Managed program
From first call to a ranked roadmap.
The first phases run in a fixed order: scope, kickoff, baseline, roadmap. Here is what happens in each, what you receive and what we need from you.
Program status
Example- 1Done
Kickoff
Tools connected read-only
- 2In review
Baseline
Draft assessment with your cyber expert
- 3Next
Roadmap
Starts when the baseline is accepted
- 4Next
Run
Scans, evidence and reports
The sequence
Five steps, always in this order.
We do not quote a standard duration, because it depends on your frameworks and where you start. Your cyber expert shares a timeline at kickoff.
- 1
Scope the program
On a call with a lead expert you agree your frameworks, your company size and the depth of support. The scope is written down: what is covered and who is on your team. The program runs on the Vectra View platform, which we set up with you.
- 2
Kick off
You meet your cyber expert and team. They are added as users in your own platform account, and you can remove any of them at any time. Together you list the tools to connect, read-only. The person who administers each tool approves its connection. You also confirm that you own your domain, because nothing is scanned until you have.
- 3
Build the baseline
Your team answers a framework-based risk assessment, and VectraIQ scores it and drafts the findings. The vendors you depend on go through a vendor review. Your cyber expert reviews both before they count. The result is a first scored view of where you stand against the frameworks you chose.
- 4
Agree the roadmap
Gaps are ranked so the important ones come first. Policies start from templates, tailored by your cyber expert. Controls are mapped across your frameworks, so one piece of work counts everywhere it applies.
- 5
Run
Scheduled scans, evidence collection and reporting start and carry on from here. The pages on scanning, audit readiness and reporting cover this phase.
Who does what in the baseline and roadmap
Baseline
Roadmap
What you receive
Something concrete at the end of each stage.
Scope
A written scope of what is covered and who is on your team
Review: You and your cyber expert
Kickoff
The agreed list of connected tools and the access each one needs, plus a shared timeline
Review: Each tool’s administrator approves access
Baseline
A company risk assessment, vendor assessments and a scored view against your frameworks
Review: Your cyber expert reviews before it counts
Roadmap
A ranked list of gaps, policies from templates, and controls and next steps mapped to your frameworks
Review: Your cyber expert tailors the policies; you approve them
What we need from you
Access, decisions and a few names.
You stay in control of what we can see.
At kickoff
- Someone on your side who can make decisions and answer promptly. Timely answers keep assessments and reviews on schedule.
- The administrator of each tool in scope, to approve its read-only connection.
- Confirmation that you own the domain to be scanned.
- The frameworks you need, and who is asking for them: a customer, a contract, a regulator or an insurer.
During baseline and roadmap
- The vendors you rely on most, and a contact at each one.
- Any policies you already have, even if they are out of date.
- Decisions on the ranked gaps: which you accept, which you fix and who owns each.
Worked example
What a first roadmap looks like.
Illustrative values. Your ranking comes from your own assessment, and the owner column is agreed with you.
| # | Gap | Why it ranks here | Owner | Maps to |
|---|---|---|---|---|
| 1. | No review of who holds admin access | One misused admin account reaches the most systems | Owner Your IT lead | Maps to SOC 2, ISO 27001 |
| 2. | Two critical vendors never assessed | They handle your data and nobody has checked them | Owner Your expert team | Maps to SOC 2, ISO 27001 |
| 3. | Policies undated and unapproved | Quick to close, and other controls point to them | Owner Your cyber expert tailors, you approve | Maps to SOC 2, ISO 27001, HIPAA |
| 4. | Backup restore never tested | Matters, but no customer is waiting on it yet | Owner Your IT lead | Maps to SOC 2, ISO 27001 |
What is not part of this
- ×Work beyond the agreed scope. It is agreed with you before it starts.
- ×Standalone advisory projects that are not day-to-day program management. Those are Vectra Advisory engagements, scoped separately.
- ×A fixed duration. Your cyber expert shares a timeline at kickoff, based on your frameworks and where you are today.
The baseline draws on risk assessments and third-party risk in the platform, and the roadmap on frameworks and controls. See the frameworks page for the list we support, and the security page for the access we ask for and who approves it.
Questions, answered.
Who has access to our platform account?
Your assigned team are added as users in your own account. You can add or remove a team member’s access at any time, and what they create in the platform is your output, as if one of your own users had created it.
What happens if we want more than the agreed scope?
Work beyond the agreed scope is agreed with you before it starts, so scope never grows without you saying yes.
What if we would rather not connect a tool?
The administrator of each tool decides. If we cannot do the work without a permission, we ask for that permission and nothing wider.
Next in the program
Keep going through the program.
Plan your start with a lead expert.
Tell us your frameworks and where you begin today. We will outline kickoff, baseline and roadmap with you.