What is a virtual CISO, in short?
Most organisations reach a point where security decisions outgrow whoever inherited them, long before they justify a full-time Chief Information Security Officer. A virtual CISO fills that gap for an agreed number of days a month, with the seniority the decisions require.
The trigger is usually a customer questionnaire nobody can answer well, a tender, an insurer, a board question, or an ISMS that passed its audit and then quietly stopped. A breach is rarely the trigger.
What does a virtual CISO cover?
- Owning the ISMS programme: one accountable coordinator for actions, deadlines and evidence.
- Risk management: maintaining the register with owners, reviewing after change or incident.
- Policy and evidence discipline: current, approved, versioned documents and records gathered as work happens.
- Audit readiness: internal audit coordination, management review, and preparation for surveillance and recertification.
- External answers: customer security questionnaires and due diligence answered from maintained evidence.
- Leadership reporting: risk expressed in terms of contracts, operations and reputation.
What does a virtual CISO not cover?
A vCISO does not run your IT, operate a security operations centre, replace your penetration testers, or act as your Data Protection Officer. The certification decision belongs to the independent body, always.
The role coordinates the specialists and makes sure responsibilities do not fall between suppliers. Providers selling a vCISO who also runs all your tooling are selling an operations contract under a strategy label, so price and judge it as such.
My CISO services page sets out the boundaries in full.
When do organisations bring in a virtual CISO?
- Certified to ISO 27001 with nobody internally owning the system.
- Selling to enterprise or public-sector customers whose diligence exceeds internal capacity.
- Growing past informal, IT-led security into board-level questions.
- Repeated findings, drifted documentation or a difficult surveillance audit ahead.
Related decisions are covered in my guides to virtual vs fractional CISO, who should own your ISMS and what a virtual CISO costs.