- Home
- vCISO services
Fractional security leadership
Virtual CISO (vCISO) services
Get an experienced security leader working with your management team, for the time you need. A vCISO owns your security strategy, keeps compliance on track and gives your board and customers a clear answer when they ask how you're protected.
- Engagement
- Monthly retainer, scaled to your needs
- Reporting
- Monthly to management, quarterly to the board
- Covers
- Strategy, risk, compliance, incidents, third parties
- Good fit for
- Organisations without a full-time CISO
What you get
Security leadership, without the full-time hire
- Security strategy and roadmapA prioritised 12-month plan tied to business goals and budget.
- Risk register and reportingClear board-level reporting on risk, progress and decisions needed.
- Policy frameworkA complete, proportionate set of security policies with owners.
- Compliance ownershipRunning your ISO 27001, ISO 42001 or privacy programme.
- Customer questionnairesAnswering security questionnaires and due-diligence requests.
- Third-party riskAssessing suppliers and setting contract security requirements.
- Incident readinessIncident response plans and tabletop exercises with your team.
- Business continuity and DRContinuity and disaster recovery plans that are tested, not shelved.
When it fits
Signs you need a vCISO
Customers are asking hard questions
Security questionnaires are piling up and nobody has the authority to answer them consistently.
Certification is on the roadmap
You need someone to own the ISO 27001 or ISO 42001 programme and keep it alive after the audit.
Security sits with IT by default
Your IT team keeps systems running but doesn't have the time or remit to set security strategy.
Investors or acquirers are looking
Due diligence goes faster when security governance, risks and decisions are documented.
FAQ
vCISO questions
What is a vCISO?
A virtual or fractional Chief Information Security Officer is an experienced security leader who works with you part-time. You get the strategy, oversight and accountability of a CISO for the time you actually need, without the cost of a full-time executive hire.
How much time does a vCISO spend with us?
It's agreed up front and adjusts as your needs change. Some clients need a few days a month for oversight and reporting; others need more while a certification or remediation programme is running.
Will the vCISO work with our IT provider?
Yes. Most clients have an internal IT team or a managed service provider. The vCISO sets direction, priorities and standards, and works with them on delivery and evidence.
Can a vCISO maintain our ISO 27001 certification?
Yes. Running internal audits, management reviews, risk reassessments and surveillance audit preparation is a common part of the role.
Need a security leader this quarter?
Tell us what's driving the need. We'll suggest the level of involvement that fits and what the first 90 days would cover.