Overview
Many US startups, mid-market firms and defense suppliers need senior security leadership but not a full-time CISO salary. Our vCISO joins leadership meetings remotely at times agreed around your time zone, owns the roadmap, helps the board understand cyber risk, including the governance topics public companies now describe in their annual 10-K, and speaks to customers, auditors and insurers.
Growing companies need security leadership long before they can justify a full-time Chief Information Security Officer. Customers ask hard questions, auditors want evidence, boards want assurance — and someone needs to set priorities.
Our vCISO service provides an experienced security leader for a defined number of days per month. Your vCISO assesses your current posture, builds a risk-based roadmap, owns security policies and governance, leads compliance programs such as SOC 2 and ISO 27001, answers customer security questionnaires and reports progress to leadership and the board.
Because the vCISO is backed by our offensive, SOC and GRC teams, strategy turns into execution quickly.
Compliance support for US organizations
- SOC 2 readiness and penetration testing evidence for your CPA firm
- HIPAA risk analysis and technical evaluation support for covered entities and business associates
- FTC Safeguards Rule and NYDFS Part 500 testing and vulnerability assessment schedules
- CMMC and NIST SP 800-171 gap assessments for defense contractors (we are not a C3PAO or RPO)
What's included
Our approach
- AssessCurrent-state review of people, process and technology.
- PrioritizeRisk-based roadmap with quick wins and milestones.
- GovernPolicies, ownership and security committee.
- ExecuteDrive projects with your teams and ours.
- ReportMonthly and quarterly progress and risk reporting.
What you receive
- Security maturity assessment
- 12-month security roadmap
- Policy framework
- Risk register
- Board-ready security reports
Standards & frameworks
- NIST CSF 2.0
- ISO/IEC 27001:2022
- CIS Controls v8
- SOC 2
- State privacy laws (CCPA/CPRA)
- FTC Safeguards Rule (16 CFR 314)
Frequently asked questions
How much time does a vCISO spend with us?
Engagements are typically a set number of days per month, adjusted to your stage and priorities.
Can the vCISO answer customer security questionnaires?
Yes. Supporting sales with questionnaires, calls and trust documentation is a common vCISO responsibility.
When should we hire a full-time CISO instead?
Usually when security needs daily executive attention or a large team to lead. A vCISO can help you define and hire that role.
Can you get us SOC 2 or CMMC certified?
We prepare you with gap assessments, control fixes, policies, testing and evidence. The SOC 2 report itself is issued by an independent CPA firm, and CMMC Level 2 certification assessments are performed by an authorized C3PAO. We are not a CPA firm, a C3PAO or an RPO. See our CMMC guide.
Do you quote in US dollars?
Yes. US proposals are fixed-price and quoted in USD, with scope, effort, deliverables and payment terms set out in writing before work starts. See our US pricing guide for published market ranges.