Monthly
Leadership update
Progress against the roadmap, new risks and the decisions that need an owner.
Virtual CISO
A Chief Security Officer.At A Fraction Of The Salary.
A named security leader who sets your strategy, answers the board, auditors and insurers, and keeps the program on track, for a fraction of a full-time CISO.
- Named vCISO
- 1
- Working sessions
- Monthly
- Reports to leadership
- Quarterly
CONSOLEDemo tenantSOC online00:00:00 ET3MTReports / Board
Board briefing
Board of Directors | Cyber risk update, Q3 FY2026Sample
Summary for decision
Risk is down a level. Two gaps remain before the insurance renewal.
Posture
Moderate
High in Q1
Top 3 risks
- 1Ransomware through remote accessMFA and EDR live
- 2Payment fraud by emailCall-back rule in AP
- 3Supplier data exposure4 vendors unreviewed
Budget asks
- Immutable backup storageCAD 24,000
- MDR for plant networkCAD 31,000/yr
Total CAD 55,000
Roadmap progress14 of 20 milestones, plan was 13
Prepared by your Cyberphore vCISOData synced 09:41:07 ET · Slide 3 of 9
Feeding this slide
Certified partner of
Why this cannot wait
- Average cost of a data breach in Canada, 2026
- CAD 7.11M
- IBM, Cost of a Data Breach Report (Canada), 2026
- Average spend per Canadian business on cyber prevention, 2025
- CAD 54,772
- Statistics Canada, Canadian Survey of Cyber Security and Cybercrime, 2026
- Canadian businesses impacted by cyber security incidents, 2025
- 16%
- Statistics Canada, Canadian Survey of Cyber Security and Cybercrime, 2026
- Insured, impacted Canadian businesses that tried to make a claim
- 6%
- Statistics Canada, Canadian Survey of Cyber Security and Cybercrime, 2026
Overview
Senior Security Leadership, a Few Days a Month
A vCISO (virtual chief information security officer) is a part-time, outsourced security executive who owns your security strategy, risk management and reporting without being a full-time employee. They do what a CISO does at a large company: decide priorities, set policy, oversee providers, answer to leadership and the board, and make sure security spending reduces real risk.
For most Canadian SMBs, a full-time CISO is hard to justify. Experienced security leaders are expensive and in short supply, and a 120-person company rarely has enough strategic security work to fill their week. A vCISO solves that mismatch.
What You Get
- A security roadmap tied to business goals, budget and real risk
- Confident, consistent answers to customer security questionnaires
- Board and leadership reporting on cyber risk in plain language
- One accountable person who owns security decisions
Where your vCISO sits
Board and investors
Quarterly reporting
Executive team
Monthly updates, decisions
Your vCISO
Owns strategy, risk, policy and reporting. Accountable for the program and the advice.
IT provider
Runs systems
SOC and MDR
Monitors and responds
Auditors, insurers, customers
Receive evidence
- CISSP
- CISM
Every Cyberphore vCISO holds the CISSP or CISM. You meet yours before you sign.
Who needs one
Who Needs a vCISO, and the Problems It Solves
Organizations that handle sensitive data, sell to enterprise or government customers, prepare for SOC 2 or ISO 27001, answer to a board or investors, or have outgrown security as the IT manager’s side job. It is also common after a serious incident.
Typical Situations
- Manufacturer, VaughanIts largest customer just sent a 300-question security questionnaire with a two-week deadline.
- Fintech, VancouverNeeds SOC 2 to close enterprise deals and has no one to own the program.
- Healthcare services, Saint JohnAfter a breach at a competitor, the board asked “how exposed are we?” and nobody could answer.
- Engineering firm, OttawaBidding on defence work that now requires CPCSC Level 1.
- Growing non-profitThe IT manager has been doing security strategy on top of a full-time job.
When it is more than you need: with fewer than 20 employees and no specific customer or regulatory pressure, a one-time risk assessment and roadmap might do. We will tell you.
The problem today
With a vCISO
No One Owns Security
IT keeps systems running. Finance pays for tools. Sales answers questionnaires as best they can. Nobody decides what matters most.
With a vCISO: One accountable owner who sets priorities and makes the calls.
Spending Without a Plan
Tools bought after a scare or a sales pitch leave overlap in one area and nothing in another.
With a vCISO: A roadmap and budget based on your actual risk.
Customer and Audit Pressure
Enterprise customers, government buyers and insurers want evidence of a security program, not just a firewall.
With a vCISO: Policies, risk assessments and consistent answers ready to share.
Board Questions
Directors have a duty to oversee risk, and cyber risk is now part of that conversation.
With a vCISO: Clear reporting and specific decisions for the board to make.
