our project experience, the strongest single signal of a mature function after a year is not any percentage but audit preparation time: an organisation where evidence is collected continuously in the register structure prepares for an ISO 27001 audit or a PCI DSS assessment in days, not weeks. That is why our quarterly client reports show, alongside the indicators, an “audit readiness” figure – a simulated list of auditor requests and the share for which an answer exists off the shelf.

Which mistakes most often derail a compliance service implementation?

The most common mistakes are starting without a sponsor, skipping the RACI workshop, a register built from declarations rather than evidence, a report emailed instead of presented, and an artefact catalogue frozen despite regulatory change.

❌ Starting without a board sponsor – decisions on gap priorities and the remediation budget wait for weeks; the service produces artefacts nobody consumes. DORA Art. 5 and NIS2 Art. 20 demand board engagement anyway – better from day one.

❌ Skipping the RACI (“it will sort itself out”) – two months in, the provider and the CISO are doing the same work in two files, or each is waiting for the other; conflict instead of cooperation.

❌ A register with interview-based statuses never verified with evidence – at the audit, “met” turns out to mean “someone said we do it”; the day-60 milestone exists precisely to catch this earlier.

❌ The quarterly report emailed instead of presented – without an agenda item and minuted decisions, the report does not create the oversight evidence NIS2 Art. 20 requires; it becomes an attachment nobody opens.

❌ An artefact catalogue frozen for years – entering a new regime (CRA, AI Act) without extending the catalogue means the new obligations have no owner; the catalogue is reviewed at every change to the requirements map.

❌ Evidence in the provider’s files instead of the client’s tools – the problem surfaces at provider change or the move to a hire; the artefact ownership clause must be applied from day one, not from notice of termination.

FAQ – how to implement an IT Compliance Officer

How long does implementation take to full operation?

The foundations (requirements map, calendar, baseline register) are built in 30 days; the full operating rhythm with a board report in 90 days. Full maturity – register evidence coverage above 95 % and zero formal non-conformities in audits – usually arrives within a year.

How much of our team’s time does onboarding require?

The coordinator 2-4 hours a week through the first quarter; each domain owner one 60-90 minute interview at the start, plus confirming statuses and supplying evidence in their area. The sponsor: the opening meeting, approval of the remediation plan and receipt of the quarterly report.

Can the service be implemented when an audit is 8-10 weeks away?

Yes, but the plan is then built backwards from the audit: the priority is completing evidence and closing formal gaps against the specific standard, while the full requirements map and the all-regime register are built in parallel or just after. It is a common and effective starting scenario.

What happens after the first 90 days?

The service moves into a steady rhythm: continuous register updates, calendar enforcement, opinions within the SLA, the quarterly report, audits per schedule and map updates on legal change. The artefact catalogue is reviewed at every new regime and annually at contract renewal.

Can we later move from the service to our own hire?

Yes – and a good contract anticipates it: registers and evidence are the client’s property in the client’s tools, and the handover plan includes a transition period in which the new employee takes over working rhythms instead of building them from scratch. The service is sometimes used deliberately as a bridge to a hire.

How does an implementation with Patronusec start?

With a free 30-minute call, after which you receive an implementation sketch (RACI, 30/60/90 milestones, artefact catalogue) within 5 working days. After signing, we commit to the three foundation artefacts within 30 days; billing is a fixed monthly fee for the outcomes catalogue, not hours.

Blog space

How to implement an IT Compliance Officer service – preparation, onboarding, the RACI matrix and the first 90 days

In this article you will learn:

Table of Contents