Incident response planning
Define how your organization will prepare for and coordinate a security incident.
Services
Security program advisory
Organize security decisions, responsibilities, and priorities.
How an engagement runs
What we’ll cover
Discuss your business objectives and current security responsibilities.
Review policies, risks, and the information stakeholders need.
Agree on an advisory scope, meeting cadence, and concrete deliverables.
The work
What vCISO advisory covers
Security priorities and roadmap
Turning what you know about your risks, obligations and current controls into an agreed list of priorities and a plan your team and leadership can follow.
Policies and responsibilities
Reviewing and drafting security policies, clarifying who owns which decisions, and preparing for the questions customers, insurers and auditors ask.
Reporting to stakeholders
Preparing the information your leadership or board needs to make security decisions, in language that fits the audience.
Scope
A scope you can review
Your proposal defines the systems covered, deliverables, responsibilities, timeline, and fees. Work begins after the scope and required authorization are agreed. Any ongoing coverage or response commitments are specified in the service agreement.
- Systems covered
- Deliverables
- Responsibilities
- Timeline
- Fees
After the work
Useful next steps
The aim is to help your team understand the findings and decide what to address first. Remediation assistance and retesting can be discussed as part of the engagement.
Questions
Common questions
What is a vCISO?
A virtual chief information security officer (vCISO) is a part-time, outsourced security leader who helps an organization set security priorities, policies and reporting without hiring a full-time CISO.
How much does a vCISO cost?
It depends on the scope: how many hours or meetings each month, which deliverables (policies, risk assessments, board reporting, vendor reviews) and how long the arrangement runs. The scope, meeting cadence, deliverables and fees are set out in a written proposal.
Who is a vCISO a good fit for?
Organizations that need security leadership and accountability, for example to answer customer security questionnaires, prepare for an audit or plan a security programme, but are not ready to hire a full-time CISO.
Start a conversation
Your next step.Let’s make it clear.
Tell us about your environment and priorities. We’ll discuss the scope and outline the next steps.