vCISO: when a part-time CISO beats a full-time hire

Every organisation that holds customer data needs someone accountable for security. Not every organisation needs, or can attract, a full-time Chief Information Security Officer. Experienced CISOs are scarce and expensive in every market we work in, and a mid-size company can struggle to give one a full-time job worth doing. A virtual CISO (vCISO), a senior security leader engaged part-time, fills that gap. Here is when the model works, when it does not, and how to get value from it.

What a vCISO actually does

A vCISO does the leadership work of a CISO for a fraction of the time. That typically includes:

• Setting the security strategy and a prioritised roadmap tied to business risk.
• Owning the risk register and presenting security risk to the board in business terms.
• Writing and maintaining policies, standards and the incident response plan.
• Leading audits and certifications such as ISO/IEC 27001 or SOC 2, and acting as the contact for auditors and regulators.
• Answering customer security questionnaires and due diligence requests.
• Managing vendor risk and reviewing contracts for security terms.
• Overseeing managed security providers, such as a SOC, and holding them to account.
• Leading the response when an incident happens.

The engagement is usually a set number of days a month, with defined availability for incidents.

When a part-time CISO beats a full-time hire

• You need senior judgement, not daily hands-on operations. Most of a mid-size company's security work is done by IT staff or a managed provider; what is missing is direction.
• Customers or regulators are asking questions you cannot answer. Enterprise customers' security reviews and certification deadlines often trigger the first engagement.
• You are building the programme from scratch. A vCISO who has built programmes many times can establish policies, risk management and a roadmap faster than a new hire learning the role.
• Your budget does not stretch to a full-time executive plus the tools and services they will need. The vCISO model lets you spend on controls, not only on salary.
• You need cover. Interim leadership between hires, or during a transformation, is a natural fit.
• Your environment spans IT and operational technology, and you need specialist experience that is hard to hire for.

When you need a full-time CISO

A vCISO is not always the right answer. Hire full-time when security leadership is needed every day: a large or fast-growing security team to manage, a constant flow of security decisions in product engineering, a regulator that expects a dedicated, employed security officer, or a threat profile that demands continuous executive attention. Many regulated financial institutions fall into this category. A vCISO can still help by building the programme, then recruiting and handing over to the permanent hire.

How to choose a vCISO

• Look for experience leading programmes, not just technical depth. Ask what they built, what changed and how they measured it.
• Check relevant credentials, such as CISSP, CISM, CISA or ISO/IEC 27001 Lead Auditor, alongside practical experience in your sector.
• Confirm independence. A vCISO who also sells you products has a conflict; agree in advance how product recommendations will be handled.
• Agree availability in writing, including response times during an incident.
• Make sure they will work with your existing providers rather than replace them by default.

Making the engagement work

Give the vCISO real authority: a reporting line to the chief executive or the board, access to the information they need, and a named internal counterpart who carries out day-to-day actions. Agree a 90-day plan at the start, covering a risk assessment, the top risks, quick wins and a 12-month roadmap. Review progress quarterly against measures that matter: risks reduced, audit findings closed, incidents detected and contained, and customer questionnaires answered on time.

A good vCISO gives you a CISO's judgement and accountability without asking you to build a role your organisation cannot yet fill.

For most organisations with fewer than a few hundred staff, the question is not whether they need security leadership, but how much of it. A part-time CISO matched to the size of the risk is often the most responsible answer, and a stepping stone to a full-time role when the business is ready.