A realistic plan for the first three months: confirm scope, close the biggest gaps and build the evidence trail. Ninety days is enough to move from uncertainty to a defensible position if the work is prioritised and owned.
What this means in practice
A useful test is to ask who would act on this tomorrow morning and what they would need. If the answer is unclear, the gap is organisational rather than technical, and that is usually the cheaper one to close.
Key actions
- Days 1 to 30: scope, ownership and a gap assessment
- Days 31 to 60: reporting routine, supplier list and quick fixes
- Days 61 to 90: management approval, training and evidence pack
Next steps
After 90 days, move to a yearly cycle of review, test and improve. Keep the first version short. A one-page routine that people follow beats a long document nobody reads.