Five Paths From Here to Day 180 and Beyond

By month six you will have tried a bit of everything. Some parts will have felt like chores. Others will have kept you up reading at night. That second group is a clue to your path.

1. ISO 27001 or ISO 42001 lead

You run a certified management system: scope, risk assessment, internal audit, management review, and the yearly audit cycle. ISO/IEC 42001 sets requirements for an AI management system and is certified on the same pattern of stage 1, stage 2 and yearly surveillance. If you like structure and seeing the whole system, this suits you. See the ISO 42001 guide.

2. Third-party risk

You assess suppliers before they get access, keep track of them while they have it, and respond when one of them has an incident. It mixes contracts, security questions and relationship work. Practise with the vendor risk scorecard and the third-party breach intake.

3. Privacy

You work on personal data: what is collected, why, where it goes and how long it stays. It sits close to legal. If you like rules applied to real people, this path is rich.

4. AI governance

You help the organisation adopt AI tools with clear owners, risk assessments and limits. It draws on risk management, privacy and supplier risk at once. It is new, so you will often be writing the first version of things.

5. PCI DSS

You protect card data in a specific, detailed standard. PCI DSS v4.0.1 is the current version; v4.0 was retired at the end of 2024. Scope reduction is a big part of the craft. Start with the PCI DSS guide.

Rule of thumb:Laws shape every path. In the EU, NIS2 puts cybersecurity risk management on top management's agenda, and DORA applies to many financial entities. Read the NIS2 guide if you work with EU organisations.

Whichever path you choose, the core stays the same: clear ownership, honest evidence and decisions on purpose.