A vCISO is a part-time information security officer. They lead the implementation of your security management system, keep track of vulnerabilities and incidents, report to management and prepare the company for the certification audit. You do not need to hire a full-time specialist.
The scope is tailored to your company. Below is everything a vCISO can run; the contract lists the parts you need.
The vCISO designs and runs the security programme: objectives, plan, budget and responsibilities.
The foundation of the security management system under ISO 27001 and NIS2.
The vCISO tracks new vulnerabilities in the technologies your company uses and tells you what to do and by when.
Preparing the company for an incident and support when one happens.
One management system for several requirements at once, with evidence kept in one place.
Two areas every auditor and every regulation asks about.
Management is accountable for cybersecurity, so it needs to know the current state and the decisions waiting for it.
We work to the standards and regulations that the auditor or the supervisory authority checks.
We agree the goal, the scope and the monthly hours. Management gives the vCISO a mandate to act on behalf of the company.
In the first month we get to know the company, list the assets and check the gaps against the chosen requirements.
We draw up a prioritised action plan and a risk register. Management approves the plan and the budget.
A steady rhythm: meetings with the team, vulnerability alerts, reviews and a monthly report.
Internal audit, management review and support during the certification audit or an inspection.
A fixed number of hours per month, matched to the size of the company and the goal. Penetration tests, audits and out-of-hours incident support are quoted separately. We work in Guardiso, so documents, risks and evidence stay with your company after the engagement ends.
Under NIS2, management approves the security measures, oversees their implementation and is accountable for breaches. That accountability stays with management even when a provider does the work. The vCISO prepares, advises and runs the work. Management approves policies, risk acceptance and the budget, and your company submits incident reports.
A consultant usually delivers one project and leaves. A vCISO works with the company continuously, owns the plan and its delivery, and is the person the team and management turn to with security questions.
No. The IT team still runs the systems and applies fixes. The vCISO sets priorities and rules and checks that they are in place.
It depends on the size of the company, the number of systems and the goal. Implementation needs more hours than running the system later. We state the hours in the quote after a short survey.
The vCISO drafts the report and keeps track of the deadlines. Your company submits it. The vCISO’s mandate to contact the CSIRT and authorities is written into the contract and a management resolution.
From an up-to-date inventory of systems and software versions kept in Guardiso. New advisories are matched against that inventory, so you only hear about what you actually use.
Fill in a short scoping survey. We will prepare a quote with timing and delivery approach. Your data is protected by a confidentiality undertaking.
