What a Fractional CISO Does in the First 90 Days: SOC 2

A practical first-90-days sequence for fractional security leadership, from a SOC 2 gap assessment to funded decisions, tested controls, and useful reporting.

What a fractional CISO does in the first 90 days is assess your security gaps, help leadership decide what to fix first, and establish reporting backed by evidence. For a SOC 2 readiness effort, that means defining the system under review, checking controls against the applicable Trust Services Criteria, and turning findings into assigned actions.

At Seven Vector, we organize this work as Assess, then Build, then Operate. Use the day ranges below as planning checkpoints. The pace depends on your system boundaries, existing controls, staff availability, and examination goals.

What does a fractional CISO assess in the first 30 days?

Start with the business objective and system boundary

The first conversations should include the executive sponsor, technology owner, operations lead, and whoever handles customer security commitments. We establish why you need the engagement: a customer request, an upcoming examination, repeated incidents, or a leadership gap. That objective determines which decisions need attention first.

For SOC 2, define the services and supporting system you expect the examination to cover. Identify infrastructure, people, procedures, data, and outside service providers. Record where sensitive information enters, moves, and leaves. The technology owner validates those facts; the executive sponsor confirms the business scope.

Security is included in a SOC 2 examination. Availability, processing integrity, confidentiality, and privacy may also be included, depending on the scope. A fractional CISO helps you connect those choices to service commitments and system requirements, then coordinates with the CPA firm before you build evidence around an assumed scope.

Compare written controls with actual practice

A gap assessment checks more than whether a policy exists. We interview control owners, inspect records, and trace selected activities from request through completion. A policy requiring prompt access removal matters only if the removal happens and you can show when it happened.

• Access: The identity administrator explains approval, privilege assignment, periodic review, and account removal. Useful evidence includes approved requests, account records, and completed reviews.
• Changes: The engineering or operations lead shows how changes are authorized, tested, and released. Evidence may include change records, test results, approvals, and emergency-change reviews.
• Monitoring and incidents: The operations lead demonstrates how suspicious activity becomes an investigated case. Review alert records, escalation notes, incident procedures, and response decisions.
• Suppliers: Procurement and service owners identify providers that affect the scoped service. Review security evaluations, relevant assurance reports, contract commitments, and follow-up actions.

These checks connect to SOC 2 criteria such as CC6 for logical and physical access, CC7 for system operations, CC8 for change management, and CC9 for risk mitigation. The criteria describe expected outcomes. Your controls and evidence must fit the system; a copied checklist alone does not establish that fit.

Separate urgent exposure from examination preparation

The fractional CISO records findings in a gap list and risk register. Each entry should describe the affected service, the observed condition, the supporting evidence, and the potential business effect. The service owner confirms the facts. Leadership sees which decisions need funding or an explicit risk decision.

An active account belonging to a departed administrator usually deserves attention before document formatting. If penetration testing is appropriate, written authorization and scope come first. Existing exposure should drive the order of work, alongside legal duties and customer commitments.

What should a virtual CISO decide by day 60?

Turn findings into funded, owned actions

The Build phase converts assessment findings into a remediation plan. We recommend priorities and explain trade-offs. Your executive sponsor approves spending and resolves competing business demands. Technology, human resources, procurement, and other control owners implement the changes assigned to them.

For each priority, agree on the owner, the required change, dependencies, a target date, and the evidence needed to close it. A finding marked complete should point to a verified change, rather than an assurance that someone handled it.

For example, a weak account-removal process may require human resources to trigger a departure notice, an administrator to disable access, and a reviewer to check completion. Closure evidence could include the revised procedure and records showing that recent departures followed it.

SOC 2 CC3 addresses risk assessment, including identifying and analyzing risks to objectives and assessing significant changes. It does not prescribe one scoring formula. Use a method leadership understands, and record assumptions. Avoid treating a numerical score as a substitute for a decision.

Approve policies people can follow

Policies should state the rule, the owner, and how exceptions are approved. Procedures should explain the actual steps. The fractional CISO drafts or revises them with the people who perform the work. The designated executive approves policies, and department leads communicate the changes.

