vCISO Guide: When and How to Use a Virtual CISO

Many organisations need security leadership but cannot justify, find or keep a full-time CISO, and a virtual CISO (vCISO) arrangement only works when the scope, authority and accountability are designed deliberately. A vCISO is an experienced security leader who provides CISO-level direction part time or for a fixed period, usually under contract. Done well, it gives a smaller or fast-changing organisation a security strategy, a risk register the board understands and a credible answer to customers and regulators. Done badly, it becomes an expensive report that nobody owns. This guide covers when a vCISO fits, the engagement models, how to scope and contract the role, how to run the first months, how to measure it and when to hire full time. It is for executives deciding whether to engage one and for practitioners working in or alongside the role. For a new permanent CISO's first three months, see the CISO Guide: First 90 Days.

Key takeaways

A vCISO is a role, not a product. The same accountability for setting direction applies whether the person works five days a week or two days a month.
Accountability stays inside the organisation. The vCISO advises and leads; a named internal executive owns cyber risk decisions and signs them off.
Scope by outcome, not hours. Contract for deliverables such as a risk register, a roadmap and quarterly board reporting, with hours as a capacity measure.
Access and authority must be explicit. A vCISO who cannot attend leadership meetings, read audit findings or direct the security budget cannot do the job.
Plan the exit from day one. Every engagement should leave documentation, an internal owner for each control area and criteria for when a permanent CISO is needed.

What a vCISO is and is not

NIST SP 800-53 Rev. 5 control PM-2 calls for appointing a senior information security officer "with the mission and resources to coordinate, develop, implement, and maintain an organization-wide information security program", and its guidance notes that organisations may call this official the chief information security officer. The NICE Workforce Framework describes the Executive Cybersecurity Leadership work role as "Responsible for establishing vision and direction for an organization's cybersecurity operations". A vCISO fills that role on a fractional basis. It differs from neighbouring services:

Service	Main output	Decision role	Typical duration
vCISO (fractional)	Strategy, risk management, board reporting, programme leadership	Leads and recommends; internal executive approves	Ongoing, reviewed periodically
Interim CISO	Covers a vacancy, stabilises the function, helps hire the permanent CISO	Acts as CISO, often near full time	Fixed period
Security consultant or assessor	Assessment, gap analysis, audit readiness	Advises on a defined question	Project
MSSP or MDR provider	Monitoring, detection and response operations	Operates services under contract	Ongoing
Board adviser	Independent challenge to the board	Advises the board, no management role	Ongoing, light touch

A vCISO is not a substitute for security operations staff, and a security operations provider is not a vCISO. Many problems start when an MSSP's account manager is presented to the board as "our CISO". The test is simple: can the person set direction, challenge leadership, prioritise spending and report risk to the board in their own name? If not, the organisation has bought a service, not a security leader, and the board should be told so plainly.

When a vCISO fits

Growing company with first customer or investor scrutiny: security questionnaires, SOC 2 or ISO/IEC 27001 certification and due diligence create demand for leadership before there is budget for a full-time executive.
Regulated small or mid-size entity: NIS2, DORA or sector rules require management bodies to approve and oversee cyber risk measures; a vCISO can prepare that material and train the board.
Vacancy cover: an interim arrangement while a permanent CISO is recruited.
Post-incident rebuild: independent leadership to rebuild the programme after an incident, often alongside an incident response retainer.
Group subsidiaries: a group CISO uses fractional leaders for smaller entities that need local accountability.

A vCISO fits less well where the organisation runs large, complex security operations that need daily executive decisions, where the threat profile demands immediate leadership availability, or where regulation or a customer contract expects a named full-time security officer.

Engagement models

Model	How it works	Strengths	Watch for
Fractional retainer	Fixed days per month, standing meetings, defined deliverables	Continuity, builds organisational knowledge	Drift into ad hoc questions with no roadmap progress
Programme or project-based	Leads a defined programme, such as ISO/IEC 27001 certification or NIS2 readiness	Clear end state	Leadership gap when the project ends
Interim (near full time)	Acts as CISO during a vacancy	Full authority, fast stabilisation	Hard dependency on one person
Individual practitioner	Contracted directly with one experienced leader	Personal continuity and accountability	No cover for absence; check professional indemnity insurance
Firm-provided with a named lead	Delivered by a consultancy or service provider with a team behind the lead	Bench depth and specialist support	Rotating staff, conflicts with the firm's other products
Hybrid with internal lead	vCISO sets direction; an internal security manager runs day to day	Builds internal capability, easiest exit	Needs clear division of responsibilities

Pricing varies widely by market, scope and seniority, so compare proposals on deliverables, named people and access rather than headline day rates.

