Skip to content

Managed vCISO

The vCISO programme

What this is

A vCISO programme is a retained engagement providing fractional security leadership on a recurring monthly basis. It typically combines a fixed allocation of leadership days with access to a delivery team, covering strategy, risk ownership, board reporting, customer assurance and certification work, and flexing up around audits or incidents.

The problem

Most people asking about a vCISO are really asking what a month looks like.

The concept is easy to understand and hard to buy, because the obvious questions are operational rather than conceptual. How many days. What happens between them. Who does the work the vCISO decides needs doing. What happens when there is an incident on a Sunday. Whether the days roll over. Whether it scales up for an audit and back down afterwards.

Those questions decide whether the model works for a given organisation, and they are rarely answered on a services page. So this page answers them.

The short version: leadership is a named individual on a fixed monthly allocation, delivery sits with a team drawn on as the roadmap requires, incident response is covered outside the allocation, and the engagement is expected to flex - a certification quarter looks different from a steady quarter, and a retainer that cannot flex is a worse fit than a hire.

Who this is for

  • Organisations comparing a vCISO retainer against a permanent hire and needing the operational detail.
  • Finance and procurement teams who need to know what is fixed, what is variable and what is excluded.
  • Companies with a certification programme that will need more capacity for two quarters and less afterwards.
  • Firms that have used a fractional model before and found it was advice without delivery.

Delivery

How the engagement actually runs

Sprints inside your engineering cycle, with findings arriving continuously rather than a report arriving at the end. Durations are elapsed time for a typical scope, and get re-scoped against your estate before anything is committed.

  1. 01Month 1

    Days 1-30

    Flash assessment, the material risks identified and the obvious exposures closed. First quick wins land inside the first fortnight.

  2. 02Month 2

    Days 31-60

    Risk register owned, core policies drafted, roadmap agreed with the executive and taken to the board with a costed ask.

  3. 03Month 3

    Days 61-90

    Certification programme underway if in scope, incident playbooks written and rehearsed, first board report delivered.

  4. 04Ongoing

    Steady state

    Monthly working rhythm, quarterly reporting and re-scoping, continuous customer assurance cover.

Deliverables

What you actually receive

Artefacts your team owns and can maintain after the engagement, not a report that ages the moment it lands.

Deliverables for The vCISO programme, with what each one contains and when it lands
DeliverableWhat it containsWhen
Named leadership allocationA fixed number of days per month from a named individual, scheduled rather than on demand, so the time is protected against your own urgent work.Monthly
Delivery capacityEngineers and analysts drawn on as the roadmap requires, scoped per tranche so cost is predictable rather than open-ended.As scoped
Governance rhythmA monthly working session, a quarterly board report and an annual roadmap reset. The cadence is what makes the model work.Monthly and quarterly
Customer assurance coverSecurity questionnaires, due diligence and audit requests handled inside the retainer up to an agreed volume.Ongoing
Incident coverLeadership of an incident is covered outside the standard allocation, because an incident that eats the month's days leaves the roadmap unmoved.On occurrence
Quarterly re-scopeAllocation reviewed each quarter against what is actually coming, so a certification quarter is resourced and a quiet one is not overpaid for.Quarterly

Frameworks this touches

FAQ

Questions people actually ask

How many days a month does a vCISO programme include?

Two to four leadership days a month is typical for an organisation of 50 to 250 people in steady state, rising during a certification programme or after an incident. The allocation is scheduled rather than on-call, because unscheduled time is the first thing to be consumed by other people's urgency. Delivery work sits outside the leadership allocation and is scoped per tranche.

What happens if there is an incident?

Incident leadership sits outside the standard monthly allocation. The reason is practical: an incident consuming the month's days leaves the roadmap unmoved and the organisation paying twice for the same time. The engagement covers declaring, leading and communicating the incident, including regulatory notification timelines, with forensic capability brought in under a separate retainer where required.

Can the retainer scale up and back down?

Yes, and it should - it is the main structural advantage over a permanent hire. A quarter containing a Stage 2 audit needs materially more capacity than a quarter that does not. The allocation is reviewed quarterly against what is actually coming. A fractional arrangement that cannot flex has taken on the fixed cost of a hire without the benefits of one.

Is this advice, or does someone actually do the work?

Both, and the distinction is the point. The vCISO holds the accountable role - owns the risk register, sets the roadmap, reports to the board, signs the customer responses. A delivery team behind them does the implementation the roadmap calls for. A fractional arrangement that produces recommendations and leaves your engineers to implement them is a consultant, and it is a different thing being bought.

More in Managed vCISO

Start

Three ways in, depending on how close the deadline is.

Or just email a human: hello@cloudgap.ai

We reply within24 hours