Fully managed SaaS

• Name one person accountable for the programme. Not a committee — programmes with three owners have none.
• Name control owners per domain: access, change, backup, vendor, training. These are the people who will be asked for evidence.
• Agree who signs off a policy and who accepts a risk. Write both down before you need them.

Done whenEvery control set in scope has a named owner who knows they own it.

• Pick the framework you are actually being asked for. Adding a second later reuses this work; starting with two doubles the argument about scope.
• Run a gap analysis and accept that the first number will be low. It is a baseline, not a grade.
• Work the top ten gaps only. Breadth comes after the team believes the tool.

Done whenOne framework has a real coverage figure the owner recognises as true.

• Walk each owner through their own controls, not the whole platform. Fifteen minutes each beats one hour-long all-hands.
• Show them the evidence request queue and how to close an item.
• Set the expectation that evidence is filed when the work happens, not the week before an audit.

Done whenOwners are closing their own evidence requests without being chased.

• Put policy reviews, access recertification and risk assessment on the schedule with real dates.
• Agree a monthly half-hour where the owner reviews coverage and overdue items. Short and regular beats long and quarterly.
• Turn on notifications for expiring evidence, so the system chases instead of a person.

Done whenA month passes with no manual chasing and nothing falls overdue.

• Publish the trust page and put the link where sales can reach it.
• Give your assessor scoped read-only access rather than exporting a folder of screenshots.
• Generate the reports your auditor asks for and check they say what you expect before the audit, not during it.

Done whenA customer security questionnaire is answered with a link.

• Install it and let the overlap map itself against the evidence you already hold.
• Work only the delta. This is where the platform pays for itself, and the team will feel it.
• Review the control profile: comprehensive where it matters, lighter where it does not.

Done whenThe second framework reaches useful coverage in a fraction of the first one's effort.