Scoping and contracting the role

The contract is where most vCISO engagements succeed or fail. Cover these points explicitly:

Accountable executive: name the internal executive who owns cyber risk and approves decisions. NIST CSF 2.0 GV.RR-01 expects organisational leadership to be "responsible and accountable for cybersecurity risk"; that cannot be outsourced.
Authority and access: attendance at leadership and risk committees, direct access to the board or audit committee, read access to audit reports, risk registers and incident records, and influence over the security budget. GV.RR-02 asks that roles, responsibilities and authorities are established, communicated, understood and enforced.
Deliverables and cadence: for example, an initial assessment, a risk register, a 12-month roadmap, policies, quarterly board reports and an annual exercise. The UK Cyber Governance Code of Practice asks boards for formal reporting at least quarterly (action E.2) and an incident plan exercised at least annually (action D.2).
Availability during incidents: response times, out-of-hours cover and who deputises. This is the clause most often missing.
Conflicts of interest: whether the vCISO or their firm may sell or recommend products and services to you, and how that is disclosed. Require vendor-neutral recommendations.
Data and access security: the vCISO is a third party with privileged information. Apply your third-party access standard: named accounts, MFA, least privilege, logging and prompt removal at the end. NIST SP 800-53 PS-7 (external personnel security) and SA-9 (external system services) apply. See the Third-Party Access Guide.
Liability and insurance: confirm the vCISO's professional indemnity cover, and whether your D&O policy or indemnity extends to them. A contractor is usually not an officer. See the CISO Personal Liability Guide.
Documentation ownership and exit: all work products belong to the organisation and live in its systems, with a handover plan and notice period.

For US public companies, Regulation S-K Item 106 asks registrants to describe which management positions are responsible for cyber risk, their relevant expertise and whether they report to the board, and whether the company engages assessors, consultants, auditors or other third parties. If a vCISO fills the role, the disclosure should describe the arrangement accurately. See the SEC Cybersecurity Disclosure Rules Guide.

Selecting a vCISO

Choose the person, not the brochure. In a firm-provided model, the named lead's experience matters more than the firm's logo, so make the named lead a contract term with approval rights over any substitution.

Criterion	What good evidence looks like	Red flag
Leadership experience	Has run a security programme with budget, staff and board reporting, not only assessments	Only audit or tooling experience
Sector and regulatory fit	Has worked under the regimes you face, such as NIS2, DORA, PCI DSS or SEC disclosure	Generic framework talk with no regulator experience
Board communication	Can show a redacted board report written in business terms	Reports are lists of technical findings
Incident experience	Has led or coordinated a real incident, including legal and communications	No incident role beyond tabletop exercises
Capacity	States how many concurrent clients they serve and how cover works	Vague about workload or absence cover
Independence	Discloses commercial relationships and resale arrangements	Proposal bundles the provider's own products
Handover discipline	Explains how previous engagements were handed to internal staff	Every past engagement simply continued

Useful questions at interview:

Prioritisation: "Given our size and sector, what would you expect to fix in the first 90 days, and what would you leave?"
Disagreement: "Tell us about a time a leadership team rejected your recommendation. What did you record, and what happened?"
Incident: "If we had a ransomware incident on a Saturday night, what would you do in the first two hours, and who would decide on notifications?"
Exit: "What would you leave behind so that we could run without you?"

Small organisations should weight hands-on breadth and handover discipline; larger organisations and group subsidiaries should weight regulatory experience and the ability to work within an existing group policy framework.

Responsibility split: vCISO and internal team

Activity	vCISO	Accountable executive	Internal security or IT lead	Board or committee
Security strategy and roadmap	Drafts and leads	Approves	Contributes	Endorses
Risk register and risk appetite	Maintains, recommends	Accepts risks	Supplies data	Sets appetite
Policies and standards	Drafts	Approves	Implements	Informed
Control operation	Oversees	Informed	Operates	Not involved
Incident response	Advises, may lead coordination	Decides, including notifications with legal	Responds	Informed, decides where material
Board reporting	Prepares and presents	Co-presents, owns	Supplies metrics	Challenges
Supplier security	Sets requirements	Approves exceptions	Runs assessments	Informed