How it works
Assess, Plan, Lead and Report: How an Engagement Runs
01Assess
Interviews across leadership, IT, finance and operations, then a review of evidence: configurations, policies, contracts, past incidents and insurance applications. We measure your posture against a recognized framework chosen for your goals.
02Plan
A roadmap for the next 12 to 24 months: priorities in order, estimated costs, owners and milestones. It explains trade-offs, including what we recommend not doing yet, and leadership reviews and agrees it.
03Lead
Regular working sessions with your team. Your vCISO drives the roadmap, writes and updates policies, reviews vendors, oversees your IT provider’s security work and keeps an eye on new risks.
04Report
Monthly progress updates for leadership and quarterly reporting for the board, with a small set of metrics that show whether risk is actually going down.
Frameworks we assess against
- NIST CSF 2.0
- CIS Controls
- Cyber Centre baseline controls
First 90 days
What You Should Have After the First 90 Days
A fair test of any vCISO is what you have after three months. With Cyberphore, you should expect these six deliverables.
- 30Days 1 to 30Understand and fix the obvious
A Risk Assessment
Your top risks in plain language, with the evidence behind them.
Quick Wins Under Way
Typically closing MFA gaps, tightening admin access and confirming that backups actually restore.
- 60Days 31 to 60Agree the plan and the rules
A Roadmap and Budget
The next 12 to 24 months, reviewed and agreed by your leadership.
Core Policies
Information security, acceptable use, access control and incident response, drafted or updated.
- 90Days 61 to 90Equip sales and report
A Questionnaire Answer Library
So the next customer security questionnaire takes days instead of weeks.
A First Leadership or Board Report
With a small set of measures you will track from then on.
Typical sequence. The order follows your priorities; by day 90 all six should be in place.
If a vCISO cannot show you something like this after a quarter, ask why. Strategy work is easy to stretch indefinitely without results, and part of our job is to prevent that.
Deliverables
What Good vCISO Work Looks Like
Two working documents sit behind every board conversation: a risk register that shows risk moving, and a roadmap that shows who is doing what and when.
Signs of Good Work
- A written roadmap your leadership agrees with and can explain
- Policies that are short, specific and actually followed
- Clear ownership of every security responsibility, including what your IT provider does
- Board reporting that leads to decisions, not just nodding
- Faster, more consistent answers to customer questionnaires
- An incident response plan that has been tested in a tabletop exercise
Residual risk
Q1 2026Q4 2026Likelihood
R1R2R3R4R5
12345
Impact
Risk and ownerScore
R1Ransomware via remote access
IT Director
20to8
R2Payment fraud by email
Controller
16to6
R3Supplier data exposure
COO
12to12
R4Lost unencrypted laptop
IT Director
12to4
R5Unpatched VPN appliance
IT Director
25to5
Scored against NIST CSF 2.0. R3 awaits the vendor review program in Q1 2027.
Security roadmap, January to December 2027
8 workstreams, 4 quarterly milestones, reviewed monthly
DonePlannedToday
JFMAMJJASOND
MFA 100%
Policies signed
SOC 2 Type I
Board review
MFA and conditional access
IT
MDR on endpoints and M365
Cyberphore
Immutable backups
IT
Policies and standards
vCISO
Vendor risk program
vCISO, COO
SOC 2 Type I readiness
vCISO
Ransomware tabletop
Leadership
Awareness and phishing
HR, Cyberphore
Sample screens with illustrative data, not a client’s.
Reporting That Leads to Decisions
Quarterly
Board report
Risk, progress and investment in language directors understand, with a small set of metrics tracked over time.
On request
Assurance evidence
Policies, risk assessments and consistent answers for auditors, insurers and customer due diligence.
Scope
What a vCISO Does, and What It Does Not Do
A vCISO is not a help desk, a system administrator or a 24/7 monitoring service. They will not reset passwords or patch servers. They make sure someone does, and that the work is prioritized correctly.
What a vCISO does
Your vCISO owns
- Risk assessment against a recognized framework
- Security roadmap and budget
- Policies and standards sized for your business
- Vendor and third-party risk
- Board and executive reporting
- Customer questionnaires and contract security clauses
- A senior voice at the table during a serious incident, with insurers, counsel and IT
- Oversight of SOC 2, ISO 27001, CyberSecure Canada, CPCSC or privacy programs
Not the vCISO’s job
Your IT provider runs
- Devices and networks
- Help desk and password resets
- Patching servers and software
- Backups
Keeping these roles separate avoids anyone marking their own homework. The two work closely together.
Not the vCISO’s job
MDR monitors
- 24/7/365 monitoring by certified analysts
- Investigation of suspicious activity
- Containment under a playbook you approve
vCISO or Full-Time CISO?
