What do the first 90 days of working with a vCISO look like? The first 90 days fall into three natural phases: getting to know the organisation and assessing its security posture (days 1-30), building a plan and priorities approved by the board (days 31-60), and establishing the function’s standing working rhythm – reviews, reporting and oversight (days 61-90). After one quarter, the security function runs in a repeatable cycle.
Canonical definition: The first 90 days of working with a vCISO are the organisation’s transition from having no security function to its standing rhythm: through a posture assessment, risk prioritisation and an action plan, to recurring reviews, oversight and board reporting.
This article describes step by step what happens in each of the three phases, which deliverables are produced along the way, and how to tell that the start of the service is going well.
The first 90 days with a vCISO – in brief:
- Days 1-30 are discovery and assessment: an inventory, conversations with people, a documentation review and a rapid risk assessment – ending in a picture of the actual state.
- Days 31-60 are the plan: risk prioritisation, a roadmap of actions with owners and deadlines, and the first quick wins.
- Days 61-90 are the rhythm: recurring reviews, board reporting, oversight of policies, suppliers and audit preparation.
- The first quarter’s deliverables are concrete: a posture assessment, a risk register, a roadmap and a working security-function calendar.
- You can tell a good start by this: after 90 days the board knows which risks it has accepted and which are being addressed – and when.
- Patronusec runs the start of its vCISO service to this model, matching pace and priorities to the client’s regulations and deadlines.
Table of Contents
What happens in days 1-30 – discovery and posture assessment?
The first month serves one purpose: building a reliable picture of the actual state – what the organisation has, what it relies on and where the biggest risks sit. Without this phase any plan would be guesswork, which is why a good vCISO starts with listening and inventory, not with recommendations.
Typical first-phase activities:
- Conversations with key people – the board, IT, business process owners, and whoever has carried security “on the side” until now. The goal: to understand how the organisation really works and what it expects.
- Inventory – systems, data, suppliers, access, locations; what is critical to the business and where sensitive data is processed.
- Documentation review – existing policies, procedures, supplier contracts, and the results of earlier audits and tests, if any.
- Requirements mapping – the regulations and standards the organisation is or will be subject to (e.g. DORA, NIS2, PCI DSS, ISO 27001), plus client requirements from questionnaires and contracts.
- Rapid risk assessment – a summary of the most significant risks and their business impact; the first version of the risk register.
The phase’s deliverable is a security posture assessment: a document showing where the organisation stands today against its requirements and risks. It is the reference point for everything that follows – and the first material the board sees in full.
A good vCISO’s first month looks unremarkable – many questions, few recommendations – because a plan built before understanding the organisation is a plan for a different organisation.
What happens in days 31-60 – plan and priorities?
The second month turns the picture into an action plan: risks are prioritised, a roadmap with owners and deadlines takes shape, and the simplest fixes are made straight away. This is the phase in which the board makes its first conscious risk decisions.
The key elements of the second phase:
- Risk prioritisation – not everything at once: the register’s risks are ranked by business impact and regulatory requirements, with a clear split into “addressing now”, “planned” and “consciously accepted”.
- A roadmap of actions – a concrete plan for the coming quarters: what, who and by when. Every action has an owner on the organisation’s or the vCISO’s side, and a deadline – without that, a roadmap is a wish list.
- Quick wins – high-impact, low-cost fixes made immediately: tidying privileged access, enabling multi-factor authentication where it is missing, updating critical policies.
- Board decisions – the most important moment of the phase: the board approves the priorities and the roadmap, and consciously accepts the risks the organisation is not yet addressing. A risk accepted consciously and recorded is a different situation entirely from a risk persisting through inertia.
- The documentation foundation – completing or updating the baseline policies so they reflect the organisation’s reality rather than a template.
The phase’s deliverables are an approved security roadmap and an ordered risk register with decisions. If the organisation is chasing a deadline – an audit, a client questionnaire, a regulation coming into force – the roadmap is built directly around it.
What happens in days 61-90 – establishing the standing rhythm?
The third month turns the plan into a working function: a standing rhythm of reviews, reporting and oversight is established, through which security stops being a project and becomes a process. This is the phase after which the organisation feels that “someone is running this”.
The elements of the standing rhythm established in the third phase:
- The security-function calendar – recurring risk reviews, access reviews, supplier reviews, policy updates; each activity has a frequency and an owner.
- Board reporting – a regular, concise report: roadmap status, changes in risks, incidents and decisions required. The board knows what is happening without descending into technical detail.