Running the engagement: a phased approach

Weeks 1 to 4, orient: interview leadership, read audit findings and incident history, inventory critical systems and data, confirm regulatory and contractual obligations (GV.OC-03), and note quick wins such as MFA gaps on administrative and remote access.
Weeks 4 to 8, assess and baseline: assess against one framework, typically NIST CSF 2.0 or ISO/IEC 27001:2022, and produce a risk register with owners. Agree risk appetite with the accountable executive (GV.RM-01).
Weeks 8 to 12, plan: present a 12-month roadmap with costs and owners to leadership and the board; agree the reporting format and metrics.
Months 4 to 12, deliver: run the roadmap through the internal team and suppliers; update policies (GV.PO-01); set supplier security requirements in contracts (GV.SC-05); run an incident exercise.
Quarterly, review: report progress, risks and metrics to the board; adjust the roadmap (GV.OV-01 to GV.OV-03). Review whether the engagement scope still matches the need.
Exit or transition: hand over to a permanent CISO or internal lead with documented decisions, open risks and access removed. Test the handover by having the internal lead run one quarterly report alone.

If the engagement is not working, roll back to a simpler scope rather than ending abruptly: keep the risk register and board reporting running while the rest is re-planned.

Decision guidance: vCISO, interim or full-time CISO

Signal	Points to
Small security team, programme still being built, customer and audit demand rising	Fractional vCISO
CISO has left, recruitment under way, programme already exists	Interim CISO
Single defined goal such as certification readiness	Project-based vCISO or consultant
Security team large enough to need daily leadership, frequent incidents, or many regulators	Full-time CISO
Board lacks independent challenge but management has a CISO	Board adviser, not a vCISO

For small organisations, the main trade-off is depth versus continuity: one practitioner offers continuity, a firm offers cover. Larger organisations using a vCISO for a subsidiary should align it to the group's policies and reporting so the subsidiary does not drift.

Measuring whether it works

Roadmap delivery: percentage of roadmap milestones delivered on time each quarter.
Risk register health: percentage of high risks with a named owner and a dated treatment or acceptance.
Board reporting: number of formal board or committee cyber reports per year, against the quarterly expectation in the UK Code.
Exercise outcomes: number of incident exercises run and actions closed from them.
Internal capability: number of control areas with a named internal owner who could run them without the vCISO.
Assurance results: audit or certification findings open, and the trend across cycles.

See the Board Cyber Risk Reporting Guide and the Board Cyber Report Template.

Framework mapping

Topic	NIST CSF 2.0	NIST SP 800-53 Rev. 5	ISO/IEC 27001:2022	Other
Security leadership role	GV.RR-01, GV.RR-02	PM-2, PM-29	Clause 5.3; A.5.2	UK Code A.2, E.1
Resources for the programme	GV.RR-03	PM-1	Clause 7.1	UK Code B.3
vCISO as an external party	GV.SC-02, GV.SC-05	PS-7, SA-9	A.5.19, A.5.20	Reg S-K Item 106(b)(1)(ii)
Strategy and oversight	GV.OV-01 to GV.OV-03	PM-9	Clause 9.3	UK Code E.2, E.3
Management body roles (financial sector)	GV.RR-02	PM-29	A.5.4	DORA Art. 5(2)(c)

Common failure patterns

Outsourcing accountability. The board believes the vCISO "owns security" and no internal executive approves risk decisions, so nobody does.
Report without authority. The vCISO produces an assessment but has no access to leadership meetings or budget, so the roadmap stalls.
No incident availability. The contract covers two days a month and no out-of-hours response, and the first serious incident arrives on a weekend.
Undisclosed product interest. Recommendations lean towards the provider's own services without disclosure.
Standing privileged access. The vCISO keeps admin rights or shared credentials long after the engagement ends. Treat their access like any third party's.
No exit plan. Knowledge lives with one person and leaves with them.

Practitioner checklist

Name the internal executive accountable for cyber risk before engaging a vCISO.
Write deliverables, cadence and incident availability into the contract.
Grant attendance at leadership and board or committee meetings in writing.
Require disclosure of conflicts of interest and vendor-neutral recommendations.
Provision the vCISO through your third-party access process with named accounts, MFA and logging.
Confirm professional indemnity cover and how your indemnity and D&O policy treat the vCISO.
Keep all work products in the organisation's own systems.
Assign an internal owner for each control area and track internal capability.
Review scope quarterly and set criteria for moving to a full-time CISO.