What is a Virtual CISO (vCISO)?
A Virtual Chief Security Officer, or vCISO, provides organizations with a temporary or part-time security leader. A vCISO typically helps an organization transition from filling a temporary role after a CISO leaves to filling a gap between needing a CISO but not a full-time CISO. Because good CISO resources are in short supply, it usually takes 6-12 months to find the right one.
A vCISO’s role is to provide interim security leadership and advisory services to the organization and executive management. A common misconception about vCISOs is that they can provide both strategic and tactical support in all areas of security, including analyst, architecture, and engineering. Because security has become more complex, it is nearly impossible to be an expert in all areas of security. vCISOs usually have a broad understanding of security as well as specific areas of expertise. They tend to focus more on strategic direction and leverage other resources to support day-to-day security operations.
Why is a vCISO important?
Organizations are increasingly in need of an executive cybersecurity presence in order to make more informed business decisions. CISOs serve as the liaison between leaders achieving corporate objectives and cybersecurity teams performing tasks such as analysis, engineering, and design. In today’s complex landscape of compliance and business demands, very few firms can provide a one-stop shop for cybersecurity and handle everything the organization requires. It is nearly impossible to find someone who understands and is familiar with all of the practical domains and technologies required to run a cybersecurity program. This is where a vCISO comes in to supplement or backfill an existing person by providing communication, perspective, and executive presence that can assist an organization in moving forward.
What questions should I be asking before hiring a vCISO?
- What do I need my CISO or cybersecurity leader to focus on?
- How can a strong leader enable or increase my organization’s ability to meet its objectives?
- How is my organization representing Board and executive leadership in cybersecurity?
- What can my organization do to increase cybersecurity executive input and decision making?
- What cybersecurity data points and decisions are presented during major business decisions, and by who?
vCISO Service Offering
Here is a sample of some of the services that vCISO could perform for organizations.
- Security Program Strategy & Roadmap
- Executive Communication – KRIs, KPIs, and Reporting
- Governance Design and Team Organization
- Process Review, Retrofit, and Maturity
- Security Program Implementation
- External Audit Liaison
- Security Education and Awareness