vCISO.com

What is a virtual CISO (vCISO)?

A virtual CISO is a senior security leader engaged on a fractional basis instead of full-time. The role covers what a full-time Chief Information Security Officer would: security strategy, compliance program ownership, policy authoring, vendor risk, board reporting, and incident response leadership. The difference is the contract: a vCISO is a retainer or fractional engagement, typically month-to-month, sized to the company that hires them.

How is a vCISO different from a full-time CISO?

A full-time CISO costs $250K to $400K loaded in base salary, equity, and benefits, takes 3 to 6 months to recruit, and is overqualified for most companies under 250 employees. A vCISO covers the same scope at a fraction of the cost, starts in 2 to 4 weeks, and scales up or down as the company grows.

What are the engagement options?

Three productized entry points plus a custom retainer. The 2-week SOC 2 Sprint at $2,500 flat is for teams with an audit on the calendar. The 90-Day vCISO Foundation at $24,000 builds a real working security program with a pentest in days 31 to 60. The Strategic vCISO retainer at $5,000 per month is the default ongoing engagement. The Embedded vCISO retainer is custom-scoped for higher-touch work and quoted on application.

Why is everything month-to-month?

If a vCISO retainer is not worth the price in any given month, you should not pay for it. Our retainer is month-to-month so the value has to be there every month, not just at the start of an annual contract. Cancellation requires 30 days notice, no fees, no termination penalties.

Which frameworks do you support?

SOC 2 (Type I and Type II), ISO 27001, HIPAA, HITRUST, PCI DSS, CMMC, NIST CSF, NIST SP 800-171, FedRAMP-adjacent work. The four most common engagements are SOC 2 (B2B SaaS), HIPAA + HITRUST (healthtech), PCI DSS (fintech), and CMMC (defense contractors).

Who actually does the work on my engagement?

Our founder personally leads every Sprint and every retainer. The senior practitioner on your kickoff call is the same person doing the day-to-day work, reviewing your policies, and signing the management representation letter. For specialized work (e.g. CMMC enclave architecture, deep AWS forensics), we engage vetted advisors from a bench of practitioners we have worked with before, with their participation called out in the SOW.