01 / Advise / vCISO
vCISO Services:A Credentialed CISO on Your Team
A CISO on your team, without the full-time hire.
A credentialed security executive who owns your program and answers for it.
What you get
- A named, credentialed CISO assigned to your account
- Ownership of security strategy, policy and priorities
- A regular rhythm of reviews, decisions and reporting
- A point of escalation when something goes wrong
- Policies that fit how you work. We draft, rewrite or update your security policies against the rules you answer to. You review and approve them, and they stay yours.
- A vendor risk program. A simple way to size up the companies you rely on, built or run for you. You keep the final say on contracts and risk decisions.
How it works
We start with a short discovery of your people, systems and obligations, agree on priorities for the first 90 days, then settle into a cadence you can plan around.
Where every engagement starts
Baseline assessment
Every vCISO engagement begins with a baseline security assessment, so the work that follows is aimed at what matters most.
Baseline your posture
We baseline your company’s security posture so everyone starts from the same facts.
Find the risk and the gaps
We identify the key risk areas and the basic policy gaps.
Benchmark against your peers
We compare your company with other organizations in your vertical.
Report to your leaders
We meet with business and technical leadership, present the baseline report, and agree on next steps.
What to expect
Your first 90 days
The aim is a clear picture of your risk, an actionable roadmap and visible value inside the first quarter.
Days 1 to 30
Discovery and trust
- Kickoff with your executive sponsor and key stakeholders
- Review of existing policies, prior assessments, architecture and tools
- Interviews with business and technical leaders on pain points and risk appetite
- Quick wins identified: high impact, low effort
- Communication cadence agreed
Days 31 to 60
Structure and roadmap
- Risk register built or refreshed and prioritized
- 12 to 18 month security roadmap tied to your business objectives
- Governance defined: meeting cadence, decision rights and metrics
- Support for early remediation and policy updates
Days 61 to 90
Operationalize
- Roadmap and risk posture presented to leadership
- Recurring reporting set up: monthly operational and quarterly executive
- Key metrics baselined
- Transition to the steady-state vCISO operating model
What you have at day 90
- A current-state summary and stakeholder map
- An initial risk register
- A prioritized security roadmap
- A governance and reporting cadence
- Your first formal executive briefing
Governance
Policies, standards and procedures written for how you really work, with defined roles, a control framework mapped to your obligations, and an owner and review date on every document.
Board and executive reporting
Risk presented in business terms, not tool output. Metrics show progress and trend, and your CISO answers the questions directors ask.
Security strategy
A multi-year roadmap that puts the right spend in the right order. We start from your business goals, not a product catalog, with technology chosen objectively and budget input you can take to finance.
Focus areas
Where your vCISO spends the time
Guidance in governance, risk, compliance, privacy, operations and development, on demand.
Business enablement
- Mergers and acquisitions
- Process development
- Trend analysis
- Business case development
- Audit coordination
Governance
- Business alignment
- Metrics and reporting
- Roadmap development
- Alignment with frameworks
Project delivery
- Security and privacy by design
- Design review
- Security control testing
- Certification and accreditation
Security architecture
- Attack surface reduction
- Application hardening
- Continuity planning
Security operations
- Program development
- Vulnerability management
- Threat intelligence
- Hardening guidelines
- Gap assessments
- Security automation
Incident management
- Response
- Communication planning
- Playbook writing
- Breach preparation
- Exercises
- Investigations
- Forensic evidence gathering
How the program fits together
From business reason to defensible evidence
Every vCISO program connects the reason you operate to proof an assessor can check.
- Business resilienceThe why
- Practice areasThe what
- Enterprise
- Operations
- Engineering
- Process
- GoalsThe target
- ProgramsThe how
- Asset management
- Controls management
- Change management
- Vulnerability management
- Incident management
- Service continuity
- Risk management
- Third-party management
- Training and awareness
- Situational awareness
- ControlsThe tactical how
- Administrative
- Physical
- Technical
- Preventative
- Detective
- Corrective
- Work productThe result
- Policies
- Procedures
- Configurations
- Evidence
- Metrics
- Cyber resilienceThe outcome
Meet your CISO
William Birchett, Founder and CEO
More than 20 years in IT across telecommunications, banking, manufacturing, healthcare, education and government. William holds CISSP, CISM, CISA, CDPSE, CEH, CHFI, CySA+ and Cyber AB Lead CCA, CCA and CCP credentials, and serves on the Secure Controls Framework Advisory Board. More about William.
Common questions
What does a vCISO do?
A vCISO provides the leadership a full-time CISO would: setting security strategy, owning policy and governance, reporting risk to executives and the board, guiding technology decisions, and leading when an incident occurs. You get that leadership part-time and at a size that fits your organization.
When does a company need a vCISO?
Typically when no one owns security at an executive level and customers, insurers, auditors or regulators begin asking for proof. Common triggers are a compliance deadline, a security questionnaire you cannot answer, rapid growth, or a recent incident.
What is the difference between a vCISO and a full-time CISO?
A full-time CISO is a dedicated employee, which makes sense once the program needs daily leadership and a large team. A vCISO provides senior leadership for a fixed share of time, usually at lower cost, and can also help you define the role if you decide to hire one later.
How much does a vCISO cost?
Generally, an experienced virtual CISO can range from $3,000 to $20,000 per month, with larger organizations spending more. Complex compliance audits may carry additional fees. The right figure depends on your size, obligations and how much leadership you need, so we scope it with you first.
“I love you guys... I sleep better at night now that I know you guys.”
Bring us the complicated part.
Talk with a credentialed CISO and an accountable team. Email [email protected] or call (877) 77-vCISO.