All services Virtual CISO
A seasoned security leader, without the full-time salary.
Your virtual CISO owns the security program: sets the plan, keeps it moving every month, and reports to leadership. Part-time, year round.
- Q1
- Risk assessment
- Security roadmap
- Policy set approved
- Q2
- Vendor reviews
- Incident response plan
- Board report
- Q3
- Tabletop exercise
- Audit preparation
- Board report
- Q4
- Staff training refresh
- Insurance renewal
- Next-year plan
Every month: check-in with your team, risk register update, progress report
What your vCISO owns
- Security programThe plan, the priorities and the pace.
- PoliciesWritten, approved and kept current.
- Risk registerEvery known risk, its owner and its next step.
- VendorsWho has access to what, and how they protect it.
- Compliance and auditsLaw 25, client questionnaires, insurer forms, audits.
- Awareness programTraining for staff and leadership, on a schedule.
- Incident readinessThe plan, the contacts, the rehearsal.
- ReportingPlain updates to leadership and the board.
Full-time CISO or virtual CISO?
- Senior executive salary and benefits
- Months to recruit and onboard
- Experience from the companies they worked at
- Part-time, sized to what you need
- Starts with an assessment and a plan
- Experience across many businesses and incidents
One risk register, kept current
The working document behind every decision: what the risk is, who owns it and what happens next.
- Score 20
R-03Wire fraud through a spoofed supplier email
L4 × I5MitigateOwner: CFONov 2026
Call the supplier back on a known number before any change to banking details.
- Score 15
R-01Only one backup copy, reachable from the office network
L3 × I5MitigateOwner: IT leadDec 2026
Add an offline copy and test a full restore every quarter.
- Score 12
R-07Former employees’ accounts still active
L3 × I4MitigateOwner: HR↓ from 16
Tie account removal to the HR departure checklist.
- Score 8
R-05Payroll provider contract has no breach-notice clause
L2 × I4TransferOwner: CFORenewal 2027-03
Require notice within 72 hours when the contract renews.
- Score 6
R-09Warehouse label-printer PC still runs Windows 7
L2 × I3AcceptSigned by CEO 2026-09-12
Isolated on its own network segment until it is replaced in 2027.
Score = likelihood (L) × impact (I), each rated 1 to 5. 15 and up is high, 8 to 14 medium, under 8 low.
How it works
- OnboardingWe meet your team, your systems and your obligations.
- First 90 daysAssessment, risk register and a prioritized roadmap.
- Every monthCheck-ins, progress on the roadmap, new risks handled.
- Every quarterA short report to leadership with decisions to make.
Who it’s for
- Growing businessesBig enough to need a security lead, not yet ready for a full-time one.
- Facing complianceLaw 25, client security questionnaires, an insurer or an audit.
- Changing fastGrowth, acquisitions, new offices or a move to the cloud.
- After an incidentRebuilding with a plan and someone accountable for it.
Examples on this page are illustrative.
Explore vCISO Services
Tell us what's going on. The expert who would lead the work replies within 1–2 business days, in English or French.