Skip to content

Managed vCISO

Managed vCISO

In short

A virtual CISO, or vCISO, is an experienced security leader engaged on a fractional basis rather than employed full time. The role covers security strategy, risk ownership, board and customer reporting, certification programmes and incident readiness. Organisations use a vCISO when they need senior security accountability before the headcount is justifiable.

The problem

Your customers want enterprise-grade governance. Your headcount plan does not have a CISO in it.

There is a stage where the security questions arriving from customers outgrow the person currently answering them. A senior engineer is spending a day a week on questionnaires. Nobody owns the risk register. The board asks about security once a quarter and gets a status update rather than a position.

Hiring solves it in theory. In practice a CISO is an expensive, slow and risky hire at this stage: the salary is significant, the search takes months, the average tenure across the profession is short, and a first-time CISO without a team behind them ends up doing the work rather than leading it.

A vCISO gives you the accountability without the headcount: a named person who owns the roadmap, sits in your governance meetings, signs the customer responses and reports to your board, with a delivery team behind them for the work that follows. The engagement scales up before an audit and down afterwards, which a permanent hire cannot.

Who this is for

  • Companies between roughly 50 and 1,000 people whose security questions have outgrown their engineering team.
  • Organisations that have lost a CISO and need continuity while they search, or instead of searching.
  • Businesses with a certification deadline and nobody senior to own the programme.
  • Regulated firms needing a named accountable individual for supervisory purposes.
  • Boards that have asked for security assurance and received a status update instead of a position.

Delivery

How the engagement actually runs

Sprints inside your engineering cycle, with findings arriving continuously rather than a report arriving at the end. Durations are elapsed time for a typical scope, and get re-scoped against your estate before anything is committed.

  1. 01First month

    Days 1-30: visibility

    Flash assessment to find the material risks, not all of them. Stop the bleeding: MFA coverage, exposed services, joiner-leaver process. Quick wins land in the first fortnight.

  2. 02Second month

    Days 31-60: governance

    Core policies drafted, risk register stood up and owned, the 12-month roadmap agreed with the board, and supplier risk reviewed for the top tier.

  3. 03Third month

    Days 61-90: programme

    Certification programme underway if in scope, incident response playbooks written and a tabletop exercise run, and the first board report delivered.

  4. 04Steady state

    Ongoing: assurance

    Monthly working rhythm, quarterly board reporting, continuous questionnaire and audit support, and the roadmap re-sequenced each quarter against what the business needs next.

Deliverables

What you actually receive

Artefacts your team owns and can maintain after the engagement, not a report that ages the moment it lands.

Deliverables for Managed vCISO, with what each one contains and when it lands
DeliverableWhat it containsWhen
Named vCISOA specific, named person with stated credentials who attends your meetings, owns the roadmap and signs the customer responses. Not a rotating pool.Day 1
Flash risk assessmentA rapid first-pass assessment of where the material exposure actually is, with the critical items separated from the noise.Days 1-30
12-month security roadmapSequenced, dated and costed, tied to commercial drivers - the deal that needs the certificate, the audit that is coming - rather than a generic maturity curve.Days 31-60
Core policy setInformation security policy, acceptable use, access control, incident response and supplier security, written to your operating model.Days 31-60
Board reporting packA recurring report the board can actually act on: posture, movement since last time, decisions needed and what they cost.Quarterly
Customer questionnaire responseSecurity questionnaires, due diligence packs and audit requests answered by us, so your engineers stay on product.Ongoing
Certification programme ownershipISO 27001, SOC 2 or Cyber Essentials run end to end, including auditor liaison.As scoped

Frameworks this touches

In this practice

The individual services

FAQ

Questions people actually ask

What does a vCISO actually do day to day?

A vCISO owns the security roadmap and the risk register, chairs or attends the governance forum, reports to the board, responds to customer security questionnaires and audits, leads certification programmes, and makes the judgement calls - whether a risk is accepted, whether a supplier is acceptable, whether a release should proceed. The delivery work sits with a team behind them, which is the difference between a vCISO and a part-time consultant.

How is a vCISO different from a security consultant?

A consultant is engaged to produce an output: an assessment, a policy set, a gap analysis. A vCISO holds an accountable role inside your organisation on an ongoing basis - they own the risk register, they sign the customer responses, they answer to your board, and they carry the decision. The distinction matters when a regulator or an enterprise customer asks who is responsible for security, because a consultant is not an answer to that question.

How much does a vCISO cost compared with hiring one?

A vCISO is engaged on a monthly retainer scaled to the days required, which is typically a fraction of a full-time senior salary once employer costs, recruitment fees and the delivery team behind the role are accounted for. Cloudgap publishes indicative figures only where they reflect delivered engagements, and those figures are being confirmed with the practice before publication rather than estimated here.

Can a vCISO satisfy a regulatory requirement for a named security officer?

Frequently yes, and it depends on the regime. Many frameworks and supervisory expectations require a named, accountable individual with appropriate authority and access to the board, and an appropriately senior vCISO with a defined mandate can fill that role. Some regimes require the individual to be an employee or an approved person. This needs checking against your specific obligation before the engagement is scoped.

What happens when we eventually hire a full-time CISO?

The handover is the point. A vCISO engagement should leave a documented risk register, a live roadmap, an operating policy set, a working governance forum and a certification position - which is what a first-time permanent CISO otherwise spends their first six months building. Cloudgap frequently supports the recruitment and then steps back to an advisory role during the transition.

Free tools

Answer it yourself first.

Nothing is gated. Each one shows you the answer before it asks you for anything, and every date and rate carries the source it came from.

Every tool we publish lives at cloudgap.ai/tools.

Start

Three ways in, depending on how close the deadline is.

Or just email a human: hello@cloudgap.ai

We reply within24 hours