# vCISO Workspace
URL: https://docs.autociso.io/product/posture/vciso-workspace/
Description: A guided security-programme home under Access & Risk — a roadmap of prioritised remediation items, current vs. target security state, tracked management decisions, and a monthly summary for Owners and Managers. Requires The Seed plan or higher.

The **vCISO Workspace** is where a fractional or in-house CISO runs the security programme end to end: a prioritised
roadmap, where you stand against where you want to be, the management decisions that came out of it, and a monthly
snapshot to hand to leadership.

**Note — Requires The Seed**

The vCISO Workspace requires **The Seed** plan or higher ([compare plans](https://docs.autociso.io/getting-started/plans-and-features/)). On the Free plan, the menu item is shown locked with the
tooltip **"Requires The Seed."**

## Where to find it

Open **Access & Risk → vCISO Workspace** in the sidebar. It sits alongside **CISO Reports** and [**Risk
Management**](https://docs.autociso.io/console/risk/workspace/) in that group.

The workspace has five sections:

| Menu item | What it's for |
|---|---|
| [**Roadmap**](https://docs.autociso.io/console/vciso/roadmap/) | A prioritised list of remediation items pulled from ISO gaps, risks, audit findings and evidence gaps, grouped into Quick Wins, Structural and Advanced Maturity phases. Click **Generate Roadmap** to (re)build it; each item can be enriched with AI analysis. |
| [**Current State**](https://docs.autociso.io/console/vciso/current-state/) | Your security posture today, by domain — open risks, overdue items, evidence gaps and open decisions in one view. |
| [**Target State**](https://docs.autociso.io/console/vciso/target-state/) | The score you're aiming for, by domain, so Current State has something to measure against. |
| [**Decisions**](https://docs.autociso.io/console/vciso/decisions/) | Management decisions tracked to a topic, decision text and due date — the page itself is titled **Management Decisions**. |
| [**Monthly Summary**](https://docs.autociso.io/console/vciso/monthly-summary/) | A month-by-month snapshot: top overdue items, top risks, evidence gaps and open decisions, exportable as a PDF. Monthly snapshots also feed the time machine on the [Security Operating Surface](https://docs.autociso.io/product/posture/security-surface/). Visible only to **Owners** and **Managers** ([roles](https://docs.autociso.io/getting-started/roles-and-permissions/)). |

## Maturity gaps and roadmap labels

Maturity shows a gap only when the target is known. These states can appear:

- **No assessment yet** when you have not run a maturity assessment. Click **Start assessment**.
- **No targets set for these domains** when a domain has no target. No gap is shown for it.
- A partial result when only some domains have targets. The overall value shows "—" when it is missing.

The **Roadmap** shows readable labels for source and owner. An unknown source code shows as "Other: …". An owner never appears as a raw ID. The maturity template guidance cites ISO 27001:2022 control IDs.

## Monthly Summary is Owner/Manager only

Unlike the other four sections, **Monthly Summary** does not appear in the menu for Members, Contributors or
Auditors — it's scoped to the roles that run the security programme.

## Get AI Options on a decision

On the **Decisions** page, opening a decision's detail shows a **Get AI Options** button that generates an
**AI-Suggested Options** list — possible resolutions with their advantages and considerations. This action is
**Owner/Manager only**; other roles don't see the button on this page.