Senior security and IT leadership, without hiring a full-time executive
We take on the CISO or IT Manager role directly, with responsibility for the security programme, IT strategy and board reporting within the agreed scope. We work on an interim basis for a defined period, or fractionally on an ongoing retainer.
Your security programme in experienced hands
An experienced CISO in the UK typically costs £120,000 to £180,000 a year before benefits. Many businesses carry real security risk and regulatory exposure without one in the seat but do not have the budget for a full-time hire. We step into the role directly, running your security programme, reporting to the board, and leading the work to meet regulatory obligations while your IT team handles day-to-day technology operations.
The service is also known as CISO as a Service, outsourced CISO or fractional CISO. Beyond recommending improvements, the virtual CISO leads the security programme within the agreed scope, coordinates the work, tracks risk and reports results to the board.
Whether you are building a security function for the first time, covering a departure, or need defined-term ownership for a project or audit, we step in quickly. We operate at ISO level for day-to-day security management or CISO level for board reporting and strategic oversight. We step back cleanly when you are ready.
Dedicated security leadership at a cadence that fits your business. We run your programme, attend board and audit meetings, manage vendor relationships, and keep your security posture moving forward without the overhead of a permanent hire.
Virtual CISO for regulated sectors
Cyvra has offices in the UK, the Netherlands and Brazil and works mainly with organisations of 50 to 5,000 employees. Most of our clients have real regulatory obligations but do not yet need a full-time CISO.
FCA and PRA operational resilience rules require regulated firms to identify their important business services, set impact tolerances, map and test them, and since 31 March 2025 to be able to stay within those tolerances. Firms with EU operations also fall under DORA, which has applied since 17 January 2025. The vCISO runs this programme, prepares the board for supervisory scrutiny and keeps the evidence organised.
Security for financial services →Apart from the few providers formally designated as critical third parties, DORA and the UK outsourcing rules apply to the financial firm, not the supplier. The firm stays responsible for the services it outsources and passes requirements down through contract clauses, audit rights and due diligence questionnaires. The vCISO answers those questionnaires and builds the programme your clients expect to see.
What DORA asks of financial firms →Health data is special category data under UK GDPR, and organisations with access to NHS patient data or systems are expected to complete the Data Security and Protection Toolkit every year. The vCISO decides who can access patient records and clinical systems, manages supplier and legacy system risk and keeps the evidence ready for audits and submissions.
Security for healthcare →Hotels take card payments and hold guest data in the PMS, on the guest Wi-Fi and in OTA integrations. The vCISO coordinates PCI DSS and UK GDPR compliance and holds system suppliers to account on security.
Security for hospitality →What you get in the first three months
The three-month minimum gives us time to understand your environment, assess the risks and set up a steady governance routine. Leadership starts on day one, with priorities set by urgency and the risks we find. We structure the period in three phases.
Asset mapping, a review of existing policies, a compliance review against the rules that apply to you (such as UK GDPR, FCA and PRA rules, DORA or PCI DSS), interviews with key teams and an initial risk assessment that shows the most urgent gaps.
We prioritise the risks we found and agree the fixes, owners and deadlines. Priority fixes start in this phase, with your team and your suppliers, under a plan aligned to the board’s risk appetite.
We track delivery of the plan and present the first formal report: business risk, compliance status and progress against the plan. After that, the report follows your board cycle, usually quarterly.
IT leadership on demand, without hiring a full-time IT Manager
Hiring a senior IT Manager takes months and locks you into a fixed cost. Organisations of all sizes often need that leadership to drive transformation, manage vendors, or hold the function through a transition. We take on the role directly, owning strategy and delivery while your team handles day-to-day operations.
The first 90 days. In the first month we review your environment, suppliers, contracts, costs, projects and operational risks, and start work on high-risk findings straight away. In the second, we agree priorities, owners, budget impact and the roadmap with management. In the third, delivery moves forward, reporting is in place and we review progress with the board. These are typical stages: how fast fixes land depends on budget and on who delivers each item.
When your IT Manager leaves, a major migration is underway, or a project needs senior ownership, we take the seat within days. We maintain continuity across your team and vendors and hand over cleanly when you hire permanently or the project lands.
Regular dedicated days each month to run your IT function strategically. We manage your roadmap, hold vendor relationships, chair steering meetings, and keep your infrastructure aligned to business priorities without a full-time salary commitment.
Security and IT certifications held across our team
From first call to in the role
30 minutes to understand your situation, gaps, and timeline. No preparation needed on your side.
We propose a structure, level, and start date within 48 hours. You decide what fits.
Most engagements start within two weeks of agreement. Urgent interim cover can start within days, depending on scope and agreed availability.
Virtual CISO: frequently asked questions
What is a virtual CISO (vCISO)?
A virtual CISO takes on the role of Chief Information Security Officer, or Information Security Officer, without being on your payroll. They run your information security programme, report risk to the board and lead regulatory compliance, under contract and with the time commitment your organisation actually needs. The service is also called CISO as a Service, outsourced CISO or fractional CISO.
How much does a virtual CISO cost?
We do not work from a fixed price list. The fee depends on the size and complexity of your organisation, the regulatory load in your sector, the level of cover (ISO or CISO), the engagement model and the current maturity of your security programme. After a 30-minute discovery call, we send a proposal with scope and fees within 48 hours. Our guide to virtual IT and security leadership compares the cost with a full-time hire.
What is the minimum contract length?
Three months. After that, the engagement can continue as an ongoing fractional retainer with fixed days each month, or end with an orderly handover to an in-house CISO or to your team.
What is the difference between an interim and a fractional CISO?
An interim CISO covers a defined period: a departure, building the security function for the first time, or a specific project or audit. A fractional CISO is ongoing, with days set aside each month for board and audit meetings, security supplier management and moving the programme forward.
Does a vCISO replace an in-house CISO?
A vCISO can take on the same strategic responsibilities as an in-house CISO. Scope, authority and time commitment are set in the contract, and the time commitment is sized to what your organisation needs. Whether the model is enough depends on the complexity of your business and the risks you carry. Many organisations start with a fractional vCISO and hire an in-house CISO once they reach scale, with the vCISO supporting the transition and the knowledge transfer.
What is included in the vCISO service?
The scope is set in the contract and covers governance, risk management, compliance, supplier coordination and follow-up of security measures. Continuous monitoring, penetration testing, incident response and independent audits are contracted separately, and the vCISO coordinates them where needed.
Can the vCISO also be our Data Protection Officer?
They are different roles. The DPO monitors data protection compliance, advises the organisation and is the contact point for the ICO and for individuals; the vCISO runs the security programme. UK GDPR allows the DPO to be a member of staff or an external provider under a service contract, and to take on other tasks as long as they do not create a conflict of interest. Senior roles that decide how personal data is processed can create that conflict, so combining the two needs a case-by-case assessment. If you need both roles covered, tell us on the discovery call and we will suggest the right structure.
Who is legally responsible for compliance?
Legal responsibility for compliance and data protection stays with your organisation as the controller, and under DORA and NIS2 the management body remains accountable for approving and overseeing cyber risk management. That is why the vCISO contract should set out the scope, liability limits and professional indemnity cover precisely. We recommend independent legal review before signing.
Do you work with organisations outside the UK?
Yes. We have offices in the UK, the Netherlands and Brazil. We support UK organisations with EU operations that need to meet NIS2 or DORA alongside UK GDPR, and European organisations with UK operations.
Further reading: our guide to virtual IT and security leadership and NIS2 compared with ISO 27001.
Ready to talk?
Tell us what you need covered. We’ll confirm whether we’re the right fit and outline an engagement structure within 48 hours.