A CISO, or chief information security officer, is the person in a large company who owns security: the strategy, the policies, the risk decisions, and answering to the board when something goes wrong. Most small businesses will never employ one and do not need to. A virtual CISO, usually shortened to vCISO, gives you the same function part-time, on a retainer, from outside the business. Here is what that looks like in practice.
What a vCISO is
A vCISO is a named, experienced security lead who works for you a set number of hours a month, usually remotely, and owns your security programme. The word to notice is owns. Plenty of firms have an IT provider who fixes things, and nobody who decides what should be fixed, in what order, and whether the firm is actually getting safer. The vCISO is that person. They are not a technician and they do not spend the hours resetting passwords. They spend them on decisions, priorities, policies, and being the person who answers when a client, an insurer or a regulator asks a hard question.
A typical month
For a firm of between five and fifty people, a light-touch retainer of a few hours a month usually covers the following.
- A review call. Thirty to sixty minutes on what has changed: new staff, new tools, new clients, anything that went wrong.
- A live risk register and roadmap. The three to five things to do next, in priority order, each with an owner and a date. Kept short enough that it actually gets done.
- One policy written or updated. Acceptable use, access control, incident response, supplier security, home working. Short, realistic, and written for the people who have to follow it.
- Compliance kept on track. Cyber Essentials renewal dates and evidence, UK GDPR obligations, and ISO 27001 readiness if the firm is heading that way.
- Client and insurer questions answered. The security questionnaire from a new client, or the cyber insurance renewal form, completed accurately rather than optimistically.
- A short written report. One or two pages you can put in front of a partner, a board, a client or an insurer.
- Being on call. Is this email genuine, a laptop has been stolen, a new starter needs setting up, a supplier has had a breach. Quick answers when they are needed.
When you need one, and when an assessment is enough
A one-off assessment is the right choice when you have not looked at security for a while and want to know where you stand, or when you have one concrete goal such as getting ready for Cyber Essentials. You get a report and a prioritised plan, and then you or your IT provider carry it out. It is cheaper, and for many small firms it is genuinely all that is needed for the next year or two.
A vCISO is the right choice when the plan needs someone to keep it moving month after month, when clients or insurers keep asking questions nobody in the firm can answer confidently, when you handle sensitive data such as legal, financial or health records and want a named person accountable for it, when you are pursuing ISO 27001 or another ongoing standard, or when you have an IT provider and nobody holding them to account on security specifically.
The honest test is this. If you cannot name who owns security in your business, and the truthful answer is you with no time to spare, that is the gap a vCISO fills. If you can name someone and the list of jobs is short, start with an assessment.
What it costs
Our vCISO service is priced per engagement, monthly retainer, cancel any time, for a few focused hours a month. Retained security leadership from larger consultancies is commonly priced at several times a light-touch SME retainer. For comparison, a one-off consultancy engagement with us is also priced per engagement, with a fixed quote agreed before any work begins.
What a vCISO is not
- Not an IT provider. A vCISO does not manage your Microsoft 365 tenant day to day or fix printers. They tell your IT provider what to change and check that it happened.
- Not a security operations centre. A few hours a month is not 24-hour monitoring of your network. If you need that, it is a separate service or a product.
- Not an incident response team on standby. In an incident a vCISO leads you through it, makes the decisions and brings in specialists, but they are not a forensic team.
- Not a certificate. A vCISO gets you ready for Cyber Essentials or ISO 27001. Certificates are issued by accredited certification bodies after their own assessment.
- Not a full-time employee. If you need someone in the building every day, you need to hire.
- Not a guarantee. Nobody can promise you will never be breached. A vCISO makes it less likely, and makes sure you can show what you did about it.
Questions to ask before you sign
Who exactly is the named person, and will it always be them. How many hours a month, and what happens if a month needs more. What is out of scope. What happens in an incident, and at what point does it cost extra. How do they report, and to whom. What is the notice period. A good vCISO will answer all six in writing before you pay anything.
