Key takeaways
- Scope comes first: what the client is accountable to decides every other step.
- Leave evidence behind from week one. A first report built from records is more credible than one built from memory.
- Use one checklist for every client, so the first 90 days are repeatable.
- Agree who owns each action before the first review, not after it.
The first weeks with a new client set the pattern for the whole engagement. A vCISO who spends them collecting documents will be asked for the same documents again at the first audit. One who spends them building a scoped, owned and evidenced position has something to show at the first review.
This checklist is a working sequence, not a standard. Adjust it to the client’s size and sector. It is written for vCISOs, MSSPs and audit firms supporting several clients.
Days 1 to 30: establish scope and ownership
What the client is accountable to
What the client has
Who does what
Days 31 to 60: build the working position
Days 61 to 90: show it and hand it on
What to leave behind at day 90
| Item | Why it matters |
|---|---|
| Scoped framework list | Shows what the client is held to, and what it is not |
| Asset and vendor register | The base for risk, audit and third-party reviews |
| Owned risk register | Shows decisions were made, and by whom |
| Approved policies | Gives the auditor a dated trail |
| Dated action plan | Turns findings into work with owners |
| First leadership report | Proves the engagement is producing outcomes |
Where onboarding usually goes wrong
Scope is agreed verbally and drifts. Evidence is gathered for the first audit only. The same questionnaire is answered again for each customer. Actions have no owner on the client side. And the vCISO’s method lives in one person’s files, so a second client starts from a blank page.
How this runs in Netra
Netra, the Managed Compliance & Audit OS, supports multi-client management, so an MSSP or vCISO can run every client with the same method. The work is done once and satisfies every framework it touches, evidence is attached once and reused, and control status is derived from completed work. The partner still decides scope and advice, and the client remains responsible for its own compliance. See Netra for vCISOs and consultants and Netra for MSSPs.
This article is a summary for general information. It is not legal advice.
Frequently asked questions
What should a vCISO do first with a new client?
Establish what the client is accountable to: the regulations, contracts and customer commitments that apply. Everything else, the risk register, the policies and the roadmap, depends on that scope.
How many frameworks should be in scope at the start?
Start with the ones the client is already being asked about, by a regulator, a customer or an auditor. Add others once the first set is running, and map shared work across them rather than repeating it.
What should a vCISO hand over at the end of the first 90 days?
A scoped framework list, an asset and vendor register, an owned risk register, approved policies, a dated action plan, and a first report the client’s leadership has seen.
How do partners manage several clients at once?
By keeping each client’s scope, evidence and owners separate, and using the same checklist for every client so the work stays comparable and the first 90 days do not depend on one person’s memory.
Run many clients from one place
Netra supports multi-client management for MSSPs and vCISOs, with the same method for each client.
See it in Netra
A demo on the frameworks that matter to you.
