90-day roadmap
A 90-day cyber security roadmap for your business
Turn security priorities into a manageable plan. This 90-day cyber security plan works through three stages: understand your current position, address the most important gaps, and record the evidence of what has changed.
Why 90 days
Why 90 days?
Ninety days gives your business a defined period to organise the work and review progress. Use the roadmap to establish priorities and responsibilities, adapting the pace to your systems, resources and any customer or certification requirements.
The three phases
The three phases
Days 1 to 30: visibility
Map your Microsoft 365 environment, devices, users and administrative accounts. Review security settings, backup coverage and the evidence customers or insurers have requested.
Days 31 to 60: hardening
Prioritise the highest-risk gaps. Review multi-factor authentication, administrative permissions, supported software, device protection and email security, planning changes around the people affected.
Days 61 to 90: evidence
Record the work completed and review the evidence, including relevant policies, logs and backup tests. Assess your Cyber Essentials readiness and give your leadership team a clear summary of progress and remaining actions.
The outcome
By day 90
The aim is a clearer view of your security, stronger controls and evidence you can use in business decisions. If Cyber Essentials is a goal, the plan should also identify the preparation still needed before independent assessment.
Report cross-promotion and proof
- Why It’s Now Commercial - how cyber resilience now affects contracts, insurance and customer confidence.
- The Microsoft-365 Gap - the common Microsoft 365 settings businesses miss, and the checks to make first.
- Frameworks Compared - when Cyber Essentials, Cyber Essentials Plus, ISO 27001, SOC 2 and NIST CSF matter.
- Monitoring & Evidence - what to record, review and keep ready before a customer or insurer asks.
- Zero Trust, Simply - how to reduce unnecessary access without slowing people down.
- The 90-Day Roadmap - a practical order of work: visibility, hardening, evidence and certification.
- The Self-Assessment - a 25-question cyber security check to run with your leadership team.
Client feedback
What our clients say
“I have been using INDIGO as our trusted IT partner for more than 20 years, both with my previous and current company. They are so good I had to take them with me! Recommended”
Mark Bosher · CAD/IT Manager, Watkins Payne
Making great IT personal and accessible
Meet Matt, Managing Director of INDIGO IT
Matt is passionate about technology and helping businesses to thrive with it. If your tech is in a tangle, he'd love to help you. Whether it's tricky tech, cyber security, or transforming your business's IT to achieve your goals, Matt can offer clear guidance, free from the technobabble.
Ready to make headway to exceptional IT? It all starts with an informal conversation!
Frequently asked questions
Using the 90-day cyber security roadmap
If yours isn't here, call us on 01491 693424.
Include a review of your systems and access, a prioritised list of improvements, and evidence of the work completed. Give each action an owner and a place in the schedule, with time to check progress and address any remaining gaps.
Yes, improvements can be planned around how your team works, with testing and clear instructions before changes are introduced. Reviewing permissions and sign-in settings with the affected team helps avoid unnecessary friction while strengthening protection.
Days 1 to 30 establish visibility of devices, accounts, settings and backups; days 31 to 60 focus on strengthening the controls that need attention. Days 61 to 90 bring the evidence together, review progress and identify the work still needed.
It supports preparation by making your systems visible, addressing technical gaps and gathering evidence. Readiness depends on your starting point and the work completed, so following the roadmap does not guarantee certification within the period.
You need an accurate view of your devices, users, settings and backups, plus help agreeing and carrying out the improvements. Your provider should explain responsibilities, keep a record of changes and help review the evidence at the end.