A vCISO, or virtual chief information security officer, is an outside security leader who does the CISO’s job part time. They decide what your security program should cover, keep the policies and risk assessments current, and report to the owners on where you stand. Most organizations with 10 to several hundred staff need that work done but can’t justify a full-time executive for it.
Talk to an advisor
Ask about your own setup.
We ask what you’re trying to accomplish and tell you what we’d look at first. It costs nothing to talk, and no price comes up on this call.
What a vCISO does
- 01Sets security priorities based on your risks, your rules and your budget
- 02Writes and maintains security policies: acceptable use, access, retention, remote work and incident response
- 03Runs or oversees the yearly security risk assessment
- 04Answers security questionnaires from cyber insurers, clients and auditors
- 05Reports to the owners or board on the state of the program
- 06Leads the response when something goes wrong
The difference from your IT company is the point of view. IT keeps systems running. A vCISO decides what risk the organization accepts and checks that the controls match what you’ve told insurers, regulators and clients.
When the rules expect someone in charge of security
Two rules many smaller organizations answer to require a named person to own security, and cyber insurers ask the same question:
| Rule | What it requires | Can it be outsourced? |
|---|---|---|
| FTC Safeguards Rule (tax preparers, accountants, lenders, many financial firms) | A Qualified Individual who oversees the information security program and reports in writing at least once a year | Yes. The rule allows a service provider, as long as you keep responsibility and name a senior person to oversee them. |
| HIPAA Security Rule (healthcare practices and their business associates) | A designated security official responsible for the security policies and procedures | You assign the role. The rule doesn’t say who does the work behind it, so an outside advisor can carry much of it. |
| Cyber insurance applications | Who is responsible for security, plus current answers on MFA, backups and endpoint protection | Yes. What matters is that the answers are true. |
Signs you need a vCISO
- A client, insurer or auditor sent a security questionnaire and nobody knows who should answer it.
- Your policies came from a template and haven’t been opened since.
- You’ve grown past the point where the owner can keep track of who has access to what.
- You’ve had a security incident and realized nobody was in charge of the response.
How our vCISO work runs
For our clients, the security leadership work ties into what we already do. Each year there’s a security risk assessment and a template for any policy you’re missing, and we write the policies themselves. We fill out the security questionnaires cyber insurers send. The state of your security program shows up in your technology business reviews, held at the pace you choose, with reports available any time in your client portal. Chad Odom, our owner and an engineer, signs every new client’s compliance review.
A vCISO can’t promise you won’t be breached, and one who does is selling something else. What it gives you is a program someone owns, written down, tested and reported on.
If a security questionnaire is sitting in someone’s inbox, that’s a good reason to talk. Book a 15-minute call and we’ll tell you how we’d approach your program. See our cybersecurity services and compliance services.
Related reading
Frequently asked questions
What is the difference between a vCISO and a CISO?
A CISO is a full-time employee who leads security. A vCISO does the same job part time, as a service, usually for organizations that need the leadership but not a full-time executive.
Is a vCISO the same as a managed security service provider?
No. A managed security service provider runs security tools and watches alerts. A vCISO sets the program those tools serve: the policies, the risk decisions and the reporting. We do both, and they work best when the same team does them.
What is the difference between a vCISO and a vCIO?
A vCIO focuses on technology strategy: budgets, refresh plans, vendors and the IT roadmap. A vCISO focuses on security risk: policies, risk assessments, compliance evidence, incident planning and what to tell insurers and auditors. Many small organizations need both perspectives, and the work often overlaps in quarterly reviews.
Does the FTC Safeguards Rule require a CISO?
Not by that title. The rule requires a Qualified Individual to oversee your information security program, and that person can be an employee or someone at an outside service provider. If you use an outside provider, someone inside the firm still has to supervise them, and the program stays your responsibility.
Sources
Next step
Let us handle this for you.
Email sign-ins watched, fake email rejected, staff phishing tests and a security operations center.
- 15 minutes
Tell us which question brought you here and how your office runs.
We’ll tell you how it applies to you and what we’d look at first.
If we’re not the right fit, we’ll say so.
