A risk register your clients can read: a blueprint for Cybersecurity Advisory

You are the security leader for ten or twenty companies that could never hire one. For each you run an assessment against NIST CSF 2.0 or CIS Controls. You write the policy set, keep the risk register, and order the fixes into a remediation roadmap. Once a quarter you stand in front of a board and explain it in twenty minutes. Once a year you run a tabletop exercise and hope the plan holds. The method is yours. It lives in Word templates, a twelve-tab spreadsheet, and a custom GPT you loaded with your policies last spring.

This page is a blueprint for a Flow Playbook that carries that method. It is not built. AI Consulting is a Playbook that exists today, and its launch story is the walkthrough for every step below. This blueprint is yours to take. Build it from your own know-how, put your name on it, and launch it as your Playbook. If you do, I would like to hear about it.

The opportunity

Security spending keeps growing. Gartner expects worldwide spending on information security to reach $240 billion in 2026, up 12.5 percent. IBM puts the global average cost of a data breach at $4.99 million in 2026, a record. Verizon’s 2026 report found that 31 percent of breaches now start with an exploited software flaw. Ransomware is in 48 percent. In small and mid-size businesses, a third party is involved in 55 percent.

The work is moving to people like you. Cynomi’s 2025 survey found that 67 percent of MSPs and MSSPs now offer vCISO services, up from 21 percent a year earlier. The people to do the work are scarce. The Bureau of Labor Statistics expects jobs for information security analysts to grow 21 percent from 2025 to 2035, with about 14,100 openings a year. ISC2’s 2025 study found 95 percent of teams report a skills gap, and 59 percent call it critical or significant. A written method a client can follow is worth more each year.

The standards have moved toward governance. NIST CSF 2.0, released February 26, 2024, added a Govern function and now speaks to every organization, with quick-start guides for small businesses. Public companies must report a material incident to the SEC within four business days and describe their risk management in the annual report. And the custom GPT you loaded with your policy templates retires on December 11, 2026. A Playbook is plain files in your own GitHub. Nobody can retire it.

The signals

Each figure measures something narrower than it sounds. Surveys count who answered. Vendor research counts a vendor’s view. A market estimate is a model. Read them as a direction, not a forecast.

What your Playbook holds

The figure at the top of this page is the folder as it could sit on GitHub. Six Markdown files. Here is what each one does.

The README is the front page. It says who the Playbook is for, what a reader will have at the end, and the order to read the documents in. A stepped figure shows an assessment becoming a board report. An isometric figure maps the path.

Risk Assessment Method is the backbone. How you assess a client against NIST CSF 2.0 or CIS Controls, the questions you ask, and how a score is earned. A Workflow Path draws the engagement from intake to findings. A Scorecard holds the score per function. An intake form gathers a client’s first answers before you arrive.

Policy Set and Risk Register is the paper that outlives the engagement. Every policy a client needs, in your words, indexed by standard clause in a table. A Register Skill draws the risk register from the findings, each risk with an owner, a score and a treatment. An Approval Card lets the owner sign the policy set.

Remediation Roadmap and Board Report is the craft. How findings become an ordered plan by quarter, and how that plan becomes a report a director reads in ten minutes. A Roadmap Skill draws the plan. A chart shows the risk score by quarter. A Decision Brief shapes the one choice the board must make.

Incident Response Plan and Tabletop is what the client reaches for on the worst day. Who does what, the escalation flow drawn as a diagram, and when the four-business-day clock starts for a public company. A Guided Exercise turns your tabletop scenario into a form the client’s team works through. What you have not confirmed is marked, and Flow counts the marks.

Worked Example is an assessment, a register and a board report for a made-up dental group, filled in end to end, with the choices explained. One finished board report teaches more than ten rules.

What Flow does for this work

Chat answers from the Method, and says when it cannot. A client asks what MFA means for their email, or whether a vendor questionnaire needs a SOC 2 report. Chat searches the folder, answers from your pages, and links each fact to its file. When the folder does not say, Chat says so.

A Skill named Register draws the risk register. Select the findings of a finished assessment and run Register. It draws each risk, its owner and its treatment into one table and waits in Review Changes. A finding with no owner is named as missing, not guessed.

An Approval Card for the policy sign-off. The policy set ends in a checklist, one line per policy. The practice owner ticks each one, types their name and presses Sign off. Flow writes one signed record beside the document. When you revise a policy next year, the card asks for a new signature and keeps the old record.

A Job keeps the vulnerability section current. Bring CISA’s Known Exploited Vulnerabilities page in with New from Web Page and choose Follow the source. Each Jobs run reads the page again and redrafts the section at about its own length. On a night when nothing changed, it skips without calling a model.

Bring In All for the standard you assess against. When a page lists the pages of one standard, Flow offers Bring In All. It reads them one at a time into a new folder with a README in the author’s order. Your Method can then cite the clause, and Chat can quote it.

