In its first quarter, a security program at a software company with 20 to 200 engineers should deliver four things: a named owner, an inventory of repositories, services and accounts, a baseline for access and code review, and a short written plan for the next three quarters. Scanners and audits come later.
Why the first quarter is about visibility
Most small engineering organizations cannot answer basic questions. How many repositories exist? Which ones ship to production? Who can merge to main? Which third-party accounts hold customer data? Until those answers are written down, every later control is guesswork.
CISA's Cybersecurity Performance Goals start in the same place. The Identify group opens with asset inventory, then a single accountable cybersecurity leader, before it reaches vulnerability work. That order is a useful hint for how to spend ninety days. (The CISA page is marked as archived content that points to a newer version, so treat it as background and check the current list.)
The four deliverables
| Deliverable | What done looks like | Typical owner |
|---|---|---|
| Named owner | One person is accountable for security outcomes, even if part time | CTO or VP Engineering names them |
| Inventory | A list of repos, deployable services, cloud accounts, SaaS tools with data access | Platform or DevOps lead |
| Baseline | Multi-factor sign-in on core systems, protected main branches, review before merge | Engineering managers |
| Plan | One page covering quarters two to four, with owners | The named owner |
None of these needs new software. A spreadsheet is a fine first inventory if someone updates it on a schedule.
Steps for the quarter
- Week 1 to 2: name the owner. Write down who decides when security and delivery conflict. Without this the rest stalls.
- Week 2 to 6: build the inventory. Start from the source host and the cloud console, since both list what exists. Mark each item as customer facing, internal or unknown. Chase the unknowns.
- Week 4 to 8: set the access baseline. Turn on multi-factor sign-in for the identity provider, source host and cloud console. Remove accounts of people who have left. Check who holds admin rights.
- Week 6 to 10: protect the code path. Require pull requests and at least one review on production branches. GitHub documents settings such as required reviews and required status checks, and notes that by default these rules do not apply to repository admins unless you turn that on, so check who can bypass.
- Week 10 to 13: write the plan. Use what the inventory showed. Resist copying a generic roadmap.
Try it yourself
The inventory step has a software side: knowing which libraries each repository pulls in. This demo shows what a dependency inventory looks like once it exists. Click through a repository and look at how direct and indirect packages are listed.
Click through it at your own pace, or open it full screen.
What to leave out of quarter one
Skip penetration tests, formal framework mapping and large tool purchases. They are easier to scope after the inventory exists, and they tend to produce findings nobody has time to fix yet. If a customer demands one early, treat it as a separate project.
Safeguard can help with the inventory side: asset discovery and SBOM and dependency scanning are available, and there is a free scan if you want a first look at one repository.
Quick check
Do we need a full time security person in quarter one?
Not necessarily. CISA's goal is a named, accountable role, which can be a part of someone's job. What matters is that the decision rights are written down.
Is a spreadsheet really enough for the inventory?
Yes at the start, provided it has an owner and a review date. Replace it when keeping it current costs more than the tooling would.
Sources
- CISA Cybersecurity Performance Goals (archived page that points to a newer version)
- GitHub Docs: About protected branches
Last reviewed: 19 October 2026.
