vCISO services: security leadership without a full-time hire

• Security work happens, but no one owns the priorities or the order in which things get done.
• Leadership and the board receive technical updates they can't act on.
• Policies were written for a past audit and no longer match how the company works.
• Customer security reviews stall because no one can speak for the program.
• Tool purchases follow vendor pitches rather than a plan.

• Security roadmap, reviewed and updated with leadership on an agreed cadence
• Governance charter, meeting agendas, and decision and risk-acceptance logs
• A maintained policy set with version history
• Program metric definitions and periodic leadership reports
• Board-ready summaries when you need them

1. 01

   Discovery

   We learn your business, obligations, current program, and the people involved, and review any recent assessments.

2. 02

   Roadmap

   We agree on priorities and a sequenced plan with owners, and set up governance so decisions are recorded.

3. 03

   Recurring leadership

   We work with your team on a set cadence: running governance meetings, advancing roadmap items, and handling policy and customer-review needs.

4. 04

   Report and adjust

   We report progress and risk to leadership and adjust the roadmap as the business changes.

• NIST CSF 2.0, especially the Govern function, as the structure for program governance and reporting
• CIS Critical Security Controls v8.1 for prioritizing technical safeguards
• Control mapping to the frameworks you're held to, such as SOC 2, ISO/IEC 27001, the HIPAA Security Rule, PCI DSS, or CMMC

Source: NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0 (February 26, 2024)

Read the full guide: What a vCISO does, and when to hire a full-time CISO

• Organizational Context (GV.OC): understanding the mission, stakeholder expectations, and the legal, regulatory, and contractual requirements behind security decisions
• Risk Management Strategy (GV.RM): setting risk appetite and risk tolerance statements, and a standard way to rate and document risks
• Roles, Responsibilities, and Authorities (GV.RR): making accountability explicit and resourcing it
• Policy (GV.PO): establishing, communicating, and enforcing cybersecurity policy
• Oversight (GV.OV): using the results of risk management activities to adjust the strategy
• Cybersecurity Supply Chain Risk Management (GV.SC): managing risk from suppliers and other third parties

Source: NIST CSWP 29, The NIST Cybersecurity Framework (CSF) 2.0 (February 26, 2024)

• An executive sponsor who owns security risk decisions for the organization
• A primary point of contact on your team for day-to-day coordination
• A seat in the leadership meetings where security priorities and budget are discussed
• Internal or contracted staff to carry out the technical work the roadmap calls for

• Governance · 9 min readWhat a vCISO does, and when to hire a full-time CISOWhat a virtual or fractional CISO does, what stays with your leadership, and the signs it is time to hire a full-time CISO, framed by NIST CSF 2.0 Govern.
• Readiness · 10 min readIncident response plan guide: write it, then test itWhat an incident response plan should include, aligned to NIST SP 800-61 Rev. 3, and how to test it with a tabletop exercise before you ever need it.
• Governance · 8 min readHow to do a cybersecurity risk assessmentHow to do a cybersecurity risk assessment: the four NIST SP 800-30 steps, writing and ranking risks in a risk register, and a roadmap with named owners.