Set review frequencies based on risk, applicable obligations, and the control design. Avoid claiming that SOC 2 universally requires a particular access-review schedule or one authentication method. Once you document a frequency, plan the staffing and evidence needed to follow it.

Design evidence collection alongside the control

Evidence planning starts while you build the process. Identify who retains each record, where it is stored, who can access it, and how it connects to the control. A screenshot without a date, system context, or explanation may leave important questions unresolved.

A Type 1 SOC 2 report addresses control design at a specified date. A Type 2 report also addresses operating effectiveness over a specified period. Coordinate timing with the CPA firm. Readiness work should support the intended examination, rather than assume that 90 days automatically supplies a sufficient examination period.

How does a fractional CISO use days 61–90 to establish routine operations?

The Operate phase checks whether the new processes survive ordinary business activity. We review fresh evidence, follow overdue actions, and test selected procedures with control owners. This is where a process that looked clear on paper may reveal missing permissions, unclear handoffs, or insufficient staff time.

• Review recent joiners, role changes, and departures. The administrator supplies records; the fractional CISO checks approvals and completion against the documented process.
• Trace selected production changes. The change owner explains exceptions and supplies approval and testing records.
• Run an incident exercise. Operations, leadership, legal counsel, and communications staff practice escalation and record decisions and follow-up actions.
• Review supplier issues. Each service owner confirms whether unresolved findings affect current service commitments and proposes next steps.

SOC 2 CC7 addresses detection, evaluation, response, and recovery activities. An exercise helps evaluate your procedures and identify gaps. It supports readiness, while actual incident handling and other operational records provide different evidence. Keep those distinctions clear when reporting progress.

When a check fails, revise the action instead of hiding the exception. Record what happened, its effect, the corrective step, and the next verification. The process owner fixes the issue; the fractional CISO tracks it through retesting.

What does a fractional CISO report in the first 90 days?

Leadership reporting should start during assessment and become more precise as evidence improves. A useful report distinguishes completed changes, unresolved exposure, and decisions waiting for approval. It also identifies the source and date of each important measure.

Choose measures that support action: overdue high-priority remediation, unresolved privileged-access exceptions, missing control records, or incident-exercise actions awaiting an owner. Define the population behind each measure. “Eight of ten sampled departures met our access-removal target” says more than “access controls are improving.”

At the 90-day checkpoint, compare the current gap list with the baseline. Show which risks were reduced, which remain, and which need leadership decisions. Recommend the next priorities with owners and dependencies. Keep readiness findings separate from the CPA firm's examination conclusions.

How Seven Vector helps

Seven Vector provides fractional security leadership that connects gap assessment, remediation, and ongoing reporting. We work with your staff to establish priorities, improve policies, verify evidence, and bring clear decisions to leadership. The scope follows your business needs and examination goals.

Book a 30-minute initial consultation to discuss your current controls, SOC 2 goals, and the decisions your first 90 days should address.

Questions

Are a fractional CISO and a virtual CISO the same thing?

The terms often overlap. Fractional usually describes part-time security leadership; virtual often describes how the service is delivered. Ask who leads the engagement, which decisions they support, and how they work with your internal staff.

Can we finish SOC 2 in the first 90 days?

Use 90 days as a planning horizon for assessment, remediation, and evidence review. Examination timing depends on scope, control maturity, report type, and the CPA firm's schedule. A Type 2 examination also requires evidence covering its specified period.

Who implements the fractional CISO's recommendations?

Assign implementation to named control owners. Administrators change access settings, engineering teams revise change processes, and department leads implement procedures. The fractional CISO coordinates priorities, checks evidence, and raises blocked decisions with the executive sponsor.

Does Seven Vector issue the SOC 2 report?

A CPA firm performs the SOC 2 examination and issues the report. Seven Vector supports readiness through assessment, remediation planning, evidence review, and coordination with your staff and the examining firm.

Call (888) 753-6725. Calls answered 24/7, 365 days a year.