What should a fractional CISO deliver in 90 days?
Ninety days is long enough to know whether an engagement is working. This builds the plan you should have agreed before day one, banded by week, with the test for each deliverable and the reading if it never arrives.
Most engagements that go wrong go wrong quietly in the first quarter. There was no agreed list of what would exist by day 90, so month one became a listening tour, month two became a policy pack bought from a template library, and by month three nobody could say what had changed. The fix is to agree the list before the contract is signed and to check it at each band.
Five questions. The plan appears on this page with the test for each deliverable, and nothing is emailed anywhere unless you ask for it at the end.
On its way
Check your inbox shortly. If you would rather talk it through, book a time.
How the plan is built
Three bands, because that is how the work actually sequences. Weeks one and two are discovery and the things that cannot wait for discovery, which means administrative accounts and an incident contact. Weeks three to six are assessment and planning, which is where the risk register and the costed roadmap come from. Weeks seven to twelve are the first cycle of delivery, where documents get approved and a control is evidenced rather than described.
Your driver adds deliverables to the band where they belong. What already exists removes work from the early bands and moves it later. The hours you are buying decide how much of the list is realistic, and this will tell you when the list and the hours do not agree rather than pretending both are fine. Internal capacity decides whether the outputs are changed systems or documents describing systems that did not change.
The comparison points are on the first 90 days of a vCISO engagement and what a vCISO hands you in month one.
Common questions
What if they want month one to be a listening tour?
Listening is part of the first fortnight, not the whole of it. A senior practitioner can hold interviews and still produce an inventory, an administrative account review and a written findings list inside two weeks, because the findings come out of the interviews rather than instead of them. A month that produces only a meeting schedule is a month you paid for and cannot show anybody.
Should policies really come that late?
Policies written before the assessment describe a company nobody looked at, which is how a business ends up with a policy set that contradicts its own systems and fails at audit for saying things that are not true. Write the risk picture first and the policies second. The exception is where a customer contract needs a specific document by a specific date, and that belongs in the plan as its own item.
What if a deliverable slips?
One slipping is normal and is usually caused by your side, not theirs, because evidence and access requests sit with your people. Three slipping with no written reason is the signal. Ask for the reason in writing at each band boundary, which is also what makes the ninety day review a conversation about facts. See when a vCISO is not working.
Does this list change if we already hold a certification?
Yes. Maintaining a certification is a different first quarter from earning one, and the early bands shift toward verifying that the controls still run rather than building them. Answer the state question honestly and the plan drops the work you have already done.
How do we hold someone to this?
Put the band list in the statement of work as named deliverables with dates, and tie the ninety day review to it. A contract that describes hours but no outputs gives you nothing to review. The contract checklist covers the clauses that make this enforceable.