Digital Partner Our take

What a digital partner should take off your plate in the first 90 days

The first three months decide whether a partnership works. What we take over in weeks one to twelve, in which order, and what you should expect to see.

3 minread 698words last updated

The short answer

The first ninety days of a partnership have one job: to move your digital side from “we hope it works” to “we know it works, and we know who is responsible”. That is done in a fixed order. Ownership and visibility first, risk removal second, improvement third. Partners who start with the exciting part, the improvements, tend to leave the foundation as they found it.

Here is what we take over, when, and what you should be able to see at each point.

Month one: ownership and visibility

  1. Inventory. Every domain, DNS zone, hosting account, repository, analytics property, form service, email tool and integration. The length of the list is the surprise.
  2. Ownership check. Whose name is on each account, written down per layer. Anything held by a party that will not commit in writing to transferring it on request gets a transfer plan, starting with the domain.
  3. Access and documentation. We get the access we need inside your accounts, you get a named account on the layers we manage, and one page follows: who holds what, where it lives, who can change it.
  4. Monitoring on. Uptime, forms, certificates, errors, Core Web Vitals. From now on we know before you do.
  5. Baseline measurements. Speed on mobile, security scan, accessibility quick check, Search Console state. This is what month three is measured against.

What you see: the one-page ownership document, the baseline report, and a short list of anything urgent.

Month two: removing risk

AreaWhat gets done
SecurityHeaders set, certificates automated, admin access reviewed, two-factor on, scan findings fixed by priority
Spam and formsHoneypot, rate limit and silent check on every form; server-side validation checked
UpdatesDependencies, plugins and platform brought current; a routine set for the future
BackupsConfirmed, and restored once to prove they work
SpeedThe worst pages on mobile fixed: images, scripts, layout shifts
EmailSPF, DKIM and DMARC in monitoring mode, reports flowing

What you see: the second scan next to the first, the first speed numbers next to the baseline, and the first monthly report.

Month three: improvement

With the foundation solid, the change budget goes to things visitors and staff notice: a landing page that converts better, a form that reaches the right person, an integration that removes retyping, the content updates that have been waiting for a year. Each one ships through a preview link you approve.

What you see: the first report with a trend rather than a snapshot, three improvements you can point to, and a plan for the next quarter that you helped set.

The ninety-day test

At the end of the third month, answer three questions:

  • Can I name three things that are measurably better than in month zero?
  • Is there one thing I used to worry about that I no longer think about?
  • If this partner disappeared tomorrow, would I know where everything is and could someone else take over?

Three yeses is a partnership. Anything less is a conversation.

What this means for you

If you are starting with a partner, ask for their ninety-day plan and check that ownership and monitoring come before improvements. If you are already with one, run the three-question test. It takes five minutes and tells you whether you are being looked after or just billed.

Written by the CivSec S.M.A.R.T team

We build and run websites, software and AI systems for businesses. We write about what we see in that work, in plain language, and we update articles when things change.

Last checked . Spotted something outdated? Tell us.

Frequently asked questions

Why does ownership come before improvements?

Because improvements on a platform you do not control are built on sand. If the domain, hosting or code are in someone else's name, that is the first risk to remove. It is also the least visible work, which is why partners who skip it look faster in month one and worse in month twelve.

What do you need from us in the first weeks?

Access, decisions and one contact. Access to the accounts that exist, so we can document and secure them. Decisions on what matters most to the business this quarter. One person who can answer questions within a day. Everything else we can find out ourselves.

Will our website be offline or changed during onboarding?

No. Onboarding is mostly reading, documenting and switching on protection that visitors do not see. Visible changes come in month three, and they go through preview links you approve first.

What if the first audit finds something serious?

We tell you the same day, in plain terms, with the risk and the fix. Serious findings jump the queue. A partnership that hides findings to keep the onboarding tidy is not a partnership.