Do you have a security Challenge?

Cyber Security Advisory

Cyber Governance, Risk & Compliance

CMMC Readiness & Uplift

Essential Eight Readiness and Uplift

OT Security & Risk Assessments

Security Architecture

vCISO

Someone senior owns cyber. Just not five days a week.

Your board expects a named person accountable for security. Your regulator may too. But a full-time CISO costs more than many organisations of 50 to 500 people can justify, and is hard to keep busy until the program matures. A vCISO gives you that person, part-time, on a monthly retainer.

Book a 30-minute call

Who it's for

Usually one of three situations.

No security lead at all

Security sits with the IT manager or the CFO, alongside ten other jobs. It gets attention after an incident and drifts the rest of the time.

No security lead at all

Security sits with the IT manager or the CFO, alongside ten other jobs. It gets attention after an incident and drifts the rest of the time.

A capable team without a senior voice

You have engineers and analysts who do good work, but no one who can turn it into a board paper, push back on a vendor or settle a priority call.

A capable team without a senior voice

You have engineers and analysts who do good work, but no one who can turn it into a board paper, push back on a vendor or settle a priority call.

A gap between CISOs

Your CISO has left, the search will take months, and the audit committee meets in six weeks.

A gap between CISOs

Your CISO has left, the search will take months, and the audit committee meets in six weeks.

The role

Everything a CISO does, sized to what you need.

Board and committee reporting

A standing paper each quarter, with KRIs that mean something, and attendance when directors want to ask questions.

Board and committee reporting

A standing paper each quarter, with KRIs that mean something, and attendance when directors want to ask questions.

Governance cadence

Risk register reviews, policy approvals, exception decisions and a security steering group that actually meets.

Governance cadence

Risk register reviews, policy approvals, exception decisions and a security steering group that actually meets.

Regulatory and contract obligations

Tracking what CPS 234, the Essential Eight, ISO 27001 or a customer contract requires, and keeping evidence current.

Regulatory and contract obligations

Tracking what CPS 234, the Essential Eight, ISO 27001 or a customer contract requires, and keeping evidence current.

Program and supplier direction

Setting priorities, approving designs, vetting new suppliers, and holding providers and internal teams to what they committed to.

Program and supplier direction

Setting priorities, approving designs, vetting new suppliers, and holding providers and internal teams to what they committed to.

Team guidance

Mentoring the people doing the hands-on work, and helping you hire when it's time.

Team guidance

Mentoring the people doing the hands-on work, and helping you hire when it's time.

Incident leadership

A senior decision-maker when something goes wrong, working with your provider, insurer and lawyers.

Incident leadership

A senior decision-maker when something goes wrong, working with your provider, insurer and lawyers.

Rhythm

What a month can look like.

Between these points, your team has a direct line for questions that can't wait.

Week 1

Steering meeting

Review of open risks, exceptions and program status.

Decide

Week 1

Steering meeting

Review of open risks, exceptions and program status.

Decide

Week 2

Working time with your team

Design reviews, policy updates and supplier questions.

Guide

Week 2

Working time with your team

Design reviews, policy updates and supplier questions.

Guide

Week 3

Evidence and obligations check

Anything due to a regulator, customer or auditor is tracked here.

Check

Week 3

Evidence and obligations check

Anything due to a regulator, customer or auditor is tracked here.

Check

Week 4

Executive update

A short update to your executive team and, each quarter, the board paper.

Report

Week 4

Executive update

A short update to your executive team and, each quarter, the board paper.

Report

Getting started

From first call to first board paper.

01 Health Check or handover

If we don't know your environment, we start with a Cyber Health Check so the first months aren't spent discovering what's there. If a previous CISO left good records, we start from those.

Learn

01 Health Check or handover

If we don't know your environment, we start with a Cyber Health Check so the first months aren't spent discovering what's there. If a previous CISO left good records, we start from those.

Learn

02 Ninety-day plan

A short plan agreed with your executive sponsor: the risks to tackle first, the reporting format, and how decisions get made.

Plan

02 Ninety-day plan

A short plan agreed with your executive sponsor: the risks to tackle first, the reporting format, and how decisions get made.

Plan

03 Settle into the rhythm

A monthly cadence from then on. We review the scope every six months, and reduce it as your internal capability grows.

Run

03 Settle into the rhythm

A monthly cadence from then on. We review the scope every six months, and reduce it as your internal capability grows.

Run

What it isn't

A vCISO is not a managed service.

We lead, decide and report. We don't watch your alerts overnight or patch your servers. If you need a SOC or managed security provider, we'll help you choose one and then hold it to its contract. Your vCISO stays independent of every provider you use.

Questions