Days 1–30: Understand and govern
- Inventory assets, data and vendors.
- Assign ownership and a security policy.
- Do a quick risk assessment to find the top risks.
Days 31–60: Close the biggest gaps
- MFA everywhere; least-privilege access.
- Patching, backups and logging.
- Basic incident-response plan.
Days 61–90: Prove and improve
- Run a penetration test.
- Security-awareness training.
- Pick a framework (ISO 27001/SOC 2) to formalise.
How CyberSigma helps
We help you build a right-sized program fast — governance, controls, testing and a path to certification — led by senior consultants.
This guide is educational and not legal advice. Requirements evolve — validate specifics against the current standard or regulation for your situation.