# The vCISO's First 90 Days Under NCA ECC: Eight Deliverables That Turn Strategic Alignment Into Board-Ready Cyber Risk Reporting
When a chief financial officer or chief executive engages a virtual chief information security officer for an entity regulated under the National Cybersecurity Authority Essential Cybersecurity Controls framework, the question is rarely whether the vCISO possesses technical competence. The question is whether the engagement will produce a sustainable cybersecurity program aligned to business objectives or simply generate another compliance document that sits unread.
The difference lies in the vCISO deliverables NCA ECC-regulated entities receive during the first quarter. A structured 90-day onboarding transforms abstract security concepts into board-ready reporting, measurable risk reduction and a roadmap the organization can actually execute. This article walks through the eight sequential deliverables that define a successful vCISO engagement under the NCA ECC framework, explaining what each document contains, who participates in its creation, and how it feeds the next phase of work.
Why Sequential Deliverables Matter More Than Ad Hoc Consulting
Many organizations treat vCISO services as flexible advisory support—calling on the virtual CISO when an auditor asks a difficult question or a regulator schedules an inspection. This reactive model fails under NCA ECC because the framework demands documented governance, continuous risk assessment and evidence of strategic oversight.
The National Cybersecurity Authority expects regulated entities to demonstrate that cybersecurity decisions flow from a clear understanding of assets, threats and business context. A vCISO who arrives without a structured onboarding process cannot produce that evidence. Sequential deliverables ensure each piece of work builds on the last: the asset inventory informs the control-gap analysis, the gap analysis shapes the roadmap, the roadmap drives the quarterly board reporting.
For the chief financial officer evaluating vCISO proposals, the presence of a defined deliverable sequence is the clearest signal that the engagement will produce governance artefacts rather than billable hours.
The Four-Phase Structure: Assess, Prioritize, Lead, Transition
A vCISO engagement aligned to NCA ECC requirements follows four phases. The first 30 days focus on assessment of current posture, risks and quick wins. The second phase produces a roadmap agreed with management. The third phase delivers ongoing leadership, committee participation and reporting. The fourth phase, when required, builds internal capability and supports the hiring of a permanent chief information security officer.
The eight deliverables described below emerge primarily from the first two phases, though several—particularly reporting artefacts—recur throughout the engagement.
Deliverable One: Comprehensive Asset and Data Inventory
The vCISO begins with a structured inventory of information assets, technology systems and data flows. This is not a network scan. It is a facilitated exercise involving business unit leaders, IT managers and process owners who understand what the organization holds, where it resides and why it matters.
The deliverable is a categorized register that maps each asset to its business function, data classification and regulatory obligation. For a financial services entity, this might distinguish between customer transaction databases subject to Saudi Central Bank rules and internal HR systems. For a healthcare provider, it separates patient records governed by health data regulations from operational systems.
The chief executive and chief financial officer participate in a validation session to confirm that the inventory reflects actual business priorities. The output becomes the foundation for every subsequent risk decision.
Deliverable Two: NCA ECC Control-Gap Heat-Map
With the asset inventory complete, the vCISO assesses current controls against each of the five domains in the NCA ECC framework: cybersecurity governance, cybersecurity defence, cybersecurity resilience, third-party and cloud computing cybersecurity, and industrial control systems and operational technology cybersecurity.
The deliverable is a heat-map that shows, for each control family, whether the organization has no control, partial implementation or full compliance. Critically, the heat-map weights each gap by the business impact of the assets it affects. A missing access-control policy for a customer-facing payment system scores higher than an incomplete patch schedule for an internal test environment.
The chief financial officer uses this heat-map to understand where regulatory risk and operational risk intersect. It answers the question: if the National Cybersecurity Authority inspects us next quarter, where will they find the most significant deficiencies?
Deliverable Three: Threat and Vulnerability Context Report
The third deliverable adds external context to the internal gap analysis. The vCISO documents the threat landscape relevant to the organization's sector, geography and technology stack. For a Saudi entity, this includes regional threat actors, common attack vectors observed in the Kingdom and vulnerabilities specific to widely deployed platforms.
The report does not rely on generic threat intelligence. It identifies which of the gaps in deliverable two are actively exploited in similar organizations and which represent theoretical risk. This distinction allows management to separate urgent remediation from longer-term hardening.
The chief executive receives a two-page executive summary that explains, in business language, why certain controls matter now. The technical team receives the full report with indicators of compromise and recommended mitigations.
Deliverable Four: Quick-Win Implementation Plan
Before drafting a multi-year roadmap, the vCISO identifies controls that can be implemented within 30 days using existing resources. These quick wins demonstrate momentum, reduce the most glaring gaps and build confidence in the vCISO's practical judgment.
