Fractional CTO First 90 Days: A Technology Audit Checklist and Roadmap

Why the plan comes last, even though you want it first

Every owner wants the roadmap in week one, and every vendor is happy to sell one. A roadmap written before the inventory is a list of opinions with dates on it. It will confidently schedule the replacement of a system that turns out to be fine, and it will miss the expired certificate, the former employee's admin login and the contract that renews next month with a 90-day notice clause.

So the order runs from dull to interesting: find out what exists, secure the keys, prove you can recover, measure the gaps, and only then decide. The sequence below is the one Casey Kinnison follows as DataCram's fractional CTO, and you can use it without us. Casey builds custom software applications and does relational database management, so the code and the data get read, not just listed. A small company with rented software may finish in less time, and a company with a large custom system may need more. The hours you buy set the pace.

The sequence, step by step, with the reason for each

1. 1

   Days 1 to 15: write the inventory

   Every system, vendor, license, domain and piece of custom code, taken from invoices rather than memory. People forget software. Accounts payable does not. The checklist in the next section gives the columns.

2. 2

   Days 1 to 30: settle access and ownership

   Move every account into the company's name, with a company email as admin. Remove people who left. Put credentials in a company-owned password manager and turn on multifactor logins. This step costs little and closes the embarrassing holes first.

3. 3

   By day 30: restore a backup, on purpose

   Pick the system you could least survive losing. Restore it somewhere safe, time it and record what came back. Do this before any new purchase, since you are about to learn what your existing purchases are worth.

4. 4

   Days 30 to 50: grade against the six NIST functions

   Walk through Govern, Identify, Protect, Detect, Respond and Recover in plain terms. The result becomes a short list of gaps, each with a cost and a name beside it.

5. 5

   Days 50 to 60: check for rules that apply to you

   If you lend money, broker mortgages or prepare taxes, find out from counsel whether the FTC Safeguards Rule covers you. Other regulated fields have their own rules, and your attorney should name them.

6. 6

   Days 60 to 75: write the roadmap

   Now you can. Three lists: now, next, and not doing. Each line has an owner, a cost and a reason. The owner approves it, or says no in writing.

7. 7

   Days 60 to 90: make the first vendor decisions

   Keep, fix, replace or stop. Cancel the unused seats, renegotiate before the notice dates and order any needed fixes. Vendor scorecards go on the monthly page from here.

8. 8

   Days 75 to 90: publish the AI rules

   One page: which tools are approved, what data may go into them, and who reviews the output. Short enough that people read it.

The audit checklist, down to the columns

A technology audit does not require special software. It requires a spreadsheet and someone stubborn. Start with twelve months of card statements and invoices, then add what you find by asking around. The table lists what to capture and the question each item is meant to answer. A free website health check and site audit can fill in the public-facing part in minutes.

A backup nobody has restored is only a rumor

The reason for doing this so early is sitting in the Verizon 2026 Data Breach Investigations Report: 48% of breaches involve ransomware. That means the day your files are locked is a day you find out whether your backups were worth paying for. The same report says 31% of breaches start with software vulnerabilities, now ahead of stolen passwords as the top way in, which is why patching gets an owner on the list and not a hopeful mention.

Casey Kinnison worked as a trader, and a trader marks the book every day to the price the market will actually pay. Apply that here. Your backup is worth what came back at the last test. A green checkmark in a vendor's console is only the seller's quote.

• Check that the records still line up. Casey has designed the databases, so the test goes past whether the files came back: are orders still tied to customers, and invoices to jobs?
• Restore to somewhere harmless. Use a separate location so a failed test does not become the outage you were trying to prevent.
• Time it. A backup that takes four days to restore is a different business decision from one that takes an afternoon.
• Check the part people forget. The database may come back without the uploaded files, the settings or the license keys.
• Check whether an attacker could reach the backup. A copy reachable with the same admin password may be locked along with everything else.
• Write down the date and a name. Then put the next test on the calendar. One passing result expires quickly.

You will meet salespeople carrying a scarier number. IBM's Cost of a Data Breach 2026 puts the global average at $4.99 million, up 12%. Those figures mostly come from larger organizations, so that is not your number, and anyone waving it at a 30-person company is selling something. Your useful estimate is simpler: what does a week without your systems cost? If a website is part of the answer, our security and malware work has more detail.

Six NIST words and what each means on a Tuesday

The NIST Cybersecurity Framework 2.0 has six functions, and NIST publishes a free CSF 2.0 Small Business Quick Start Guide written for companies like yours. It is free, it is sober and it is not trying to sell you anything, which sets it apart from most material on this subject. The translations below are ours, not NIST's, and using the framework does not make a company secure. It shows you where you stand.

If you lend money or prepare taxes, read this one twice

Casey can help you prepare what counsel will ask for: the inventory, the access records, the restore test and a list of open risks. Whether any outside person, ours included, should be named to that role is a question for your attorney, and we will not answer it for you. Firms in financial services or insurance should raise it in the first week, not on day 50.

The roadmap, and the vendor decisions that will not wait for it

A roadmap for a small business fits on one page. Now: the things that could hurt you this quarter. Next: the things that would pay for themselves. Not doing: the things someone wants, with a reason written beside them. That third list is what makes it a plan. Say a 30-person plumbing company (made up) puts "rewrite the customer portal" under not doing, and spends a fraction of that on an integration that stops staff from typing the same address twice.

Many of those decisions end in a purchase. DataCram sells custom software, hosting and integrations at published prices. Budgeting for the seat itself is covered in the cost guide, with vendor figures labeled as such.

AI rules short enough that someone will read them

Staff are already using AI tools, approved or not. Banning them mostly produces quiet use on personal accounts. A one-page rule set gets better compliance, and it takes about an hour once the inventory exists. Here is what ours would cover, to be adjusted for your business and your counsel's advice.

• Approved tools. A short named list, on company accounts, with data-handling settings checked by someone.
• Data that stays out. Customer records, passwords, API keys, health or financial details and anything under a confidentiality agreement.
• Human review. Nothing written by AI goes to a customer or into production without a person who can explain it.
• Disclosure. If a customer is talking to an AI, say so. Kairos, our own chat and booking tool, tells visitors by default.
• Automation limits. What an agent may do by itself, and what needs a person's click. Workflow automation and AI agents both start with this question.
• An owner. One named person who reviews this page each quarter, because the tools will change.

On day 91 the work turns routine: the standing meeting, the monthly page, the next restore test and the now list getting shorter. The marketing equivalent is the same discipline on a different bill, and the fractional CMO section describes it. If you would like a hand with any of this, tell us where you are and a person will reply.