Question 1

What is a virtual CISO (vCISO)?

Accepted Answer

A virtual CISO is a senior security leader engaged on a fractional basis instead of full-time. The role covers what a full-time Chief Information Security Officer would: security strategy, compliance program ownership, policy authoring, vendor risk, board reporting, and incident response leadership. The difference is the contract: a vCISO is a retainer or fractional engagement, typically month-to-month, sized to the company that hires them.

Question 2

How is a vCISO different from a full-time CISO?

Accepted Answer

A full-time CISO costs $250K to $400K loaded in base salary, equity, and benefits, takes 3 to 6 months to recruit, and is overqualified for most companies under 250 employees. A vCISO covers the same scope at a fraction of the cost, starts in 2 to 4 weeks, and scales up or down as the company grows.

Question 3

When should we hire a vCISO?

Accepted Answer

The clearest signals are external: your customers are sending security questionnaires, you have a SOC 2 or ISO 27001 audit on the calendar, your board has asked about your security posture, or you have lost a deal because a buyer wanted a security artifact you did not have. If any of those are true, a vCISO can typically pay for itself inside one or two enterprise deals.

Question 4

What does a vCISO do day to day?

Accepted Answer

Owns the security program at the strategic level: writes and maintains policies, runs vendor risk reviews, drafts customer security questionnaire responses, manages compliance audits and evidence collection, runs incident response when things break, and delivers board-grade briefings on cadence. Engineering still owns operational security; the vCISO owns the program around it.

Question 5

What does a vCISO not do?

Accepted Answer

We do not run a 24/7 security operations center. We do not staff a help desk or do tier-one alert triage. We do not provide MSP or MSSP services. If you need eyes-on-glass detection, hire an MDR provider (Arctic Wolf, Expel, ReliaQuest) and pair them with a vCISO for the program-level work. We have referred clients to MDRs many times.

Question 6

Is a vCISO the same as a fractional CISO?

Accepted Answer

Yes. The terms are used interchangeably across the industry. We use vCISO because the buyer search volume is higher, but the role, scope, and pricing are the same.

Question 7

What are the engagement options?

Accepted Answer

Two clear shapes: a focused project for a bounded assessment, test, readiness initiative, or remediation plan; and ongoing program ownership when the work needs recurring security leadership and accountability. Hands-on execution is stated explicitly in either scope.

Question 8

How do I know which engagement fits?

Accepted Answer

Use a focused project when the outcome and finish line are bounded. Use ongoing ownership when the work needs recurring leadership, audit coordination, and cross-functional accountability. If the right starting point is not obvious, request a written recommendation.

Question 9

Can I switch engagement types mid-stream?

Accepted Answer

Yes. Responsibilities and commercial terms can be adjusted openly when your internal capacity, audit load, or operating needs change.

Question 10

What can ongoing program ownership include?

Accepted Answer

The scope can include the security roadmap, policies, compliance platform, evidence, audit coordination, customer questionnaires, risk register, tabletop exercises, executive reporting, and agreed remediation oversight. Cadence and responsibilities are defined before the engagement begins.

Question 11

How is hands-on execution handled?

Accepted Answer

Hands-on remediation, deeper engineering integration, board participation, complex audit fieldwork, and incident leadership are added explicitly when required. They are not hidden behind a package label.

Question 12

How is your pricing structured?

Accepted Answer

Focused projects are fixed-fee or capped when the boundaries support it. Ongoing program ownership is priced monthly based on the environment, compliance obligations, cadence, implementation needs, and response expectations. The written intake provides a working range before a call is required.

Question 13

Can pricing be fixed or capped?

Accepted Answer

Yes, when the outcome and testing or assessment boundaries are sufficiently clear. Ongoing ownership is usually monthly because priorities and operating cadence continue over time.

Question 14

Can I cancel anytime?

Accepted Answer

Yes. Every engagement requires 30 days notice. If you prepay annually, the unused prepaid balance is refunded on a prorated basis. There are no autorenewing multi-year SOWs.

Question 15

Do you do hourly billing?

Accepted Answer

No. We are not a $30 to $50 per hour shop and we do not bill hourly at the senior end either. Retainers are flat monthly fees with the scope written into the SOW. If your budget is hourly-contractor pricing, we can recommend a freelancer marketplace.

Question 16

Do you take equity in lieu of cash?

Accepted Answer

No. Cash retainers only. Equity is too easy to misprice on both sides and creates conflicts of interest at the security advisory level.

Question 17

Are there setup or onboarding fees?

Accepted Answer

No. Standard onboarding is included in the published monthly price. If your environment requires unusual travel, specialist tooling, or a separate third-party cost, we identify it before the SOW is signed.

Question 18

What is a typical first-year cost?

Accepted Answer

Annual cost depends on the monthly scope and whether the work is expected to remain steady across the year. Request a written recommendation for a working monthly and annual range based on your environment and responsibilities.

