Virtual CISO: what drives the cost and how the contract works

What a virtual CISO (vCISO) is

A virtual CISO takes on the role of Chief Information Security Officer or Information Security Officer without joining your payroll. In practice they lead the information security programme, report risk indicators to the board, oversee regulatory compliance and carry out the duties of an in-house security executive within the authority the contract sets, under a services agreement rather than an employment contract.

The role exists because most SMEs, and many mid-sized companies, face the same problem: they need senior security leadership but lack the workload or budget to justify a full-time executive post. A vCISO fills that gap with the right level of experience, sized to how large your operation actually is.

What determines the cost of a vCISO

There is no standard market rate for a vCISO in the UK, and a figure published without context tells you very little. What does exist is a set of concrete factors that shape the price. These are the five main ones.

How to work out the monthly cost of a vCISO

You can see how the monthly fee is built without a published rate card. Most proposals follow this logic:

A business that reserves two days a month pays for that defined capacity, plus anything contracted separately: an initial assessment, emergency cover or specific projects. These are the components that usually go into the calculation:

To give a sense of how capacity is usually sized, here are three illustrative structures (these are not market standards or Cyvra quotes):

• Light fractional, 1 to 2 days a month: an established programme that needs senior oversight.
• Standard fractional, 3 to 5 days a month: active security governance, supplier coordination and compliance work.
• Interim leadership, 2 to 5 days a week for a defined period: building or stabilising the function, or covering a vacancy.

Contract models: interim and fractional

Two common ways to engage a vCISO are interim and fractional. At Cyvra we structure virtual security leadership mainly in these two formats.

Interim CISO. A fixed term, typically used to cover a departure, set up the security function for the first time, or run a specific project or audit. The engagement has a clear start and end, with an orderly handover at the close, either to a permanent hire or into a fractional contract.

Fractional CISO. An ongoing contract with a fixed number of days reserved each month. The vCISO attends board and audit meetings, manages relationships with security suppliers and keeps security maturity moving in step with the business. It is the most common model for companies that need standing oversight without the cost of a full-time hire.

At Cyvra we work with a minimum initial term of three months. That period lets us understand the environment, assess the risks, set priorities and present first results to the board before the engagement continues on a fractional basis. For some organisations, three months may not be enough.

Virtual CISO vs. IT consultancy

People often confuse the two services, and the difference matters when you decide what to buy.

A security consultancy usually works to a defined scope or project, although it may also provide ongoing services. A vCISO becomes part of your governance structure and leads the security programme on an ongoing or interim basis, with responsibilities, authority, deliverables and accountability agreed in the contract.

In practice the vCISO takes on leadership and day-to-day management of the programme. They propose priorities, guide the setting of risk appetite, oversee controls and report results to the board. Approving risk appetite, accepting significant risks and decisions reserved to management stay with your organisation. That matters when an improvement is expensive, when a critical system cannot be patched, or when a business unit wants to accept a high residual risk: the vCISO recommends and the board decides.

The vCISO holds a leadership role defined by contract. Operational delivery can stay with your internal team, your MSP, a SOC/MDR provider or specialist suppliers. Continuous monitoring, penetration testing, emergency response and independent audits should be contracted and scoped separately when they are not part of the engagement.

When the same provider supplies security leadership and implementation services, the contract should address possible conflicts of interest and how results will be validated. Audits and assessments that require independence should be carried out by people or functions with appropriate impartiality.

Is it worth it for an SME?

A vCISO makes sense when your business already carries real security risk and regulatory exposure but lacks the workload to justify a full-time security executive. Typical cases are mid-sized companies in regulated sectors, or smaller businesses that handle sensitive customer data, payment cards or health information.

It makes less sense when the operation is small enough for your own IT team to manage basic security controls, with no extra regulatory requirements. In those cases a one-off audit or a targeted piece of consultancy usually meets the need without the commitment of an ongoing contract.

Does a virtual CISO replace an in-house CISO?

A vCISO can carry the same strategic responsibilities as an in-house CISO, with scope, authority and time commitment set out in the contract. The time commitment is sized to what the operation actually needs, and whether the model fits depends on the complexity and risks of your business. For a company without the workload for a full-time post, that sizing is an advantage.

As the organisation grows, the model can change with it. Companies often start with a fractional vCISO and, once they reach enough scale, hire a full-time in-house CISO, with the vCISO supporting the transition and handing over knowledge.

vCISO liability and legal responsibility

Every board should ask this before signing, and the right answer depends on the contract rather than a general rule.

A properly contracted vCISO reduces risk instead of adding a new layer of exposure, provided the contract is clear about who decides what and who answers for each decision. We recommend independent legal review of any vCISO contract before signing.

Before signing, check that the contract covers these points:

How to report security metrics to the board

One of the first deliverables from a competent vCISO is a reporting structure the board actually understands. That usually means moving from technical metrics (vulnerability counts, patches applied) to business risk indicators, such as:

• critical risks and their trend;
• overdue critical remediation actions;
• recovery capability for critical services;
• coverage of identity and security controls;
• significant incidents and lessons learned;
• regulatory and audit actions, with their deadlines;
• risk acceptance decisions that need the board;
• budget and roadmap progress.

Estimates of financial exposure can help, but they carry a lot of uncertainty. When you use them, document the method, the assumptions and the margin of uncertainty.

Reporting frequency should follow how critical the risks are, how mature the programme is and your company's governance cycle. Monthly reports may suit a set-up or remediation phase; quarterly presentations may serve the board's strategic oversight. Incidents and critical risks call for reporting outside the normal cycle.

A 90-day security action plan

A vCISO engagement should set objectives, deliverables and priorities for the first 90 days, adapted to your company's maturity and its most urgent risks. A common structure splits the period into three phases.

Days 1 to 30: assessment. Asset mapping, review of existing policies, a compliance review against the rules that apply to you (such as UK GDPR, PCI DSS or FCA operational resilience requirements), interviews with key teams and an initial risk assessment to find the most urgent gaps. Critical risks found in this phase should be reported and handled according to their urgency, without waiting for the assessment to finish.

Days 31 to 60: prioritisation and action plan. The risks from the first phase are prioritised, with fixes, owners and deadlines set. Priority fixes begin in this phase, working with the internal team and suppliers, and the pace depends on budget and on who delivers each item.

Days 61 to 90: follow-up and first formal report. Tracking delivery of the plan and presenting the first structured report to the board, which sets the cadence for the rest of the contract.