---
title: "What Is a Virtual CISO? Role, Duties & UK Costs"
description: "What a virtual CISO (vCISO) does day to day, when you need one, how it differs from a fractional CISO or a hire, and what it costs in the UK from £1,250/month."
canonical: https://www.isosecurity.co.uk/resources/what-is-a-virtual-ciso
updated: 2026-11-10
---

# What is a virtual CISO, and what does one actually do?

A virtual CISO is senior information security leadership bought part-time: an experienced external officer who owns governance, risk and compliance, and keeps your management system operating. You get the judgement without the salary, recruitment risk or idle capacity of a full-time hire.

## What is a virtual CISO, in short?

Most organisations reach a point where security decisions outgrow whoever inherited them, long before they justify a full-time Chief Information Security Officer. A virtual CISO fills that gap for an agreed number of days a month, with the seniority the decisions require.

The trigger is usually a customer questionnaire nobody can answer well, a tender, an insurer, a board question, or an ISMS that passed its audit and then quietly stopped. A breach is rarely the trigger.

## What does a virtual CISO cover?

- **Owning the ISMS programme:** one accountable coordinator for actions, deadlines and evidence.
- **Risk management:** maintaining the register with owners, reviewing after change or incident.
- **Policy and evidence discipline:** current, approved, versioned documents and records gathered as work happens.
- **Audit readiness:** internal audit coordination, [management review](/resources/iso-27001-management-review), and preparation for [surveillance](/resources/iso-27001-surveillance-audit) and recertification.
- **External answers:** customer security questionnaires and due diligence answered from maintained evidence.
- **Leadership reporting:** risk expressed in terms of contracts, operations and reputation.

## What does a virtual CISO not cover?

A vCISO does not run your IT, operate a security operations centre, replace your penetration testers, or act as your Data Protection Officer. The certification decision belongs to the independent body, always.

The role coordinates the specialists and makes sure responsibilities do not fall between suppliers. Providers selling a vCISO who also runs all your tooling are selling an operations contract under a strategy label, so price and judge it as such.

My [CISO services page](/virtual-ciso-services) sets out the boundaries in full.

## When do organisations bring in a virtual CISO?

- Certified to ISO 27001 with nobody internally owning the system.
- Selling to enterprise or public-sector customers whose diligence exceeds internal capacity.
- Growing past informal, IT-led security into board-level questions.
- Repeated findings, drifted documentation or a difficult surveillance audit ahead.

Related decisions are covered in my guides to [virtual vs fractional CISO](/resources/virtual-ciso-vs-fractional-ciso), [who should own your ISMS](/resources/who-should-own-your-isms) and [what a virtual CISO costs](/resources/iso-27001-cost-uk).

## Frequently asked questions about virtual CISOs

### What is a virtual CISO?

A virtual CISO (vCISO) is an experienced Chief Information Security Officer engaged externally and part-time. At ISO Security the work centres on owning and maintaining your Information Security Management System: risk, policy, evidence, internal audit, management review, and readiness for surveillance and recertification audits.

### What does a virtual CISO do day to day?

Keeps the management system running: reviews the risk register with owners, tracks actions and control effectiveness, keeps policies and evidence current, prepares management reviews, coordinates internal audit, answers customer security questionnaires from maintained evidence, prepares for external audits, and reports security risk to leadership in business terms. The work is governance; your IT and security tooling stay with your IT team or providers.

### How much does a virtual CISO cost in the UK?

Published UK retainers commonly run from around £2,000 to £7,000 a month for small and mid-sized organisations, with day rates of roughly £1,200 to £2,500. A full-time CISO costs £140,000 or more in salary alone, and ISO Security's fees start from £1,250 a month for maintaining an established ISMS (typically £2,400 to £3,600 a month where the vCISO leads the programme).

### Does a virtual CISO replace management responsibility?

Accountability for information security and for the ISMS remains with your top management, and it cannot be outsourced. A vCISO gives management the expertise, coordination and evidence to exercise that accountability properly, which is exactly what ISO 27001's leadership clause expects.

## Contact

Security decisions outgrowing the people making them? Arrange a readiness discussion: [contact ISO Security](/contact) or email info@isosecurity.co.uk.