vCISO Workspace
The vCISO Workspace is where a fractional or in-house CISO runs the security programme end to end: a prioritised roadmap, where you stand against where you want to be, the management decisions that came out of it, and a monthly snapshot to hand to leadership.
Where to find it
Open Access & Risk → vCISO Workspace in the sidebar. It sits alongside CISO Reports and Risk Management in that group.
The workspace has five sections:
| Menu item | What it’s for |
|---|---|
| Roadmap | A prioritised list of remediation items pulled from ISO gaps, risks, audit findings and evidence gaps, grouped into Quick Wins, Structural and Advanced Maturity phases. Click Generate Roadmap to (re)build it; each item can be enriched with AI analysis. |
| Current State | Your security posture today, by domain — open risks, overdue items, evidence gaps and open decisions in one view. |
| Target State | The score you’re aiming for, by domain, so Current State has something to measure against. |
| Decisions | Management decisions tracked to a topic, decision text and due date — the page itself is titled Management Decisions. |
| Monthly Summary | A month-by-month snapshot: top overdue items, top risks, evidence gaps and open decisions, exportable as a PDF. Monthly snapshots also feed the time machine on the Security Operating Surface. Visible only to Owners and Managers (roles). |
Maturity gaps and roadmap labels
Maturity shows a gap only when the target is known. These states can appear:
- No assessment yet when you have not run a maturity assessment. Click Start assessment.
- No targets set for these domains when a domain has no target. No gap is shown for it.
- A partial result when only some domains have targets. The overall value shows “—” when it is missing.
The Roadmap shows readable labels for source and owner. An unknown source code shows as “Other: …”. An owner never appears as a raw ID. The maturity template guidance cites ISO 27001:2022 control IDs.
Monthly Summary is Owner/Manager only
Unlike the other four sections, Monthly Summary does not appear in the menu for Members, Contributors or Auditors — it’s scoped to the roles that run the security programme.
Get AI Options on a decision
On the Decisions page, opening a decision’s detail shows a Get AI Options button that generates an AI-Suggested Options list — possible resolutions with their advantages and considerations. This action is Owner/Manager only; other roles don’t see the button on this page.
Was this page helpful?