Many organizations use a vCISO to build the program, then hire a full-time leader once the role is well defined. A vCISO can help write the job description and run the hiring.
One-time assessment
Fewer than 20 employees and no specific customer or regulatory pressure. A risk assessment and roadmap may be enough.
vCISO retainerThis service
Real customer, board or audit pressure, but not enough strategic security work to fill a senior leader’s week.
Full-time CISO
Security decisions need daily senior attention: larger organizations, heavily regulated firms, or products that are security-sensitive at scale.
On accountability: a vCISO is accountable for the program, the advice and the reporting under the engagement agreement. Legal accountability for security still rests with your leadership and board, as it does with an employee CISO.
Canadian considerations
Privacy Accountability, Certifications and Insurance in Canada
Privacy Accountability
PIPEDA requires every organization to designate someone accountable for its compliance with the law’s privacy principles. Quebec’s Law 25 makes the person with the highest authority the person in charge of the protection of personal information by default, though the role can be delegated in writing. A vCISO often works closely with whoever holds those roles.
Certifications
CyberSecure Canada, the CPCSC for defence suppliers, SOC 2 and ISO 27001 all require program leadership and documentation. A vCISO typically steers the readiness work.
Cyber Insurance
A vCISO can own your cyber insurance application, making sure answers are accurate and the controls described actually exist.
General information, not legal advice.
Choosing and pricing
How to Choose a vCISO, and What Drives the Cost
Five Questions to Put to Any Provider
Tick each one off as you interview providers, including us.
Too many clients per vCISO means you get a name on a contract and little else. The capacity question matters most.
All five covered. Our answers start on the scoping call: every Cyberphore vCISO holds the CISSP or CISM, and you meet yours before you sign.
FAQ
vCISO Services: Common Questions
What does a vCISO actually do each month?
It varies with your priorities, but a typical month includes a working session with leadership, progress on the roadmap, review of new risks such as a vendor change or acquisition, help answering customer questionnaires, policy updates and oversight of providers like your IT company or SOC. Quarterly, there is usually a board or executive report.
How much does a vCISO cost in Canada?
vCISO engagements are usually priced as a monthly retainer based on the number of hours and the scope of work. A company preparing for SOC 2 with active customer demands needs more time than one maintaining an established program. Compared with a full-time CISO salary plus benefits, a vCISO is a fraction of the cost. Pricing depends on your environment and scope, so we provide a written quote in CAD after a free scoping call.
Who needs a vCISO?
Organizations that handle sensitive data, sell to enterprise or government customers, are preparing for SOC 2 or ISO 27001, need to answer to a board or investors about cyber risk, or have grown past the point where the IT manager can reasonably own security strategy as a side job. It is also common after a serious incident.
Is a vCISO the same as our IT provider?
No. Your IT provider runs systems: devices, networks, help desk, backups. A vCISO sets security direction, assesses risk, writes policy and holds everyone, including the IT provider, accountable for security outcomes. Keeping those roles separate avoids the conflict of someone marking their own homework. The two should work closely together.
When should we hire a full-time CISO instead?
When security decisions require daily senior attention: typically larger organizations, heavily regulated firms, or companies whose product is itself security-sensitive at scale. Many organizations use a vCISO to build the program, then hire a full-time leader once the role is well defined. A vCISO can help write the job description and run the hiring.
Can a vCISO be held accountable like a real executive?
A vCISO is accountable for the program, the advice and the reporting under the engagement agreement. Legal accountability for the organization's security still rests with your leadership and board, as it does with an employee CISO. A good vCISO makes that accountability easier to exercise by giving directors clear information and decisions to make.
Get started
Meet a vCISO Before You Commit to Anything
A free 30-minute scoping call with a certified security leader. We learn what is driving the need and tell you honestly whether a retainer, a one-time assessment or neither is the right next step.
- 1Free scoping callCustomers, audits, the board or growth: we map what is driving the need and your current controls.
- 2Written quote in CADA fixed-price assessment and roadmap, a monthly retainer, or both, scoped to the hours and work you need.
- 3Meet your vCISOYou meet the person who will lead your program before you sign. Then the first 90 days begin.
Related Services
Compliance ReadinessReadiness for SOC 2, ISO 27001, CyberSecure Canada, CPCSC and PCI DSS: gap assessment, remediation, evidence and audit support.Privacy CompliancePractical privacy programs and breach readiness for PIPEDA, Quebec Law 25, Alberta and BC PIPA and provincial health privacy laws.Incident ResponseEmergency response, retainers, tested plans and tabletop exercises for ransomware, business email compromise and data breaches.