Virtual CISO (vCISO)
A Chief Information Security Officer sets the strategy, owns the risk, and answers for security at board and client level. Plenty of organisations genuinely need that leadership but cannot justify a full-time hire, often a six-figure one. A virtual CISO gives you the same senior expertise on a flexible retainer, for a fraction of the cost.
YourvCISO
Your vCISOanswers toPriced per engagement, monthly retainer, cancel any time
At a glance
Strategy, owned for you
A named security lead who takes the time to understand your business, sets and owns your security strategy and roadmap, and puts practical policies and processes in place that people will actually follow.Risk and compliance, on track
The risks that actually matter to you identified, prioritised and tracked, and your Cyber Essentials, ISO 27001 and UK GDPR readiness steered month to month. Certificates are issued by accredited bodies; we get you ready.Answers for the people who ask
Clear, board-ready reporting in plain English, client security questionnaires and insurer requirements answered, and someone on call when clients, insurers or auditors start asking the hard questions.Security leadership, without the full-time hire.
You get an experienced security lead on call, someone who takes the time to understand your business, owns your security roadmap, and is there when clients, insurers or auditors start asking the hard questions. No permanent headcount, no recruitment, just the right expertise when you need it.
We start with a conversation about where you are and what you need, then agree a simple monthly arrangement that scales with your business, a few focused hours a month for most SMEs, more during a big project or audit. Retainers are priced per engagement, agreed up front. You get a named lead who builds real context over time, not a rotating team you have to re-brief every call.
Your vCISO works hand in hand with the rest of Secure Select. Many businesses begin with a free security check or an in-depth assessment, bring in vCISO oversight to steer the plan, use training to keep the team sharp, and, when it launches, SecureCore for the day-to-day protection underneath it. Strategy on top, technology beneath, one partner for all of it.
With a vCISO, you can:
- Have a named security lead who knows your business
- Get your strategy, risk register and policies owned for you
- Stay Cyber Essentials, ISO 27001 and UK GDPR ready
- Answer client questionnaires and insurer requirements with confidence
- Take board-ready reporting in plain English
- Scale the hours up or down, and cancel any time
What happens, step by step.
YourvCISO
Your vCISOanswers toEight workstreams, one lead.
Depending on where you are, that typically means:
- Set and own your security strategy and roadmap
- Identify, prioritise and track the risks that actually matter to you
- Put practical policies and processes in place, and keep them current
- Keep your rules for AI tools current as the tools change
- Steer your Cyber Essentials, ISO 27001 and UK GDPR readiness
- Prepare you for client security questionnaires and insurer requirements
- Give you clear, board-ready reporting in plain English
- Make sure you are ready to respond calmly if something does go wrong
- Keep an eye on the security of the suppliers and tools you rely on
Built for compliance-heavy sectors.
If you are a law firm, accountancy practice or clinic, your clients and regulators expect you to take security seriously, and increasingly ask you to prove it. A vCISO helps you meet UK GDPR, Cyber Essentials and ISO 27001 expectations, and turns “are you secure?” from an awkward question into a confident, evidenced yes.
Law firms
Client confidentiality, regulator expectations and increasingly detailed security questionnaires from the clients you act for.Accountancy practices
Financial data, HMRC and client portals, and insurers who now want evidence of controls before they renew.Clinics and practices
Patient records under UK GDPR, shared systems, and a duty of care that makes a calm, planned response to incidents essential.Any growing SME
You have outgrown ad hoc security but not reached the point of a full-time hire. A retained lead fills the gap without the headcount.A light-touch retainer, agreed up front.
What it costs
Priced per engagementmonthly retainer, cancel any timeA few focused hours a month for most SMEs.Scales with you: more hours during a big project or audit, fewer when things are steady. Cancel any time.
Included
- A named security lead who knows your business
- Strategy, risk register and policies owned for you
- Cyber Essentials, ISO 27001 and UK GDPR readiness
- Client questionnaires and insurer requirements answered
- Board-ready reporting in plain English
Not included
- Hands-on IT support or device management
- Certification body fees and formal audits
- Large projects, quoted separately when they arise
“Every engagement ends with something you can act on, in plain English, at the price we agreed before we started.”
Related services.
Managed detection and response
A specialist security operations partner watches your endpoints and Microsoft 365 around the clock, contains threats, and escalates to us. We set it up, read the reports with you and own the relationship.Priced per engagement · with a partnerManaged email and firewall security
The controls that stop most attacks before anyone sees them: email filtering, SPF, DKIM and DMARC enforcement, and a managed firewall with rules that are reviewed rather than forgotten.Priced per engagement · with a partnerBackup and recovery
Managed backup of servers, laptops and Microsoft 365 with regular restore tests, so a bad day is a bad day rather than the end of the business.Priced per engagement · with a partnerSecureCore
One on-premises appliance that watches your network, responds intelligently to threats in real time, and keeps your security data in your building. Ships preconfigured, then a short guided setup.In developmentCompliance Autopilot
A platform that connects to the systems you already run, scores your Cyber Essentials, ISO 27001, NIST CSF and CIS posture from real evidence, and produces the reports your clients, insurers and auditors ask for.In development
Tell us what you need. A person replies, usually the same day.
Or email [email protected].