The import checklist for a client’s Word, Excel or PDF. A client sends old policies in Word and a Microsoft 365 security export in Excel. The Sources tab lists what to check before you rely on them, and Walk Through with Chat takes the open items one at a time.

Sources and Change Summary on the board report. A Sources element says what the report was made from and marks a source that changed since. A Change Summary says what changed lately, who changed it and on which day. A director who asks why the score moved finds the answer on the page.

How you build it in Flow

The AI Consulting story walks every one of these steps on a real screen. Follow it with your own material.

1. Add an empty folder and choose it. Chat answers from the folder before any document exists. The walkthrough shows it at an empty folder, and Chat already in it.
2. Ask Chat for the README. Describe who the Playbook is for and what you want a reader to have at the end. Chat writes it in your voice and marks every claim it cannot stand behind. See a front page, in the author’s voice.
3. Bring in what you already have. The assessment questionnaire in Word, the risk register spreadsheet, and the shared chats from your custom GPT. New from Web Page turns a page or a shared AI chat into a document with its links kept. See an old AI chat became a reference.
4. Let Ideas pick a Skill. Press Suggest on your Method document. Ideas reads the sections and names a Skill for each. A Workflow Path for the engagement, a Register for the findings. A figure or a form waits in Review Changes until you keep it.

5. Ask Chat for the next document with your own pages as sources. The Roadmap and Board Report can be written from your Method and two past board decks with the names removed. Repeat until the path is done. See the next document, from his own pages.
6. Review every change. When you merge two policies or rename the Register, every page that pointed at it follows. See Review changed the plan, and the source followed.

Apply it to a client job

A Playbook is for using, not only reading. A new client signs, a dental group with four offices. Open the Playbook, start a folder for them, and drop in their old policies and the security export as tables. Ask Chat to draft the assessment from the Method and the intake, and to mark every claim it is unsure about. Run Register on the findings and Roadmap on the remediation section. The Policy Set goes to the owner with an Approval Card. The Board Report is drafted from the roadmap. Before the quarter ends, the Incident Response Plan is theirs and the tabletop has been run once.

What you learn goes back into the Playbook. The question the owner asked twice becomes one of the README’s questions. The finding you had not seen becomes a row in the Method. A new hire can read the Method and the Policy Set on their first day and run their first assessment the way you would. That is the skills gap answered one person at a time.

Lanternfield Intake.mdRisk Assessment.mdRemediation Roadmap.mdRemediation Roadmap.mdPolicy Set.mdREADME.md Imported · 2 to check4 claims to check1 change to reviewKept, 0 openAwaiting signatureUpdate available

Lanternfield Dental

Lanternfield Intake

Proposed

Table

Imported · 2 to check

Lanternfield Dental

Risk Assessment

Proposed

Chart · Radar

4 claims to check

Lanternfield Dental

Remediation Roadmap

Proposed

Roadmap

1 change to review

Lanternfield Dental

Remediation Roadmap

Proposed

Register

Kept, 0 open

Lanternfield Dental

Policy Set

Proposed

Approval Card · Sign off

Sign off

Awaiting signature

Lanternfield Dental

README

Update · 1 document

vciso-method · 1 document

README.mdRisk Assessment Method.mdPolicy Set and Risk Register.mdRemediation Roadmap and Board Report.md

Update SelectedNot Now

Update available

01Start the client folder02Draft the risk assessment03Draw the roadmap04Draw the register and keep05Owner signs the policies06The client’s update arrives

Publish it, and keep it current

When the folder is ready, choose Publish and then GitHub Repository. Flow sends the files and nothing else. A reader brings the Playbook in with File, then New from GitHub, and the folder’s address. Check the repository’s visibility first. Your method can be public while every client’s assessment, register and incident plan stays in their own folder on your Mac.

When a rule changes and you publish again, every reader’s copy shows the update as a change they review. They keep their own edits. Nothing is replaced behind their back.

The same source can also become a GitHub Pages site, a PDF, an EPUB, or Word and Excel files for a client’s team. Chat on the Playbook, and the figures a reader steps through, stay in Flow.

What it costs

Bringing any Playbook into Flow is free on Base. Writing with Chat, and Chat on a Playbook, need Flow Pro at $10 a month. Publishing to GitHub needs the Publish add-on too, another $10 a month. There is no fee per Playbook, so publish one or twenty for the same price. Any AI you connect follows the terms of that service. Publishing does not bring clients on its own. It gives the clients you earn a living copy of your method.

Start here

Read the walkthrough once, end to end. Then add an empty folder in Flow, name it, and describe your assessment method to Chat in three sentences. Which standard you assess against, what a client has at the end, and what the board sees. The README it writes is the first document of your Playbook. If you want to talk it through first, the Playbooks page has one email address and four questions.