The vCISO's First 120 Days Checklist: Fifteen Deliverables Every NCA ECC-Regulated Entity Must See Before the First Board Report
Most virtual CISO engagements begin with optimism and end with ambiguity. The board approves the arrangement, the vCISO attends a few meetings, and three months later no one can articulate what has actually been delivered. The vCISO deliverables first 120 days Saudi entities require are not abstract consulting advice or periodic check-ins—they are tangible, auditable outputs that demonstrate whether the arrangement is delivering value. For CFOs and general managers at NCA-regulated entities, this checklist defines exactly what must be in hand before the vCISO presents the first quarterly security report to the board.
The first 120 days establish whether a vCISO engagement will succeed or drift into irrelevance. Without a clear set of deliverables, the board cannot assess whether the arrangement is working, regulators cannot see accountable leadership, and the organization cannot measure progress. This checklist groups fifteen outputs into five phases, each building on the last, each producing evidence that security leadership is present and effective.
Phase One: Baseline and Accountability (Days 1–30)
The first month establishes what exists, who is responsible, and what the board will see.
1. Asset and System Inventory
Why it matters: You cannot protect what you do not know you have. The vCISO must produce a current inventory of information systems, data repositories, and critical infrastructure, mapped to business functions. This inventory becomes the foundation for every subsequent risk and compliance activity.
2. Governance Charter
Why it matters: The board and regulators need to see who is accountable for cybersecurity decisions. The charter defines the vCISO's authority, reporting lines, escalation paths, and the scope of decisions that require board approval. It answers the question regulators will ask: who is responsible?
3. Regulatory Obligation Register
Why it matters: NCA Essential Cybersecurity Controls, Cybercrime Law, Personal Data Protection Law, and sector-specific requirements create overlapping obligations. The vCISO must produce a single register that lists every applicable requirement, the control that addresses it, and the evidence needed to demonstrate compliance.
4. Initial Risk Register
Why it matters: The board needs to see the top ten cybersecurity risks in business terms—revenue impact, regulatory exposure, operational disruption—not technical jargon. This register is not exhaustive; it identifies the risks that matter most in the first quarter and will be refined over time.
5. Board Reporting Template
Why it matters: The board will receive a quarterly security report. The template must be agreed in the first month so the board knows what to expect, what questions to ask, and how progress will be measured. It sets the rhythm for all future governance.
Phase Two: Policy and Control Framework (Days 31–60)
The second month builds the policy foundation and identifies gaps against regulatory requirements.
6. Policy Gap Analysis
Why it matters: Most organizations have some policies, but they are incomplete, outdated, or misaligned with NCA ECC. The vCISO must produce a gap analysis that compares existing policies to the Essential Cybersecurity Controls and identifies what must be written, updated, or retired.
7. Core Policy Suite
Why it matters: The vCISO must deliver or update the policies that regulators expect to see: information security policy, acceptable use, access control, incident response, business continuity, and third-party risk. These are not aspirational documents; they are the rules the organization will enforce.
8. Access Control and Privilege Review
Why it matters: Excessive or orphaned access is the most common finding in regulatory assessments. The vCISO must produce a report on who has administrative privileges, whether access is justified, and a plan to remediate findings within 90 days.
9. Third-Party Risk Assessment
Why it matters: NCA ECC requires entities to manage cybersecurity risk in their supply chain. The vCISO must produce a list of critical vendors, assess their security posture, and identify contracts that lack adequate cybersecurity clauses.
10. Security Awareness Plan
Why it matters: Human error remains the leading cause of incidents. The vCISO must deliver a 12-month awareness plan with defined topics, delivery methods, and metrics. The board needs to see that awareness is planned, not ad hoc.
Phase Three: Incident and Continuity Readiness (Days 61–90)
The third month ensures the organization can respond to incidents and meet NCA reporting obligations.
11. Incident Response Playbook
Why it matters: NCA requires entities to report cybersecurity incidents within one hour of detection. The vCISO must produce a playbook that defines detection, classification, escalation, containment, and reporting procedures. The playbook must include contact details for NCA's Computer Emergency Response Team and internal escalation paths.
12. Business Continuity and Disaster Recovery Assessment
Why it matters: The board is accountable for operational resilience. The vCISO must assess whether business continuity and disaster recovery plans address cybersecurity incidents, whether recovery time objectives are realistic, and whether plans have been tested in the past 12 months.
13. NCA Reporting Procedures
Why it matters: Regulatory reporting is not optional. The vCISO must document the procedures for submitting incident notifications, annual compliance reports, and material change notifications to NCA. The procedures must include who is authorized to submit, what evidence is required, and how the board is informed.
Phase Four: Roadmap and Treatment (Days 91–110)
The fourth phase translates findings into a costed, prioritized plan.
14. Three-Year Cybersecurity Roadmap
Why it matters: The board needs to see where cybersecurity investment is going and why. The vCISO must produce a three-year roadmap that prioritizes initiatives by risk reduction, regulatory requirement, and business enablement. Each initiative must include estimated cost, timeline, and dependencies.
15. Risk Treatment Plan
Why it matters: The initial risk register identified the top risks; the treatment plan defines what will be done about them. For each risk, the vCISO must document whether it will be mitigated, transferred, accepted, or avoided, the controls that will be implemented, and the residual risk after treatment.
Phase Five: First Board Report (Days 111–120)
The final phase consolidates the first 110 days into a single report for the board.
The first quarterly board report is not a status update; it is a demonstration that the vCISO engagement is delivering value. The report must include:
- Executive summary of cybersecurity posture in business terms
- Progress against the 15 deliverables in this checklist
- Top risks and treatment status
- Regulatory compliance status and upcoming obligations
- Incidents, near-misses, and lessons learned
- Roadmap priorities for the next quarter
- Budget and resource requests
The board must be able to read the report in 15 minutes and understand whether the organization is more secure than it was 120 days ago.
Why These Fifteen Deliverables Matter
Every item on this checklist is auditable, measurable, and directly tied to regulatory expectations or board accountability. They are not consulting recommendations or strategic observations—they are tangible outputs that demonstrate security leadership is present and effective.
For CFOs and general managers evaluating vCISO services, this checklist provides a clear benchmark. If a vCISO cannot commit to delivering these fifteen outputs in the first 120 days, the engagement is unlikely to succeed. If the vCISO delivers them, the board will have everything it needs to assess value, regulators will see accountable leadership, and the organization will have a foundation for sustained improvement.
How CISO Consulting Delivers Virtual CISO Services
CISO Consulting provides experienced security leadership through its Virtual CISO & Security Leadership service—an experienced CISO who leads your security function, reports to your board and represents you to regulators. The service delivers executive security leadership, without the full-time hire.
The engagement produces a cybersecurity strategy and three-year roadmap, policy framework and governance charter, quarterly board and committee reports, risk register and treatment plan, and regulatory correspondence and assessment support.
The service provides accountable security leadership recognized by your board and regulators, a security strategy and policy framework aligned to SAMA and NCA, board and committee reporting in clear business terms, leadership through regulatory assessments and findings, and a planned handover when you appoint a permanent CISO.
The arrangement is structured as an ongoing retainer, typically 12 months. The time commitment is agreed at the start and reviewed quarterly—usually a fixed number of days each month, with more during assessments or incidents. Where the regulator permits it, the vCISO can be named in regulatory submissions; the scope of accountability is agreed in writing before the engagement begins.
For CFOs and general managers at NCA-regulated entities, the first 120 days are the proving ground. The fifteen deliverables in this checklist are the evidence that a vCISO engagement is working.
