Global Food Manufacturer · Governance
An IPO-ready security program, one year early
A public offering sets a date you cannot move and invites three sets of outside reviewers who each want different proof. The security program had to satisfy all of them — and it was ready twelve months before it had to be.
- Organization
- Global food production and manufacturing company — $14B revenue, 50,000+ employees
- Role
- Director of Cybersecurity (Deputy CISO)
- Scope
- Enterprise governance, ISMS, control environment, audit readiness, executive and board reporting
- Outcome
- IPO-ready security program delivered one year ahead of schedule
The situation
A company preparing to go public acquires a set of reviewers it did not have before. External auditors want control design and operating effectiveness, evidenced. Cyber-insurance underwriters want to know what could actually cause a loss and what stops it. Regulators want documented governance with named owners. Each of them is satisfied by different artifacts, and none of them accepts “we do that” without evidence.
The starting position was that the enterprise security governance program did not exist in any form those reviewers would recognize. There was security work happening — capable people doing real things — but not a policy set, a control environment, a risk register, an evidence trail, or a reporting cadence that would survive a diligence process. Building that under a public-offering timeline is a different exercise from building it at leisure, because the deadline is external and immovable and the cost of missing it is measured in the transaction rather than in the security program.
What I did
Built the governance program as a product, not a paperwork exercise
The core decision was to treat governance as something with users. Policies were written to be followed by the people who actually do the work, not to be quoted in an audit response. Controls were defined against NIST CSF 2.0, ISO 27001, and CIS Controls so that one control set answered multiple external frameworks instead of maintaining a separate mapping for each audience.
That mattered enormously for pace. The alternative — one workstream for the auditors, one for the underwriters, one for regulators — is how these programs slip. A single control environment with a single evidence trail, cross-mapped to the frameworks each reviewer cares about, is the reason this landed early rather than late.
Made evidence a by-product of operating, not a project
Audit readiness fails when evidence is collected in a scramble before an assessment. The design goal was that running the program should generate its own proof: control ownership assigned to real people, KPIs and SLAs measured continuously, exceptions documented with expiry dates and accountable owners, and risk decisions recorded where they happen.
This is unglamorous and it is most of the work. It is also what converts a program that passes one audit into a program that stays passable.
Wrote the reporting for the people who would actually read it
Executive Cybersecurity Committee and board reporting was built on the same quantified risk model used to run the program day to day, so that what the board saw and what the team worked from were the same thing. When outside reviewers arrived, the executive narrative and the operational evidence did not have to be reconciled — they were already the same story at different resolutions.
Rebuilt third-party risk, because that is where diligence goes next
Supply-chain risk was rebuilt around tiered due diligence, continuous monitoring, contractual security requirements, and structured customer and partner assessments. In a diligence process this is one of the first areas probed, and an ad-hoc vendor questionnaire process does not survive the question “show me how you decided this vendor was acceptable.”
Outcome
- IPO-ready one year ahead of schedule — policies, control evidence, audit documentation, and executive reporting complete and defensible.
- Accepted by all three external audiences: auditors, cyber-insurance underwriters, and regulators.
- An ISMS and control environment operating against NIST CSF 2.0, ISO 27001, and CIS Controls, with defined KPIs and SLAs.
- Third-party and supply-chain risk rebuilt on tiered due diligence, continuous monitoring, and contractual requirements.
- A 12-person team across cyber risk, governance, architecture, and operations running it as business as usual.
What transfers
Any organization facing a hard external date — an IPO, an acquisition, a certification, a major customer’s diligence — is solving this same problem. The leverage is in refusing to build audience-specific programs. One control environment, cross-mapped, with evidence generated by operating it. Everything else is schedule risk.
Related
- Turning vulnerability counts into $46M of risk removed — the risk model underneath this reporting.
- Cutting security spend 27% without cutting coverage — done in the same period.
- Operating philosophy — why governance has to be usable to be real.