Cybersecurity Onboarding Timeline: What to Expect Week by Week

A basic managed security rollout for a small business commonly takes a few weeks, a penetration test usually runs several weeks from scoping to final report, and a compliance program such as SOC 2 or CMMC readiness often takes many months. The actual time depends less on the provider than on your environment, how fast you approve changes and how quickly you supply access and documents. This guide describes the typical stages and what to expect so you can plan around them.

Managed security or MDR onboarding

For a business with a few dozen devices and modern management tools, deployment can be quick. Older equipment, remote workers who rarely connect, or devices that cannot run the agent slow things down. Plan on a tuning period after deployment, because early alerts are often noisy until the provider learns what is normal for you.

Illustrative 6-week example for 40 devices

• Week 1: kickoff, contact list, access granted, inventory confirmed.
• Week 2: discovery scan, review of gaps such as devices without MFA or with outdated software.
• Weeks 3 and 4: phased deployment, starting with a pilot group of five or ten devices, then the rest.
• Week 5: tuning of alerts; first escalation test.
• Week 6: first report and 30-day review.

Penetration test timeline

1. Scoping (about one to two weeks): define targets, objectives, testing windows and rules of engagement; sign authorization.
2. Scheduling: reputable firms often book weeks ahead, so build lead time into any deadline from a customer or auditor.
3. Testing (often one to three weeks of active work): depends on scope.
4. Reporting (a week or more): draft report, review call, final report.
5. Remediation and retest: your team fixes findings; the tester verifies, often within a defined window.

If a customer needs a report by a specific date, start the process well before the deadline, because remediation takes time and a retest may be needed to show closure. See penetration testing cost.

Compliance readiness timelines

Frameworks differ, and so do starting points.

• SOC 2: a Type I report assesses control design at a point in time, while a Type II report assesses operating effectiveness over a review period, which commonly lasts several months. Preparation includes a gap assessment, policy writing, tooling and evidence collection before the audit window opens.
• HIPAA: there is no official certification. Compliance work includes a security risk analysis, policies, training and technical safeguards, and it is an ongoing obligation rather than a one-time project.
• PCI DSS: timeline depends on merchant level, scope and whether you use a self-assessment questionnaire or an on-site assessment by a Qualified Security Assessor.
• CMMC: timeline depends on the required level, existing NIST SP 800-171 implementation and assessment scheduling. Check the Department of Defense's CMMC resources for current rules and phase-in dates.

For more on obligations by sector, see compliance requirements by industry.

vCISO engagement timeline

A vCISO typically begins with a discovery and risk assessment in the first month, then delivers a roadmap, policies and a reporting schedule over the next few months. Expect recurring meetings thereafter. Agree up front on the first 90 days of deliverables.

What commonly delays projects

• Slow approvals for change windows or software installation
• Missing administrator access or unclear ownership of cloud accounts
• Unmanaged or personal devices that cannot be enrolled
• Legacy systems that cannot run modern tools
• Staff pushback on MFA or new procedures without communication
• Scope growth after kickoff
• Remediation work that requires budget approval

How to keep things on schedule

1. Prepare documents before kickoff; see documents needed.
2. Assign one internal owner with authority to approve decisions.
3. Communicate changes to employees before they happen, especially MFA and new software.
4. Use a pilot group to find problems early.
5. Track open items in a shared list with owners and dates.
6. Hold a short weekly status call during onboarding.

What good looks like at 30, 60 and 90 days

• 30 days: tools deployed on most systems, escalation contacts tested, first report delivered.
• 60 days: alert noise tuned, gaps list prioritized, training scheduled or completed.
• 90 days: regular reporting rhythm, agreed remediation roadmap in progress, decision on additional services.

If you are not seeing visible progress by these points, raise it in writing and review the contract's remedies.

Frequently asked questions

Can onboarding be done in a week?

Sometimes for very small environments with modern, centrally managed devices. Be cautious of promises that skip discovery or testing.

Will onboarding disrupt employees?

Some change is normal: MFA prompts, device restarts, new software. Announce changes in advance and offer short instructions.

When does billing start?

Ask whether billing begins at signature, at kickoff or after deployment. It is negotiable.

What if we miss a compliance deadline?

Talk to the customer, regulator or contract owner early. Documented progress and a remediation plan are often better received than silence.

Sources

• CISA — incident and baseline guidance
• AICPA — SOC 2 reporting
• U.S. Department of Defense CIO — CMMC program information
• PCI Security Standards Council — PCI DSS documentation