Question 19

Which frameworks do you support?

Accepted Answer

SOC 2 (Type I and Type II), ISO 27001, HIPAA, HITRUST, PCI DSS, CMMC, NIST CSF, NIST SP 800-171, FedRAMP-adjacent work. The four most common engagements are SOC 2 (B2B SaaS), HIPAA + HITRUST (healthtech), PCI DSS (fintech), and CMMC (defense contractors).

Question 20

Do you perform the audit yourselves?

Accepted Answer

No. We are not a CPA firm. We do readiness, gap analysis, remediation, evidence collection, and audit support. Then a separate licensed audit firm performs the audit and issues the report. We help you select an auditor if you need a referral. This separation is required by every framework that produces an attestation.

Question 21

How long does SOC 2 readiness take?

Accepted Answer

A focused readiness assessment usually takes two to four weeks. Full readiness with policy authoring, gap remediation, evidence collection, and auditor coordination usually takes eight to twelve weeks or longer depending on starting posture and the audit window.

Question 22

Can you handle multiple frameworks at once?

Accepted Answer

Yes. Most growth-stage clients run two or three frameworks in parallel (SOC 2 + ISO 27001, or SOC 2 + HIPAA, or SOC 2 + CMMC). The frameworks share 60 to 80 percent of underlying controls; we map controls once and produce evidence packages for each framework's audit window. Multi-framework is where embedded vCISOs add the most leverage.

Question 23

Do you work with Vanta, Drata, Secureframe, Oneleet, or ScalePad?

Accepted Answer

Yes, all of them. We administer compliance platforms inside retainer engagements. The platform automates evidence collection well; the human work is policy customization, vendor risk review, customer questionnaire response, and audit-prep narrative. We do the human work on top of whichever platform you have.

Question 24

Do you include penetration testing?

Accepted Answer

We run penetration testing in-house and scope it to the application, environment, and assurance requirement. Technical validation may be included in an ongoing engagement when it is part of the agreed roadmap; broader tests are scoped explicitly in the SOW.

Question 25

Who actually does the work on my engagement?

Accepted Answer

Our founder personally leads every engagement. The senior practitioner on your kickoff call is the same person doing the day-to-day work, reviewing your policies, and joining executive conversations. For specialized work such as CMMC enclave architecture or deep AWS forensics, we engage vetted advisors with their participation identified in the SOW.

Question 26

Where are you based and do you work on-site?

Accepted Answer

Headquartered in Pittsburgh, PA. Pittsburgh-based clients get quarterly in-person executive briefings, on-site board meetings, and same-day incident response kickoffs at no extra cost. Non-Pittsburgh clients work with us remote-first with travel available on request.

Question 27

How do we communicate during a retainer?

Accepted Answer

Slack channel shared with your team for day-to-day. Monthly video review with engineering and security stakeholders. Quarterly board-grade briefing for leadership and investors. Weekly written updates for active workstreams. Whatever incident-channel pattern your team already uses for live response.

Question 28

What is your response time?

Accepted Answer

Response expectations depend on the scope and are documented in the SOW. New written recommendation requests are reviewed within one business day.

Question 29

How big is the team?

Accepted Answer

Practitioner-led firm with the founder as principal consultant on every engagement. Specialized advisors brought in by the engagement when scope demands it. The firm is structured for senior-led delivery, not enterprise scale.

Question 30

What credentials do you hold?

Accepted Answer

CISSP, OSCP, AWS Security Specialty, CREST RPT. MS in Information Security from Carnegie Mellon. Active practitioner: pentests run in the same shop that delivers vCISO retainers, not subcontracted out.

Question 31

Do you sign NDAs?

Accepted Answer

Yes. NDA on first call as standard practice. Mutual or one-way, your standard or ours. We have signed hundreds of these and have no problem with reasonable terms.

Question 32

How is client data handled?

Accepted Answer

Client data is classified, encrypted at rest and in transit, scoped to least-privilege access by default. We use a separate access scope per client, no cross-client visibility. DPAs available on request and signed before any production data flows.

Question 33

Do you carry professional liability insurance?

Accepted Answer

Yes. Errors and omissions insurance sized for growth-stage engagements. Coverage certificates available on request during procurement review.

Question 34

How long do you retain inquiry and engagement data?

Accepted Answer

Inquiry emails are retained for 3 years from last contact. Engagement-related communications are retained per contract terms (typically 7 years after engagement close). Optional analytics require your consent; the privacy policy explains browser-storage durations and provider retention. Contact info@vciso.com for current retention details or deletion requests.

Frequently asked questions.

General vCISO questions

Engagement types

Pricing and contracts

Frameworks and compliance

Working style and team

Data, privacy, and insurance

Still have questions?

Your privacy choices