The deliverable is a task list with named owners, completion dates and success criteria. Typical quick wins include enabling multi-factor authentication for privileged accounts, removing unused user accounts, documenting an incident response contact tree and scheduling the first cybersecurity committee meeting.
The chief financial officer approves any budget required—usually minimal—and the vCISO tracks completion in the first monthly management report.
Deliverable Five: Costed Three-Year Security Roadmap
The roadmap translates the control-gap heat-map and threat context into a prioritized, costed plan. It sequences remediation activities across three years, grouping them into phases that align with business cycles, regulatory deadlines and budget availability.
Each initiative in the roadmap includes a cost estimate, resource requirement, expected completion quarter and the NCA ECC control it addresses. The roadmap distinguishes between foundational work that must happen in year one—such as establishing a governance committee and formalizing risk assessment processes—and advanced capabilities that depend on those foundations.
The chief executive and chief financial officer review the roadmap in a dedicated session with the vCISO. They adjust timelines to match capital planning cycles, defer lower-priority projects and confirm that the plan supports business objectives such as new product launches or geographic expansion. The agreed roadmap becomes the basis for quarterly board reporting.
Deliverable Six: Monthly Management Report
Once the roadmap is approved, the vCISO produces a monthly management report that tracks progress against planned milestones, highlights emerging risks and escalates decisions that require executive input.
The report follows a standard structure: roadmap status with red-amber-green indicators, new vulnerabilities or threat intelligence relevant to the organization, updates on regulatory developments from the National Cybersecurity Authority, and a summary of committee activity. It includes a one-page executive summary and detailed annexes for technical audiences.
The chief financial officer uses the monthly report to monitor whether cybersecurity spending is delivering the expected risk reduction. It also provides the narrative for internal audit and external assurance reviews.
Deliverable Seven: Quarterly Board Cyber Risk Dashboard
The board of directors requires a different view. The quarterly board pack distils the monthly management reports into a concise dashboard that presents cybersecurity as a business risk, not a technical function.
The deliverable includes four elements: a summary of residual risk across critical business processes, progress against the approved roadmap, a comparison of the organization's posture to regulatory expectations, and any strategic decisions the board must make—such as approving budget for a major control upgrade or accepting residual risk in a legacy system.
The vCISO presents the board pack in person or joins the audit and risk committee meeting to answer questions. The chief executive and chief financial officer receive a pre-brief to align on messages and recommendations.
Deliverable Eight: Committee Minutes and Action Tracking
Governance under NCA ECC requires documented oversight. The vCISO establishes or chairs a cybersecurity steering committee that meets monthly, bringing together representatives from IT, legal, compliance, operations and business units.
The deliverable is a set of formal minutes for each meeting, recording decisions, action items, risk acceptances and escalations. The vCISO maintains a central action tracker that links committee decisions to roadmap tasks and board commitments.
The chief financial officer relies on this documentation during regulatory inspections and audits. It demonstrates that cybersecurity is managed through a deliberate governance process, not ad hoc responses to incidents.
How These Deliverables Support Ongoing Leadership and Transition
The eight deliverables establish the infrastructure for the third phase of the vCISO engagement: ongoing leadership. With the roadmap, reporting cadence and governance structure in place, the vCISO shifts from assessment to execution—mentoring the internal team, liaising with regulators and auditors, overseeing vendor selection and managing the cybersecurity budget.
When the organization is ready, the fourth phase begins. The vCISO supports the hiring of a permanent chief information security officer, transferring knowledge and ensuring continuity. The deliverables produced in the first 90 days become the handover documentation for the incoming leader.
What Chief Executives and Chief Financial Officers Should Expect
A vCISO engagement structured around these eight deliverables provides clarity from the first week. The chief executive knows what the organization will receive, when it will arrive and how each piece supports regulatory compliance and business resilience. The chief financial officer can budget with confidence, knowing that spending is tied to a documented roadmap rather than open-ended consulting.
Entities regulated under NCA ECC cannot afford a vCISO who operates as a part-time advisor without structure. The framework demands evidence of strategic oversight, documented risk decisions and continuous improvement. The eight deliverables described in this article provide that evidence.
Closing: From Deliverables to Sustainable Leadership
The value of a virtual chief information security officer is not measured in hours billed or reports written. It is measured in the organization's ability to make informed cybersecurity decisions, demonstrate regulatory compliance and protect the business operations that matter.
For organizations seeking experienced security leadership without a full-time hire, a vCISO engagement delivers strategic cybersecurity leadership on demand, aligned to business objectives. The first 90 days determine whether that leadership translates into sustainable governance or remains an expensive placeholder. The eight deliverables—asset inventory, control-gap heat-map, threat context, quick wins, roadmap, monthly management report, quarterly board pack and committee minutes—provide the structure that turns assessment into action and compliance into capability.
