Most small and mid-sized businesses have someone who owns IT. Very few have someone who owns security risk: who decides what matters, what to spend, what to tell the board and what to say when a client sends a 200-question security questionnaire. That is the gap a vCISO fills.
What Does a vCISO Actually Do?
A vCISO works at the management level, not the keyboard level. Typical responsibilities:
| Area | Examples |
|---|---|
| Strategy and roadmap | A prioritized 12 to 24 month security plan tied to business risk |
| Risk management | Risk register, risk assessments, decisions on what to accept |
| Policies | Acceptable use, access control, incident response, AI usage, vendor management |
| Compliance | Readiness for SOC 2, ISO 27001, CyberSecure Canada, CPCSC, Law 25 |
| Customer and insurer requests | Security questionnaires, cyber insurance applications |
| Vendor oversight | Reviewing the MSP, MDR and key SaaS vendors |
| Board and leadership reporting | Plain-language updates on risk and progress |
| Incident leadership | Guiding decisions during a major incident |
How Is a vCISO Different from Your IT Provider?
Your IT provider, or MSP, runs systems: devices, servers, Microsoft 365, help desk. A vCISO decides what security outcomes those systems need to deliver and checks whether they do. There is a natural tension, and it is healthy. The person implementing controls should not be the only person judging whether they are sufficient. See MSP vs MSSP for more on how the roles fit together.
How Is a vCISO Different from a Full-Time CISO?
| vCISO | Full-time CISO | |
|---|---|---|
| Time commitment | Part-time, often a set number of days or hours a month | Full-time |
| Cost | A fraction of an executive salary | Executive compensation plus benefits |
| Breadth of experience | Sees many organizations and incidents | Deep knowledge of one organization |
| Availability | Scheduled, plus on call for incidents | Always in the building |
| Best fit | 20 to 1,000 employees without a security team | Larger or highly regulated organizations |
When Does a Business Need a vCISO?
Common triggers:
- A large customer sends a security questionnaire and nobody can answer it.
- A SOC 2 or ISO 27001 project is starting.
- The cyber insurance renewal asked questions you could not answer confidently.
- You are bidding on defence work and need CPCSC.
- The board or owners want a clear view of cyber risk.
- You have had an incident and want to avoid a repeat.
A 90-person Calgary engineering firm bidding on work for an energy company is a classic example. The customer wants proof of a security program. The firm has good IT but no one who can own the program and speak to the customer's security team.
How Are vCISO Engagements Structured?
Usually as a monthly retainer for a defined amount of time, often starting with an assessment and roadmap in the first months, then shifting to ongoing governance, reporting and project oversight. Some businesses use a vCISO for a fixed project, like SOC 2 readiness, then step down to a lighter retainer.
What Should You Look for in a vCISO?
Relevant experience in your industry, the ability to explain risk to non-technical leaders, recognized credentials (CISSP, CISM, ISO 27001 Lead Implementer or similar), and independence from the products being recommended. Our vCISO service includes a named vCISO, a set number of hours each month, a monthly working session and a quarterly report to leadership. For choosing a framework to work from, see Which cybersecurity framework should a small business use?.