ONGOING COVERAGE
A security leader on your org chart, without the salary line.
What it is
Most organisations that need a CISO cannot justify hiring one. Our Virtual CISO puts a named security leader into your organisation on a fraction of the cost, owning the security program, the compliance obligations and the risk decisions that currently land on whoever has the most time.
Who it is for. Small and mid-sized organisations carrying real compliance obligations with no security leadership in house.
What is included
- A named security leader, not a rotating queue of consultants
- Ownership of the security program roadmap and the control environment
- Compliance obligation management across every framework in scope
- Risk decisions documented so they hold up when an auditor or a regulator asks
- Board and customer facing security reporting
- Scaled to your size and budget rather than a fixed retainer
What you end up with
Someone owns security. Clients tell us this is the difference between a program that survives an audit and a folder of policies nobody has read.
Not sure this is the right shape yet? Nearly everyone starts with an assessment and decides afterwards. Start within 90 days of the assessment and you take 25% off the first year of this engagement.
How pricing works
Engagements start at $3,000 per month. What moves the number above that is the size of your control environment, how many frameworks are in scope, and how much of the program you want us to hold outright rather than advise on. A full time CISO in this market costs well north of $200,000 before benefits, and most organisations carrying compliance obligations do not need one full time. Your figure is quoted on the call and fixed from that point.
- Your price is quoted on the free scoping call, not after we have started.
- Once quoted, it is fixed. No hourly billing and no change orders.
- Continue into a Virtual CISO or managed compliance engagement within 90 days and you take 25% off the first year of it.
Common questions
What does $3,000 per month actually get?
A named security leader owning your security program: the control environment, the compliance obligations, the risk decisions and the reporting that goes to your board and your customers. Not an advisory hour allocation, and not a rotating queue of consultants.
What moves the price above that?
Three things, in order of impact: how many frameworks are in scope, how large the control environment is, and how much of the program you want us to own outright rather than advise on. We tell you which of those is driving your number on the call, before you commit to anything.
Are we locked in?
No. It is billed monthly with no minimum term. A Virtual CISO you cannot leave is not a Virtual CISO, it is a contract.
Also available
Cybersecurity Assessment
Find out where you actually stand, in two to four weeks.
Managed Security Compliance
Stay compliant between audits, without hiring a team to do it.
Talk about a Virtual CISO engagement
Thirty minutes. Bring the framework, the deadline, and who is asking for it.