What is a vCISO?

A virtual CISO (vCISO) is an experienced security leader who provides chief information security officer (CISO) duties to an organisation on a part-time, retained or contracted basis, rather than as a full-time employee. The vCISO owns the security strategy and its reporting, but is engaged for a fixed number of days or a set scope each month.

There is no single legal or standards-body definition of “vCISO”. The term describes a way of delivering the CISO role, so what you get depends on the scope that is agreed. That is why the first job in any engagement is to write down what the vCISO is, and is not, responsible for.

What a CISO does, and what the “virtual” part changes

In US federal guidance, NIST’s glossary treats the chief information security officer as a cross-reference to the Senior Agency Information Security Officer, the official responsible for carrying out the Chief Information Officer’s information security responsibilities under FISMA. That definition is specific to government, but it captures the core of the job: someone is accountable for how the organisation manages information security risk, and acts as the link between technical teams and the people who make business decisions.

A vCISO covers that same accountability without the full-time salary. In practice the work usually includes:

• Setting direction. Agreeing a security strategy and a prioritised roadmap that fits the client’s size, sector and appetite for risk.
• Governing risk. Keeping a risk register, deciding which risks to accept, treat or transfer, and making sure someone owns each decision.
• Owning policy. Maintaining the policies, standards and procedures that the organisation says it follows, and checking that it does.
• Preparing for audits and assessments. Mapping controls to frameworks such as ISO/IEC 27001, SOC 2 or the NIST Cybersecurity Framework, and collecting the evidence an assessor will ask for.
• Reporting to leadership. Translating technical findings into decisions a board or owner can make.
• Managing third-party risk and incidents. Reviewing suppliers, and making sure there is a tested plan for when something goes wrong.

What “virtual” changes is capacity and access. The vCISO is not in the building every day, so the work depends on a clear cadence, shared tooling and a named internal contact who can act between visits.

Why it matters

NIST’s Cybersecurity Framework (CSF) 2.0, released in February 2024, added a Govern function, and its announcement notes that the governance component emphasises that cybersecurity is a major source of enterprise risk that leaders should weigh alongside other factors such as finance and reputation.

The UK National Cyber Security Centre makes a similar point for boards. Its Cyber Security Toolkit for Boards says it helps boards ensure that cyber resilience and risk management are embedded throughout an organisation, including its people, systems, processes and technologies.

Some smaller organisations may carry that responsibility without being able to justify a full-time senior security hire. A vCISO is one way to close that gap: the organisation gets someone accountable for the programme, and leadership gets a regular, plain-language view of risk.

How an MSP or vCISO practice delivers it

For a managed service provider (MSP) or a dedicated vCISO practice, the role becomes a repeatable service rather than a series of one-off projects. A workable delivery model has five parts.

1. Scope and boundaries. Write down which frameworks are in scope, how many hours or days are included, what decisions the client retains, and what is excluded. This also sets expectations about liability, which our guide on scoping and contracting vCISO liability covers in more depth.
2. A baseline assessment. Start with a gap assessment against the chosen framework so the roadmap is built on evidence rather than assumptions.
3. A fixed cadence. Monthly or quarterly reviews of risks, actions and evidence keep the engagement from drifting into reactive firefighting. The first 90 days playbook lays out one way to sequence the opening weeks.
4. Evidence and reporting. Keep a single record of policies, risk decisions and evidence so each client can show what has been done. Reports should lead with decisions needed, not a list of findings.
5. Framework alignment. Pick one primary framework and map the rest to it to avoid duplicate work. For example, a client building toward the NIST Cybersecurity Framework can see how that work lines up with the NIST CSF compliance guide, and a client heading for certification can follow the equivalent ISO 27001 pathway.

The same pattern works whether the vCISO is a person inside an MSP, an independent consultant, or a team inside a managed security service provider.

Common mistakes

• Selling hours instead of outcomes. A retainer described only as “x hours a month” invites arguments about what was delivered. Tie the service to named outputs such as a risk register, a policy set and a quarterly board summary.
• Leaving ownership vague. If no one inside the client owns a risk or an action, the vCISO’s recommendations will stall. Name an internal owner for each item.
• Treating compliance as security. Passing an audit shows that controls were in place and evidenced for a defined scope and period. It does not prove the organisation is secure, and the service should say so plainly.
• Skipping the scope conversation. Unclear boundaries are the usual source of disputes, especially around incident response and who decides to accept a risk.
• Starting with the tool. Software helps with evidence and reporting, but the service still depends on judgement, a clear scope and a consistent cadence.
• Overpromising availability. A vCISO who is stretched across too many clients cannot respond when something happens. Decide how many engagements one person can serve well.

Where GetCybr fits

If you deliver vCISO services across several clients, GetCybr is a platform for running the repeatable parts of the work in one place: framework mappings, risk registers, policies, evidence and client reporting. It does not replace the judgement or accountability that the vCISO provides. You can see how the service model fits together on the vCISO services page.

Sources

• NIST, “NIST Releases Version 2.0 of Landmark Cybersecurity Framework”, 26 February 2024. Source for the newly added Govern function and the statement on enterprise risk.
• NIST Computer Security Resource Center, Glossary: chief information security officer. Cross-references Senior Agency Information Security Officer.
• UK National Cyber Security Centre, Cyber Security Toolkit for Boards. Source for the board responsibility statements quoted above.