What a vCISO does in the first 90 days

Somewhere between "the IT manager handles security in their spare time" and "we have a full-time Chief Information Security Officer" sits a gap that catches most mid-sized companies off guard. Customers start sending security questionnaires. Insurers ask for a documented program. The board wants to know if the business is exposed. These are executive questions, and there's no executive to answer them.

A virtual CISO — vCISO — fills that seat on a fractional basis. You get the strategy, governance, and leadership of a seasoned security executive for a slice of the cost and commitment of a full-time hire. But "fractional" doesn't mean vague. A good engagement is structured, and the first ninety days should produce concrete, board-ready output. Here's what that looks like, phase by phase.

Days 1–30: Assess — find out what's actually true

You can't lead a security program you don't understand, so the first month is discovery, not action. The vCISO builds an honest picture of where the business stands, working from evidence rather than assumption. By day 30 you should have:

• A risk register. The real risks to this business — its data, its systems, its industry — ranked by likelihood and impact, in language leadership can weigh.
• An asset and data inventory. What you have, where it lives, and which data is sensitive or regulated. You cannot protect what you haven't listed.
• A current-controls review. What's already in place — MFA, EDR, backups, email defense, training — and, more tellingly, where the gaps are.
• Quick wins. The handful of high-impact, low-effort fixes that reduce real risk in the first month and prove the engagement is worth it.

The quick wins matter more than they sound. They build trust, show momentum, and buy the credibility needed for the harder work ahead.

Days 31–60: Plan — turn findings into a roadmap

Month two converts the assessment into a program. This is where a vCISO earns their title, because prioritization is the whole job — deciding what to do first, what can wait, and what to tell leadership no about. The deliverables:

A prioritized security roadmap

A sequenced plan tied to the risk register: what gets fixed in the next quarter, the next six months, the next year, and roughly what each step costs. Not a wish list — a phased, defensible plan.

Foundational policies

The written policies a mature program requires and auditors and insurers expect: acceptable use, access control, data handling, incident response, business continuity. Practical documents people can follow, not shelfware.

Framework alignment

Mapping the program to a recognized standard — NIST CSF, CIS Controls, or an industry-specific framework — so progress is measurable and the business can answer "which framework do you align to?" with a straight face.

Days 61–90: Report — put it in front of leadership

Security leadership that never reaches the boardroom isn't leadership. The final month is about accountability and communication, translating technical reality into business terms decision-makers can act on. By day 90:

• A leadership and board report. Where the business started, what's been done, what risk remains, and what's recommended next — in plain language, not jargon.
• A security budget. A justified spending plan tied to the roadmap, so security stops being a series of surprise invoices and becomes a planned investment.
• Metrics and a reporting cadence. The handful of measures that show whether the program is improving over time, plus a regular rhythm for reporting them.

At the end of the first quarter, the business goes from "we think we're probably fine" to a documented program with an owner, a plan, a budget, and a way to prove progress. That's the transformation.

How Atom runs a vCISO engagement

Our vCISO practice is powered by an AI-driven vCISO & governance platform, purpose-built for structured, scalable security leadership. It lets us move faster through the assessment, generate tailored policies and roadmaps grounded in recognized frameworks, and produce clear, consistent reporting for leadership — so our senior people spend their time on judgment and strategy rather than reformatting spreadsheets. The technology accelerates the work; the seasoned security leader still makes the calls.

Who needs a vCISO — and who needs the full-time role

A vCISO is the right fit when you need genuine security leadership but not forty hours a week of it: growing businesses facing customer or insurer demands, companies pursuing compliance, organizations whose risk has outgrown their IT team's spare capacity. A full-time CISO makes sense when security is continuous and central to the business — a large enterprise, a regulated financial or healthcare organization, or a company where a dedicated executive is genuinely occupied every day. Many organizations start with a vCISO precisely to learn what the full-time role would need to do, if they ever grow into it.

Either way, the first ninety days answer the question that started all of this: are we exposed, and what are we doing about it? A vCISO doesn't just answer it — they hand you the plan, the budget, and the report that proves it.