The vCISO's First 90 Days: A SAMA CSF Checklist for CFOs
When a Saudi financial institution appoints a virtual CISO, the chief financial officer or general manager needs clarity on one question: what will we actually receive, and when? The vCISO's first 90 days at a SAMA-regulated firm should follow a structured roadmap that produces tangible outputs aligned to the SAMA Cyber Security Framework. This checklist sets out the week-by-week deliverables you should expect, so you can hold any vCISO—whether ours or another provider's—accountable from day one.
The structure below mirrors the rhythm our vCISO engagements follow: assess in the first 30 days, prioritize in the second month, and establish governance rhythms in the third. Each phase produces specific documents and decisions that move the institution from risk discovery to managed remediation.
Weeks 1–4: Assess Posture, Risks and Quick Wins
The opening month is diagnostic. The virtual CISO maps what exists, identifies immediate exposures, and frames the institution's position against SAMA Cyber Security Framework requirements.
Week 1: Orientation and Scoping
- Stakeholder interviews with executive management, IT leadership and compliance.
Why it matters: The vCISO learns business priorities, recent audits, and where friction exists between technology and regulation.
- Document inventory: policies, procedures, recent risk assessments, audit findings.
Why it matters: Establishes the baseline and avoids duplicating work already completed.
- Access provisioning: systems, logs, vendor contracts, incident records.
Why it matters: The vCISO cannot assess what they cannot see; delayed access delays every downstream deliverable.
- Confirmation of regulatory scope: SAMA CSF domains, NCA ECC obligations if applicable.
Why it matters: Different regulators impose overlapping but distinct requirements; clarity prevents wasted effort.
Week 2: Technical and Governance Review
- Network architecture review and asset inventory validation.
Why it matters: SAMA CSF Domain 1 (Cybersecurity Governance) and Domain 2 (Cybersecurity Defense) both require accurate asset registers.
- Identity and access management audit: privileged accounts, multi-factor authentication coverage.
Why it matters: Credential misuse remains a primary attack vector; quick wins often lie in tightening access controls.
- Incident response and business continuity plan review.
Why it matters: SAMA expects tested, documented plans; gaps here attract regulator attention during inspections.
- Vendor and third-party risk register review.
Why it matters: SAMA CSF Domain 3 (Third Party Cybersecurity) mandates oversight of service providers with access to systems or data.
Week 3: Gap Analysis Against SAMA CSF
- Control-by-control mapping of current state to SAMA Cyber Security Framework domains.
Why it matters: This is the evidence base for every remediation decision and budget request that follows.
- Identification of critical gaps: those that expose the institution to material operational or regulatory risk.
Why it matters: Not all gaps are equal; leadership needs to know which demand immediate investment.
- Quick-win catalogue: low-cost, high-impact fixes achievable within 30 days.
Why it matters: Early visible progress builds confidence and demonstrates the vCISO's practical value.
Week 4: Risk Snapshot and Summary Report
- Risk snapshot document: top five exposures, current mitigations, residual risk ratings.
Why it matters: Executives need a one-page view of what keeps the institution vulnerable.
- SAMA CSF gap summary: compliant, partially compliant, non-compliant controls by domain.
Why it matters: The regulator will ask this question; the institution should know the answer before the next examination.
- Quick-wins implementation plan with owners and deadlines.
Why it matters: Demonstrates momentum and secures early credibility for the vCISO function.
By the end of week four, management should hold a concise written assessment of cybersecurity posture, regulatory alignment, and immediate actions. This mirrors the first 30 days phase of our vCISO service, where we assess posture, risks and quick wins.
Weeks 5–8: Prioritize and Build the Roadmap
The second month translates findings into decisions. The virtual CISO works with finance, IT and business units to cost remediation options, sequence initiatives, and prepare materials for board approval.
Week 5: Remediation Options and Costing
- Remediation options for each critical gap: build, buy or accept the risk.
Why it matters: Different gaps demand different solutions; some require technology, others process change or staff training.
- Budget estimates: capital expenditure for tools, operating expenditure for services, internal effort required.
Why it matters: The CFO cannot approve what is not costed; vague requests stall in budget committees.
- Vendor shortlisting for key capabilities: endpoint protection, SIEM, vulnerability management.
Why it matters: Procurement cycles are long; early shortlisting accelerates delivery once budget is approved.
Week 6: Roadmap Development
- Three-year cybersecurity roadmap: initiatives sequenced by risk reduction, regulatory deadline and dependency.
Why it matters: SAMA expects a forward plan, and the institution needs predictable budget phasing across financial years.
- Year-one detailed plan: milestones, owners, success criteria.
Why it matters: The board will approve strategy but hold management accountable for execution; specificity is essential.
- Alignment to business objectives: how each initiative supports growth, digital transformation or operational resilience.
Why it matters: Cybersecurity competes for budget with revenue-generating projects; the business case must be clear.
This roadmap development reflects the prioritize phase, where the roadmap is agreed with management.
Week 7: Board Presentation Preparation
- Executive summary: current risk posture, regulatory exposure, recommended investment.
Why it matters: Board members have limited time; the ask must be clear and the consequences of inaction explicit.
- Risk heat map: before and after the proposed roadmap.
Why it matters: Visual tools communicate risk reduction more effectively than narrative alone.
- Budget request with phasing: what is needed this year, what can wait, what is discretionary.
