Virtual CISO
A head of security, without hiring one full-time.
A senior security lead joins your management team part-time. They set the plan, write the policies, manage risk, prepare your audits and tell the board where you stand, in plain language.
What is included
A named senior lead
One dedicated person who learns your business and stays with you. [CONFIRM: same person throughout the engagement]
A security plan tied to the business
What to fix first, what it costs and why, agreed with management.
Policies that fit how you work
Security policies, standards and procedures written for your company, not copied from a template.
Risk management that keeps going
A risk register that is reviewed and updated, aligned with ISO 27001, NIST CSF and ENS.
Audit preparation and coordination
From the readiness check and the evidence to the conversations with your external auditor.
Reports the board can act on
Technical risk turned into business impact, with clear priorities.
How it works
- 01
Meet your vCISO
Your lead learns the business, the team and what auditors, clients or regulators ask of you.
- 02
Set the plan
Together we agree the security strategy, policies and priorities for the year.
- 03
Run it
Your vCISO manages risk, follows the plan with your IT team and suppliers, and prepares the audits.
- 04
Report
Regular updates to management and the board: where you stand, what changed and what to decide next. [CONFIRM: reporting cadence, monthly or quarterly]
We have helped clients achieve ISO 27001 and ENS certification.
Works well with
How our services fit together
Governance and compliance
- Compliance and ISO 27001
From gap analysis to audit-ready, for ISO 27001, ENS and NIS2.
- Virtual CISOYou are here
A senior security lead for strategy, risk and your board, without a full-time hire.
A plan, an owner and the proof that auditors and clients ask for.
Questions about a virtual CISO
How much of their time do we get?
It depends on your size and goals. We agree a monthly number of days or hours before we start, and you can change it. [CONFIRM: engagement model, days per month]
Is a vCISO enough for ISO 27001 or ENS?
A vCISO leads the work and keeps it on track. Certification also needs your team's time and an independent auditor. We help you plan both.
Can the vCISO answer our clients' security questionnaires?
Yes. Answering client and supplier security questionnaires is part of the role. [CONFIRM: included in scope]
What happens if we have an incident?
Your vCISO coordinates the response with management and the technical teams. [CONFIRM: incident-response availability and terms]
Give your vCISO a head start.
The free Exposure Review shows what an attacker can already see about your company. It is a good first page for any security plan.