# 100-day cyber plan for private equity

Suggested planning sequence, not a Valty delivery commitment. Active incidents and urgent obligations may need immediate action.

Company: [name]
Critical service / scenario: [scope]
Budget approver: [name]
First-year budget cap and currency: [amount]
Chosen loss objective: [mean / P95 / other]

## Days 1–15: Agree scope and stabilize urgent issues

- Suggested owner: Company IT/security lead + operating partner. Replace with a name.
- Evidence: Critical services, open incidents, control exports, recovery records, existing obligations.
- Output: Named approver, first-year cap, evidence register, urgent action owners.
- Review: Day 15: confirm scope and unresolved evidence. Replace with a calendar date.
- Actual owner / date / cost / evidence links: [complete].

## Days 16–30: Validate the assumptions that could change the choice

- Suggested owner: Evidence owners + finance. Replace with a name.
- Evidence: Recovery tests, scoped cost quotes, outage cost basis, dependency and access coverage.
- Output: Source, collection date, coverage and confidence for each input.
- Review: Day 30: decide which options can be compared. Replace with a calendar date.
- Actual owner / date / cost / evidence links: [complete].

## Days 31–45: Choose fund, defer, or validate

- Suggested owner: Company budget approver. Replace with a name.
- Evidence: Alternatives, required spend, loss objective, cost horizon, sensitivity results.
- Output: Approved decision or evidence hold, named execution owner.
- Review: Day 45: record the decision and conditions. Replace with a calendar date.
- Actual owner / date / cost / evidence links: [complete].

## Days 46–75: Execute the approved scope

- Suggested owner: Company team or authorized provider. Replace with a name.
- Evidence: Approved change scope, test plan, execution records, rollback plan where relevant.
- Output: Completed work, exceptions, and fresh verification evidence.
- Review: Day 75: compare actual control state with intended change. Replace with a calendar date.
- Actual owner / date / cost / evidence links: [complete].

## Days 76–100: Review the result and the next funding cycle

- Suggested owner: Operating partner + company approver. Replace with a name.
- Evidence: Current validation, actual spend, residual gaps, revised model inputs.
- Output: Board update separating observed control change from modeled loss change.
- Review: Day 100: agree next review date and unresolved owners. Replace with a calendar date.
- Actual owner / date / cost / evidence links: [complete].

## Review discipline

Required actions use budget even when they receive no modeled loss-reduction credit. Name the source of each requirement. Hold unknown cost or effectiveness instead of treating it as zero. Keep actual spend, observed control change, and modeled financial change separate.

Use the IC memo to carry pre-close gaps forward: https://valty.ai/ic-memo-cyber-risk
Use the board template to record the funding decision: https://valty.ai/board-cyber-brief-template

Source: https://valty.ai
Free to adapt for your organization. Replace placeholders with reviewed, scoped evidence.