- Supplier oversight – a review of third-party contracts and risks, particularly where regulations require it (e.g. the register of information under DORA, supply chain security under NIS2).
- An awareness programme – the first activities building employee awareness, matched to the organisation’s real risks.
- Incident readiness – basic response procedures: who does what, and in what order, when an incident happens, together with regulatory reporting requirements where they apply.
- Audit preparation – if a certification or audit lies ahead, the third phase includes an evidence plan and a preparation schedule.
Patronusec Insight: The most common first-quarter mistake – on the organisation’s side and among inexperienced providers alike – is inverting the order: recommendations before understanding, tools before process, documents before board decisions. In our vCISO projects we hold the sequence assessment – decisions – rhythm, because a security function the board does not understand and has not approved ends up as a binder of policies with no bearing on reality. The measure of a successful start is not the number of documents but whether the board can say which risks it has accepted.
How can you tell the start of the service is going well?
A sound start shows itself in concrete deliverables and in a change within the organisation: after 90 days there is a picture of the state, an approved plan and a working rhythm – and the board knows which risks it has accepted and what is being addressed. The absence of these elements is a warning sign regardless of the number of meetings held.
Checkpoints after each phase:
- After day 30: a security posture assessment and a first version of the risk register exist; the key people have been heard; regulatory and client requirements are mapped.
- After day 60: the board has approved the priorities and the roadmap; risks have an explicit status (addressed / planned / accepted); the first quick wins are in place.
- After day 90: the review and reporting calendar is running; suppliers are under oversight; basic incident procedures exist; preparations for any upcoming audits have a schedule.
It is worth naming the soft but most important indicator too: after the first quarter, the question “who owns security here” has an unambiguous answer, and risk decisions have stopped making themselves. That is the true goal of the first 90 days – everything else follows from it.
Patronusec runs the start of its vCISO service to the model described here, matching pace and priorities to the organisation’s regulations, deadlines and scale.
FAQ – What working with a vCISO looks like
What does a vCISO’s first-90-days plan look like?
The plan falls into three phases: discovery and posture assessment (days 1-30) – inventory, conversations, documentation review and a rapid risk assessment; plan and priorities (days 31-60) – risk prioritisation, a roadmap with owners and deadlines, board decisions; and the standing rhythm (days 61-90) – a review calendar, reporting, supplier oversight and incident readiness.
What deliverables are produced in the first quarter?
Four concrete ones: a security posture assessment (the picture against requirements and risks), a risk register with an explicit status for every risk, a board-approved roadmap of actions with owners and deadlines, and a working security-function calendar – recurring reviews and reporting.
How much of the organisation’s time does the start require?
Most in the first phase: conversations with key people and access to documentation require the team’s involvement, usually measured in single hours per person. In the later phases the load drops to taking part in decisions (the board) and delivering assigned actions (the owners). A well-run start respects the organisation’s time – it asks once, and thoroughly.
Can a vCISO start with preparation for a specific audit?
Yes – if the organisation is chasing a certification deadline, a client questionnaire or a regulation coming into force, the first-90-days plan is built directly around it: the posture assessment becomes a gap analysis against the requirement, and the roadmap becomes a remediation plan with an evidence schedule. The standing rhythm starts in parallel, so that after the audit compliance is maintained, not rebuilt.
What happens after the first 90 days?
The function moves into a standing cycle: risk and access reviews, board reporting, supplier oversight, policy updates, the awareness programme and preparation for subsequent audits – following the calendar built in the third phase. The roadmap is delivered and refreshed quarterly, and the scale of the service adjusts to the current need.
How do you start working with a vCISO from Patronusec?
With a free consultation: we discuss the regulations you are subject to, your security posture and the deadlines you are chasing – and propose the scope and scale of the service, together with a first-90-days plan matched to your situation.
Recommended reading
A reading path for the vCISO topic:
- What is a vCISO and how does it differ from an in-house CISO – the service model, the comparison with a salaried post, and a case study.
- When does a company need a vCISO – 7 signals – a test of whether your organisation is at the point where the CISO function becomes necessary.
- Business continuity plan in 5 steps – one of the areas the security function puts in order in its first quarters.
The security function up and running in 90 days
Patronusec runs the start of its vCISO service to a proven three-phase model – from posture assessment, through board decisions, to the function’s standing rhythm – matching the pace to the organisation’s regulations and deadlines. Book a free consultation.
