MyCISO Getting Started Compliance

Overview

MyCISO Getting Started provides a structured, platform-guided entry point into cybersecurity management.

It covers approximately 20 foundational controls across asset management, access control, backup, patching, awareness, and incident readiness.

The framework is designed to be implemented in four to eight weeks without external consultants.

Progress is tracked in real-time through the MyCISO platform with maturity scoring and gap analysis.

Getting Started is the first step in a progression path that leads to MyCISO Intermediate and then to international standards.

Key Areas

• Asset Awareness - know what devices, systems, and data you have and where they live
• Access Management - ensure only the right people have access to the right resources
• Backup and Recovery - protect critical data with regular, tested backups
• Patch Management - keep systems and software up to date to close known vulnerabilities
• Security Awareness - ensure staff understand basic threats like phishing and social engineering
• Incident Readiness - know who to call and what to do when something goes wrong
• Policy Foundations - establish basic security policies that set expectations for the organisation
• Endpoint Protection - deploy and maintain antivirus and endpoint detection on all devices

Who It's For

• Small and mid-size businesses without a dedicated security function
• Not-for-profit organisations with limited IT resources
• Startups looking to establish security fundamentals before scaling
• IT managers who have been tasked with improving security but lack a formal framework
• Organisations required by insurers or partners to demonstrate basic security practices

Core Requirements

Policies and Governance

Establish a basic information security policy that defines the organisation's commitment to protecting data. Assign a security owner or sponsor at leadership level, even if security is not their full-time role. Document acceptable use expectations for staff.

Risk Management

Identify the organisation's most critical information assets and the key risks to those assets. This does not require a formal risk register at this stage - a simple prioritised list of what matters most and what could go wrong is sufficient.

Security Controls

Implement foundational technical controls: endpoint protection on all devices, multi-factor authentication on critical systems, regular patching cadence, and automated backups. These controls address the most common attack vectors with minimal complexity.

Incident Response

Define a basic incident response process: who to contact, how to report a suspected incident, and initial containment steps. This does not need to be a full playbook - a one-page guide that every staff member can follow is the goal.

Evidence and Reporting

Track which controls are in place and which are still being implemented. The MyCISO platform provides a dashboard view of maturity against the Getting Started framework, giving leadership visibility into progress without manual reporting.

Implementation Steps

1. Platform onboarding - Set up your MyCISO environment and select the Getting Started framework. The platform will guide you through an initial self-assessment to establish your baseline maturity across all control areas.
2. Quick wins - Address the highest-priority gaps identified in your assessment. These typically include enabling MFA, deploying endpoint protection, establishing a backup schedule, and drafting a basic security policy.
3. Staff awareness - Run a foundational security awareness session for all staff. Cover phishing recognition, password hygiene, and incident reporting. MyCISO Culture module can support this with pre-built content.
4. Document and track - Record your controls, policies, and improvement actions in the platform. Set reminders for recurring tasks like patch reviews and backup tests. Begin building an evidence trail.
5. Review and progress - After three to six months, review your maturity scores and identify areas ready for uplift. When all Getting Started controls are in place, transition to MyCISO Intermediate for the next level of security maturity.

Frequently Asked Questions

Is MyCISO Getting Started a recognised standard?

No. It is a proprietary framework designed by MyCISO to help organisations build foundational security practices. It is not a substitute for formal standards but serves as a structured pathway toward them.

Who is this framework for?

Any organisation that does not yet have a formal cybersecurity program in place. It is particularly suited to small and mid-size businesses, not-for-profit organisations, and teams without dedicated security staff.

How long does it take to complete?

Most organisations can assess and begin implementing Getting Started controls within four to eight weeks. Ongoing maintenance and improvement continue beyond initial implementation.

What comes after Getting Started?

MyCISO Intermediate is the natural next step, adding more comprehensive controls across wider security domains. From there, organisations can progress to international standards like ISO 27001 or NIST CSF.

Do I need a security consultant?

No. The framework and the MyCISO platform are designed to be self-service. The controls are written in plain language with practical guidance built into the platform.

Why It Matters

• Many organisations know they need to improve their security posture but don't know where to start. International standards can feel overwhelming, and hiring consultants to interpret them is expensive. MyCISO Getting Started removes that barrier by providing a clear, jargon-free starting point.
• Boards and leadership teams increasingly expect evidence that cybersecurity is being managed. Even at a foundational level, Having a structured framework in place demonstrates governance and due diligence to stakeholders, insurers, and regulators.
• Getting Started creates the muscle memory for continuous improvement. By establishing basic practices - asset management, access control, backup, and incident awareness - organisations build the operational discipline needed to progress to more advanced frameworks like MyCISO Intermediate or ISO 27001.

Common Challenges

• Assuming that basic controls are already in place when they have not been formally verified or documented
• Lack of a designated security owner, leaving no one accountable for driving progress
• Treating the framework as a one-time checklist rather than an ongoing practice
• Resistance from staff who view security awareness training as unnecessary or disruptive
• Delaying implementation because the organisation believes it is too small to be a target