What Does a vCISO Do? Deliverables in the First 90 Days

"Virtual CISO" is one of the most elastic titles in security — which is exactly why you should judge providers on deliverables, not descriptions. A competent vCISO engagement follows a recognizable arc, and the first 90 days are the most predictable part of it. If you know what should land in the first month, the second, and the third, you can tell within weeks whether you hired a security executive or an expensive attendee of your status meetings. Here's what that arc looks like.

Days 1–30: Understand and Assess

The first month is discovery with teeth: stakeholder interviews; access to systems, prior audits, and existing documentation; a baseline risk assessment against the frameworks that actually matter to your business (SOC 2, HIPAA, NIST CSF, CMMC); and an asset and data inventory that answers what matters most and where it lives.

Deliverables to expect: a written risk assessment, an initial risk register, and the first quick-win fixes shipped — not just noted.

Days 31–60: Prioritize and Plan

Month two converts findings into a plan: a security roadmap with sequenced priorities, effort and cost estimates, and named owners; a policy gap analysis with the first policy drafts; and a vendor and third-party risk snapshot.

Deliverables to expect: a 12–18 month roadmap approved by leadership, a policy plan, and budget framing your CFO can work with.

Days 61–90: Operationalize

Month three is where a program becomes real: operating cadences go live — leadership reporting, risk review, security metrics; a compliance calendar is built, with audits, assessments, and penetration testing windows scheduled; and the incident response plan is drafted or refreshed, with a tabletop exercise on the calendar.

Deliverables to expect: an operating program with metrics and dates — not a binder on a shelf.

After 90 Days: What Steady State Looks Like

From month four onward the engagement settles into ownership: audit and assessment ownership, vendor reviews, board reporting, and program iteration as the business changes. The warning signs of a drifting engagement are just as recognizable: no artifacts, meetings without decisions, and roadmap slippage with no explanation attached.

How to Hold Your vCISO to This Arc

Two contract-stage moves keep everyone honest. First, put the 90-day deliverables in the contract — named artifacts with dates, not aspirations. Second, ask for the artifact list before you sign; strong providers hand it over without hesitation because it is how they already work. (For the harder screening questions, start with our 10 questions to ask before you sign.)

How Essendis Helps

Essendis virtual CISO services run exactly this arc: structured onboarding, credentialed executives — leadership credentials include CISA, CISM, CISSP, and CCSP — and an engineering team behind the roadmap, so what gets planned actually gets built. Connect with an expert to see the 90-day artifact list before you commit to anything.