MyCISO Intermediate Compliance

Overview

MyCISO Intermediate covers approximately 50 controls across governance, risk, technical, and operational domains.

It bridges the gap between foundational security and full international standard implementation.

The framework includes formal risk assessment, supplier management, and business continuity planning.

All progress is tracked through the MyCISO platform with automated evidence collection and board-ready reporting.

Intermediate serves as a structured preparation path for ISO 27001, NIST CSF, or SOC 2 certification.

Key Areas

• Security Governance - formal policies, roles, responsibilities, and management review
• Risk Assessment and Treatment - structured identification, evaluation, and management of information security risks
• Access Control and Identity Management - role-based access, privileged access management, and regular access reviews
• Network and Infrastructure Security - segmentation, firewall management, and secure configuration baselines
• Data Classification and Protection - identifying sensitive data and applying appropriate controls
• Supplier and Third-Party Risk - assessing and monitoring the security posture of key suppliers
• Business Continuity and Disaster Recovery - planning for disruptions and testing recovery procedures
• Security Monitoring and Logging - centralised log collection, alerting, and review processes
• Change Management - controlled processes for changes to systems and infrastructure
• Vulnerability and Patch Management - structured scanning, prioritisation, and remediation cadence

Who It's For

• Mid-market organisations preparing for ISO 27001 or SOC 2 certification
• Organisations responding to customer due diligence requirements
• IT and security teams that have outgrown ad-hoc security practices
• Companies required by insurers to demonstrate structured security management
• Organisations that completed MyCISO Getting Started and are ready for the next level

Core Requirements

Policies and Governance

A comprehensive information security policy suite covering acceptable use, access control, data classification, incident response, and supplier management. Policies should be approved by leadership, communicated to all staff, and reviewed at least annually.

Risk Management

A formal risk assessment process that identifies threats to information assets, evaluates likelihood and impact, and documents treatment decisions. A risk register should be maintained and reviewed quarterly with leadership visibility.

Security Controls

Technical controls covering network segmentation, endpoint detection and response, vulnerability scanning, privileged access management, encryption for data at rest and in transit, and secure configuration baselines. Controls should be documented and tested.

Incident Response

A documented incident response plan with defined roles, escalation paths, communication templates, and post-incident review procedures. At least one tabletop exercise should be conducted annually.

Evidence and Reporting

Systematic evidence collection for all control areas, including access reviews, vulnerability scan results, policy attestations, training records, and risk register updates. The MyCISO platform automates much of this evidence management and provides board-ready reporting.

Implementation Steps

1. Maturity assessment - Assess your current state against all MyCISO Intermediate controls. If you have completed Getting Started, your existing scores will carry forward. Identify the gaps that need to be addressed.
2. Risk assessment - Conduct a formal risk assessment covering your critical information assets, key threats, and existing controls. Document findings in a risk register and define treatment plans for unacceptable risks.
3. Policy development - Draft or update security policies to cover all Intermediate control domains. Ensure policies are practical, enforceable, and aligned with the organisation's risk appetite.
4. Technical uplift - Implement technical controls identified in the gap assessment. Prioritise based on risk assessment findings. Common areas include network segmentation, EDR deployment, log centralisation, and privileged access management.
5. Supplier review - Identify critical suppliers and conduct initial security assessments. Establish a tiered approach to supplier risk management based on data access and service criticality.
6. Ongoing management - Establish recurring processes for access reviews, vulnerability scanning, risk register reviews, and policy updates. Use the MyCISO platform to automate task scheduling and evidence collection.

Frequently Asked Questions

Is MyCISO Intermediate a recognised standard?

No. It is a proprietary framework designed by MyCISO as a stepping stone between foundational practices and formal international standards. It is not certifiable but provides structured, measurable security improvement.

Can I skip Getting Started and go straight to Intermediate?

Yes. If your organisation already has basic security controls in place, you can start directly with Intermediate. The platform will assess your current state and identify gaps regardless of your starting point.

How does Intermediate compare to Essential Eight?

Essential Eight focuses on eight specific mitigation strategies. MyCISO Intermediate covers a broader range of security domains including governance, supplier risk, and business continuity that Essential Eight does not address.

What comes after Intermediate?

Organisations typically progress to a formal standard such as ISO 27001, NIST CSF, or SOC 2. The MyCISO platform supports seamless transition by mapping Intermediate controls to these standards.

Do I need a consultant for Intermediate?

Not necessarily. The framework and platform provide sufficient guidance for most organisations. However, some technical controls like network segmentation or EDR deployment may benefit from specialist input.

Why It Matters

• Organisations that have outgrown basic security practices but are not yet ready for full ISO 27001 or NIST CSF implementation need a structured middle ground. MyCISO Intermediate fills this gap by providing a comprehensive but manageable set of controls that deliver meaningful risk reduction.
• Customer and supplier due diligence questionnaires increasingly ask for evidence of structured security management. MyCISO Intermediate provides the governance, documentation, and evidence trail needed to respond confidently to these requests.
• The framework serves as a rehearsal for formal certification. Organisations that implement Intermediate controls find the transition to ISO 27001 or SOC 2 significantly smoother because the core practices, documentation habits, and evidence collection processes are already in place.

Common Challenges

• Attempting to implement all 50 controls simultaneously rather than prioritising based on risk
• Developing policies that are too detailed or theoretical to be practically followed by staff
• Underestimating the effort required for effective supplier risk management
• Neglecting to involve business stakeholders in risk assessment and treatment decisions
• Relying on manual evidence collection when platform automation is available
• Failing to conduct regular management reviews, which undermines governance effectiveness