vCISO Services (Virtual CISO)

What a vCISO does

A vCISO owns your security program: deciding what to protect first, writing the policies, answering to insurers, customers and regulators, and holding your IT and security providers to account. The role is about direction and evidence. A vCISO usually does not install tools or watch alerts; that is the job of your MSP and your managed security provider.

Typical vCISO deliverables:

• Risk assessment and roadmap. A written view of your biggest risks and a 12 to 24 month plan ranked by cost and impact. See cybersecurity risk assessment.
• Policies and plans. Information security policy, acceptable use, access control, vendor management, and an incident response plan that has been tested in a tabletop exercise.
• Questionnaires and audits. Completing customer security questionnaires, insurer applications and auditor evidence requests.
• Vendor oversight. Checking what your MSP, MDR provider and key SaaS vendors deliver against their contracts.
• Testing. Scoping and reviewing a yearly penetration test and tracking findings to closure.
• Reporting to leadership. Regular, plain-language updates to owners or the board.

vCISO, fractional CISO, CISO as a service and outsourced CISO all describe the same idea. "Fractional" usually signals a named senior person giving you a set number of hours; "CISO as a service" may mean a team behind one main contact. Ask who exactly will do the work.

When you need a vCISO

You need a vCISO when someone outside the company starts asking for written proof of your security program and nobody inside can produce it. The most common triggers:

• Cyber insurance. Applications now ask detailed control questions. Marsh lists twelve controls insurers look for, including incident response plans, privileged access management and logging and monitoring ³. Getting answers wrong is risky: in Travelers v. International Control Services, Travelers sought to rescind a $1 million policy, alleging the insured misstated its MFA coverage on the application ⁴. See cyber insurance requirements.
• Customer security questionnaires. Larger customers send long questionnaires before signing or renewing. Third parties were involved in 48% of breaches in Verizon's 2026 DBIR ⁵, so buyers are checking suppliers harder.
• FTC Safeguards Rule. Covered financial firms, including tax preparers, must designate a Qualified Individual to oversee the security program, and that person can be a service provider ⁶. The Qualified Individual must report in writing at least annually to the board or equivalent, though firms holding data on fewer than 5,000 consumers are exempt from that reporting duty ⁶. IRS Publication 4557 says tax preparers must create and enact security plans ⁷. See written information security plan.
• HIPAA. The Security Rule requires identifying a security official responsible for developing and implementing security policies ⁸. A vCISO can fill or support that role. See HIPAA compliance services.
• CMMC and NIST 800-171. Defense contractors that handle CUI must implement NIST SP 800-171 Rev 2 and keep a current score in SPRS; DoD says it will enforce 800-171 Rev 2 compliance while CMMC Phase 2 is suspended ⁹. See CMMC compliance services.
• NYDFS Part 500. The New York rule gives a CISO specific duties, such as approving any compensating control used in place of MFA ¹⁰. Ask counsel whether an outside vCISO can fill that role for your firm.

Confirm your own obligations with counsel or your assessor. A vCISO helps you meet a rule; your company stays responsible for it.

What a vCISO costs

Published provider guides put vCISO retainers at about $1,500 to $4,000 per month for companies with 1 to 50 employees, $3,000 to $7,000 for 50 to 200, and $5,000 to $12,000 for 200 to 500 ¹. Hourly advisory runs about $200 to $400 ¹.

Other guides land in the same zone. Consilien puts vCISO cost at $3,000 to $20,000 per month overall, with firms under 50 people at $1,500 to $4,000 ². ICG says $5,000 to $12,000 per month is typical for SMBs, with smaller firms closer to $2,000 to $4,000 ¹¹. No neutral survey of vCISO prices exists, so treat these as provider estimates.

What moves the price:

• Hours per month, and whether the vCISO joins leadership meetings or works mostly in the background.
• Compliance load. A CMMC or HIPAA program with audits and evidence collection takes far more hours than an insurance-driven program.
• Project work. Initial risk assessments and policy sets are sometimes priced as a separate first-phase project.
• Seniority. A former enterprise CISO costs more than a security analyst with a CISO title.

Compared with hiring. We do not have a sourced salary figure for a full-time CISO. For scale, the median information security analyst, a more junior role, earned $129,180 in May 2025 ¹², about $184,500 a year including benefits at the BLS 30% benefits share (our calculation) ¹³. Even the top of the published vCISO range for 50 to 500 staff, $12,000 a month, is $144,000 a year.

vCISO vs vCIO vs managed security

A vCISO is responsible for security risk and compliance, a vCIO for technology strategy and budget, and a managed security provider for operating the security tools day to day. Smaller firms often get partial versions of all three from one MSP, which is fine as long as each job has an owner.

• vCIO. Plans hardware refresh, software, cloud and IT budget. Some MSPs include a vCIO in managed IT plans.
• vCISO. Sets security priorities, writes policy, answers outside parties and checks that providers deliver.
• MDR or a SOC. Watches for attacks and responds, 24/7.

One caution: if your MSP also provides the vCISO, the person grading the program works for the company running it. That can still work for a small office, but get an independent penetration test or risk assessment at least once a year so someone outside is checking.

How to scope a vCISO engagement

Scope a vCISO engagement around the outcomes you need in the first year, then agree hours and reporting that match. A practical way to set it up:

1. Name the drivers. Insurer renewal date, customer questionnaires in hand, a HIPAA or Safeguards Rule obligation, or a CMMC level.
2. Define the first 90 days. Usually a risk assessment, a policy gap review and a prioritized roadmap.
3. Set ongoing duties. Monthly or quarterly leadership reports, questionnaire turnaround time, vendor reviews, tabletop exercises.
4. Agree hours and overflow. A monthly hour budget, what happens to unused hours, and the rate for extra work during an audit or incident.
5. Clarify authority. Who the vCISO reports to, whether they can direct your MSP, and whether they serve as your named Qualified Individual or security official.
6. Plan the exit. All policies, risk registers and evidence stay with you, in your systems.

Ask candidates for sample deliverables with client names removed, such as a redacted risk report or policy set. That shows more than a list of certifications.