Why it matters: Boards appreciate optionality; a single take-it-or-leave-it number is harder to approve.
Week 8: Board Presentation and Approval
- Delivery of board presentation: risk, roadmap, budget.
Why it matters: Formal board approval is the gateway to budget release and vendor engagement.
- Board minutes and action log.
Why it matters: Decisions must be recorded; the vCISO will track progress against these actions in every subsequent quarterly report.
At the close of week eight, the institution should possess an approved cybersecurity strategy, a costed roadmap, and board-level accountability for delivery. Our vCISO service produces a security roadmap and priorities as a core deliverable during this phase.
Weeks 9–12: Establish Governance Rhythms and Reporting
The final month of the first quarter embeds the operating model. The virtual CISO sets up committees, reporting cadences, and handover mechanisms so the institution can sustain momentum beyond the initial engagement.
Week 9: Governance Structure
- Cybersecurity committee charter: membership, frequency, escalation paths.
Why it matters: SAMA CSF Domain 1 requires defined governance; ad hoc meetings do not satisfy this obligation.
- Terms of reference for working groups: incident response, change advisory, vendor risk.
Why it matters: Committees without clear scope drift into status updates rather than decision-making.
- Reporting templates: monthly management report, quarterly board pack.
Why it matters: Consistent formats allow trend analysis and reduce preparation time each cycle.
Our vCISO service delivers monthly management reports and quarterly board packs as standard, alongside committee minutes and action tracking.
Week 10: First Committee Cycle
- Inaugural cybersecurity committee meeting: roadmap progress, risk register review, open actions.
Why it matters: The first meeting sets the tone for rigor and accountability in all subsequent sessions.
- Action tracking system: owner, due date, status, escalation trigger.
Why it matters: Actions without tracking become recommendations without consequence.
Week 11: Stakeholder Engagement
- Regulator liaison preparation: summary of remediation plan, timeline for outstanding findings.
Why it matters: SAMA expects proactive communication on how the institution is addressing known gaps.
- External auditor briefing: control improvements, evidence available for next audit.
Why it matters: Auditors appreciate early visibility; it reduces surprise findings and shortens fieldwork.
- IT and business unit alignment sessions: how cybersecurity supports their objectives.
Why it matters: Security is an enabler, not a blocker; this framing secures cooperation.
Our vCISO service includes regulator and auditor liaison as a feature, ensuring the institution maintains constructive relationships with oversight bodies.
Week 12: First Quarterly Report and Transition Planning
- Quarterly report to the board: progress against roadmap, risk movements, budget utilization.
Why it matters: The board approved the plan in week eight; they now need evidence of delivery.
- Lessons from the first 90 days: what worked, what needs adjustment.
Why it matters: Honest reflection improves the operating model before bad habits calcify.
- Transition options discussion: continue with vCISO, begin permanent CISO search, hybrid model.
Why it matters: Some institutions need ongoing virtual leadership; others use the vCISO to define the role before hiring.
Our vCISO service operates on an ongoing retainer basis, with days per month agreed to match the institution's needs. We also provide team mentoring and hiring support for institutions that choose to recruit a permanent CISO, and we manage the transition phase, building the team and, if wanted, hiring a permanent CISO.
What This Roadmap Tells You
This 90-day structure is not theoretical. It reflects the sequence our vCISO engagements follow at SAMA-regulated institutions: assess in the first 30 days, prioritize through roadmap agreement with management, then lead through ongoing governance and reporting.
You should expect four categories of output:
- Diagnostic documents in month one: risk snapshot, SAMA CSF gap summary, quick-wins plan.
- Strategic documents in month two: costed roadmap, board presentation, approved budget.
- Governance artefacts in month three: committee charters, reporting templates, first quarterly report.
- Operational rhythms embedded by day 90: monthly management reporting, quarterly board packs, committee minutes and action tracking.
If a virtual CISO cannot articulate what you will receive in each phase, or cannot commit to a timeline, you are buying advisory hours rather than leadership. The distinction matters.
How CISO Consulting Delivers This Roadmap
Our vCISO service provides strategic cybersecurity leadership on demand, aligned to your business objectives and regulatory obligations. We deliver experienced security leadership without a full-time hire.
The engagement follows a four-phase process: assess in the first 30 days to understand posture, risks and quick wins; prioritize by developing a roadmap agreed with management; lead through ongoing committee participation and reporting; and transition by building the team and, if wanted, hiring a permanent CISO.
Deliverables include a security roadmap and priorities, monthly management reports, quarterly board packs, and committee minutes with action tracking. The service operates on an ongoing retainer basis, with days per month agreed to match your institution's scale and complexity.
Our vCISOs provide security strategy and priorities, committee and board reporting, regulator and auditor liaison, team mentoring and hiring support, and vendor and budget oversight. We work within the SAMA Cyber Security Framework and NCA Essential Cybersecurity Controls, ensuring alignment to the regulatory environment Saudi financial institutions navigate.
We also offer a standalone Cybersecurity Strategy & Roadmap service for institutions that need the strategic plan but prefer to execute it internally. This translates your business priorities, regulatory obligations and threat landscape into a costed, prioritized strategy and multi-year roadmap—a three-year security direction the board can approve and the team can deliver.
If you are evaluating whether a virtual CISO can meet your institution's needs, this checklist gives you the accountability framework. Use it to assess any provider's proposal, including ours.
