What is a vCISO? Virtual and fractional CISOs explained

What does a vCISO do?

A vCISO does the same job as a full-time CISO in fewer hours. The work usually starts with an assessment and a plan, then moves to running the security programme. Typical tasks:

• Assessing where you stand: a risk assessment, or a gap assessment against a framework such as ISO 27001, SOC 2, NIS2 or DORA
• Writing a security strategy and a roadmap that leadership can fund
• Writing or updating security policies and standards
• Preparing for audits and certifications, and leading them
• Answering customer security questionnaires and due-diligence requests
• Assessing the suppliers and service providers that handle company data
• Planning incident response and running tabletop exercises
• Running staff awareness training
• Reporting cyber risk to the CEO and the board
• Hiring the first security staff, and handing over to a full-time CISO when the time comes

vCISO, fractional CISO and interim CISO

There is no standard definition, and providers use these terms differently. A common way to tell them apart:

• Virtual CISO (vCISO): a part-time CISO who works mostly remotely, on a monthly retainer or for a defined project
• Fractional CISO: often the same thing. Some providers use the term for a part-time CISO who is more embedded in the team, with regular days on site.
• Interim CISO: a stand-in who works full time or close to it for a set period, usually while the company hires a permanent CISO
• Full-time CISO: an employee who sits on the leadership team and does the job every day

Whatever the title, check the contract

The title tells you little. What matters is the scope of the work, the time you get each month and who is accountable for what. Write all three into the contract.

When does a company need a vCISO?

• Nobody owns security, or it sits with an IT manager or CTO who has other priorities
• A customer, investor or insurer asks for ISO 27001, SOC 2 or a completed security questionnaire
• A law such as NIS2 or DORA now applies to you, and your management needs someone to brief it and run the programme
• You need a CISO's judgement for a few days a month, not five days a week
• Your CISO has left and you need cover while you hire
• You had an incident and need to rebuild the security programme

Why companies use a vCISO

NIST's cybersecurity guidance for small businesses says it is common for businesses of all sizes to outsource their cybersecurity needs, and especially common for small businesses, which typically lack the expertise, resources or budget. It names virtual and fractional CISOs among the providers they use.

Hiring is hard as well. In the ISC2 2025 Cybersecurity Workforce Study of 16,029 security professionals, 59% reported critical or significant skills needs on their teams, up from 44% a year earlier. The most common reason was not being able to find people with the right skills (30%), just ahead of a lack of budget to hire (29%).

When a full-time CISO is the better choice

A vCISO is not always enough. Hire full time when:

• You run a large security team or a round-the-clock security operation that needs daily leadership
• Your regulator, or your own appetite for risk, calls for a dedicated and independent security function
• Security is part of what you sell, and customers and auditors want regular time with the person in charge
• You have outgrown the hours, and your vCISO spends most of the week on your company

Can a vCISO meet regulatory requirements?

Usually, as long as your company stays accountable. Few laws require the CISO title, and few say the person must be an employee:

• New York's cybersecurity regulation (23 NYCRR Part 500) lets the CISO of a covered financial company work for an affiliate or a third-party service provider. The company must keep responsibility for compliance, name a senior employee to direct and oversee the provider, and require the provider to keep a cybersecurity programme that meets the rule.
• The EU's NIS2 Directive does not mention a CISO. It makes management bodies approve and oversee cybersecurity risk-management measures, lets them be held liable for failures, and requires their members to follow training.
• DORA requires EU financial entities, other than microenterprises, to give the management and oversight of ICT risk to a control function with an appropriate level of independence. They may outsource the verification of compliance with its ICT risk rules to an outside firm, but they stay fully responsible for it.
• The US SEC's cybersecurity disclosure rules (Item 106 of Regulation S-K) ask listed companies whether they engage assessors, consultants, auditors or other third parties in their cyber risk processes, which management positions are responsible, and what expertise those people have.

Accountability stays with you

A vCISO can run the programme, but the company and its management remain responsible for it. Put a senior person in charge of the relationship, and make sure the vCISO's reports reach the board directly.

How a vCISO engagement works

Most engagements follow the same pattern:

• Discovery: interviews, a review of existing policies and systems, and a risk or gap assessment
• Roadmap: priorities for the coming year, agreed with leadership
• Ongoing work: a set number of days a month for the programme, meetings and reporting, with extra time for audits or incidents
• Handover: when you hire a full-time CISO, the vCISO briefs them and steps back

What to agree in writing

• How many days or hours a month you get, and for how long
• What happens when an incident happens outside those hours
• Which deliverables you expect, such as a risk register, a roadmap, policies and board reports
• Who owns the documents the vCISO writes
• How either side can end the arrangement, and how the handover works

How to choose a vCISO

• Look for experience in your sector and with the frameworks you need, such as ISO 27001, SOC 2, NIS2 or DORA
• Ask who will do the work. With a firm, ask for a named lead rather than a pool of consultants.
• Check the certifications they claim. CISSP from ISC2 needs at least five years of cumulative, full-time experience in two or more of its eight domains, and CISM from ISACA needs five years of experience across at least three of its four domains. CCISO from EC-Council is aimed at security executives.
• Ask for references from companies of your size, and for examples of the risk registers, roadmaps and board reports they write
• Ask how many other clients they have and how much time that leaves for you
• Check for conflicts of interest, for example if they also sell the products or services they might recommend
• Agree how and how often they will report to your board

How CISO Talents helps

At launch you can post a vCISO request through a guided brief: what you need, how many days a month and for how long. Verified vCISOs and vCISO practices see it with the reason it matched them and reply in the same format, so price, deliverables and timeline are easy to compare. A Verified Leader badge means our team reviewed the person's CISO, vCISO or head of security role, and every badge shows the date of the check.