Introduction

This document provides a practical 90-day roadmap to start a compliance program covering cybersecurity, data protection and artificial intelligence. It is a template adaptable to SMEs, large organizations and public bodies. The approach is operational: clear priorities, assigned responsibilities and measurable deliverables.

Guiding principles

  • Risk-driven: focus effort on areas with the highest operational, reputational or legal impact.
  • Documentary evidence: each activity should produce evidence suitable to demonstrate compliance (reports, minutes, registers).
  • Executive buy-in: leadership should appoint a sponsor and approve resources and objectives.
  • Iterative and scalable: the roadmap is cyclical — after 90 days evaluate, extend and industrialize.

Key roles (recommended)

  • Executive Sponsor: approves budget and priorities.
  • Security Lead / CISO: technical and operational lead.
  • DPO (Data Protection Officer): privacy and DPIA interface.
  • Legal/Compliance: regulatory interpretation and contracts.
  • IT/Operations: technical implementation.
  • Procurement/Vendor Management: third-party oversight.
  • HR & Communications: training and internal change.

90-day roadmap: phases and activities

Days 0–30: Rapid assessment and action plan

Goal: understand the current state and set operational priorities.

Main activities:

  • Quick inventory of critical assets: systems, sensitive data, external services.
  • High-level mapping of data processing and check for a processing register.
  • Identification of critical suppliers and contracts that affect security/privacy.
  • Assessment of incident response capabilities: playbooks, notification channels, roles.
  • High-level gap analysis against GDPR, NIS2, AI Act, DORA and Cyber Resilience Act (identify high-risk areas).
  • Appoint sponsor and owners for each line of action.

Deliverables (within 30 days):

  • Executive summary of compliance posture with prioritized list (Top 5).
  • Essential asset & data inventory (concise document).
  • Detailed operational plan for the next 60 days with assigned resources.

Initial KPIs:

  • % of critical assets inventoried.
  • % of vendor contracts reviewed.
  • Estimated average remediation time for identified issues.

Days 31–60: Mitigation and operational strengthening

Goal: fix priority gaps with tactical interventions and consolidate essential controls.

Main activities:

  • Implement or strengthen baseline controls: patch management, network segmentation, verified backups, MFA for privileged access.
  • Start Data Protection Impact Assessments (DPIAs) for high-risk processing or critical AI projects.
  • Update or introduce vendor contracts with security clauses, audit rights and incident notification SLAs.
  • Conduct a tabletop incident response exercise with realistic scenarios (logistics and communications).
  • Adopt minimum policies and processes (incident response, data retention, access control).

Deliverables (within 60 days):

  • DPIA register started and initial DPIAs completed for priority processes.
  • Incident exercise report with action items and assigned owners.
  • Contractual updates applied to critical suppliers.

Intermediate KPIs:

  • % of critical controls implemented.
  • Estimated incident response time (before vs after exercise).
  • Number of DPIAs started/completed.

Days 61–90: Consolidation, verification and long-term planning

Goal: consolidate results, measure effectiveness and define a 12-month maturation plan.

Main activities:

  • Internal audit of implemented controls and closure of minor non-conformities.
  • Continuous monitoring: central logging, alerts and SOC responsibilities (in-house or outsourced).
  • Targeted training for key roles (IT, management, privacy) and awareness campaign for all staff.
  • Preparation of registers and internal notification flows for incidents/data breaches.
  • Plan a 12-month technical and compliance roadmap: hardening projects, resilience tests, vendor reviews.

Deliverables (within 90 days):

  • Final 90-day report with status of deliverables, KPIs and a detailed 12-month plan.
  • Scheduled technical roadmap (patching, pen testing, third-party assessments).
  • Register of collected compliance evidence.

90-day KPIs:

  • Estimated risk reduction on prioritized areas.
  • % of deliverables completed vs planned.
  • Completed training program for critical categories.

Quick regulatory checklist (what to verify immediately)

  • GDPR: processing register, DPIAs for high-risk activities, lawful bases, clear privacy notices, processes to handle data subject requests.
  • NIS2: risk management, incident handling plans, supplier oversight, incident reporting obligations (check national transposition requirements).
  • AI Act: inventory of AI systems classified as high-risk, risk assessments and lifecycle governance, transparency measures and mitigations.
  • DORA: ICT operational resilience for financial services and critical third parties; continuity plans, periodic testing and vendor controls.
  • Cyber Resilience Act: security requirements for products with digital components; vulnerability management processes and supplier/manufacturer responsibilities (check specific obligations for acquired products).

Note: verify national transposition for specific obligations and deadlines. This plan focuses on pragmatic and transferable measures.

Measuring success and communication

  • Weekly board updates: activity status, residual risks and budget requests.
  • Simple KPI dashboard: percent of activities completed, mean remediation time, number of open critical vulnerabilities.
  • Evidence package: tickets, DPIA reports, exercise minutes, copies of updated contracts.

Conclusion and next steps

A 90-day plan does not deliver full compliance but creates operational momentum and generates crucial evidence. At the end of the quarter deliver a realistic 12-month roadmap with budgets, technical milestones and maturity KPIs. Repeat the cycle every quarter to turn compliance into a managed, sustainable process.