What Does a vCISO Do? Duties, Monthly Workload and How to Choose One

The short version: A vCISO (virtual chief information security officer) is a part-time, external security leader. They set the security plan, keep the risk register, own the policies, answer customer security questionnaires, prepare you for incidents and report to management. They decide and govern; your IT team or provider operates the tools. Most small and mid-size companies need a few days a month, not a full-time hire.

This is for owners, finance heads and IT leads who are asked "who is responsible for security?" and do not have a good answer. After reading you will have a duty list you can put in a scope document, a method to estimate monthly hours, signs that you need one, and questions for choosing a person.

Hours below are examples to show the method. Your own scope decides the real number.

What is a vCISO, in practice?

1. A role, not a tool. A vCISO does the job of a chief information security officer on a part-time or fractional basis, for a company that cannot justify a full-time executive.
2. Accountable for the plan, not the keyboard. They decide priorities, accept or reject risk with management, and check that work gets done. Patching, monitoring and user support stay with IT or a managed provider.
3. Independent view. They report to the owner or board, so they can say "this is not done" without defending a team.

What duties belong in a vCISO scope?

We group duties by the six functions of the NIST Cybersecurity Framework 2.0 (Govern, Identify, Protect, Detect, Respond, Recover), checked on the NIST site on 28 October 2026. Use this as your scope checklist.

Govern

1. Write and maintain the security policy set, and get it approved by management.
2. Define who owns what: roles, approvals, exceptions.
3. Report to management or the board on a regular schedule.
4. Set the yearly security roadmap and budget request.

Identify

1. Keep the asset, data and system inventory in step with reality.
2. Run and update the risk register, with owners and dates.
3. Review key suppliers and what data they hold.
4. Answer customer security questionnaires and contract clauses, with evidence.

Protect

1. Review identity and access: MFA, admin accounts, conditional access. Our Microsoft 365 security checklist is a starting point.
2. Set standards for devices, patching, encryption and backup, and check they are applied.
3. Run security awareness training and phishing exercises.
4. Review new tools and projects for security before purchase.

Detect

1. Agree what logs and alerts matter, and who reviews them.
2. Review the monthly output from your monitoring or security operations provider.
3. Track vulnerability scan and penetration test findings to closure.

Respond

1. Write the incident response plan: roles, contacts, decision rules.
2. Run a tabletop exercise at least once a year, with awareness or phishing exercises each quarter.
3. Lead or advise during a real incident and write the after-action review.

Recover

1. Confirm backup scope, retention and restore tests match business needs.
2. Agree recovery targets with the business.
3. Keep the continuity plan current.

How do you estimate monthly hours?

Build the number from activities, not from a guess. List each recurring activity, its frequency, and the time one occurrence takes, then add a setup allowance for the first months.

1. Recurring activities, example for a company of about 50 people:

• Monthly security review with management: 2 hours.
• Risk register and exceptions review: 1 hour.
• Customer questionnaires and supplier reviews: 2 hours (assuming about two a month at one hour each).
• Review of provider reports and findings: 1 hour.
• Management report: 1 hour.
• Annual tabletop exercise plus quarterly awareness work, spread across the year: about 1.5 hours a month.

1. Steady-state total in this example: about 8 to 9 hours a month.
2. Setup phase, first 3 months, example: add 8 to 16 hours a month for policies, the first risk register and the roadmap, so about 16 to 25 hours a month at first.
3. Adjust for: headcount, number of sites, regulated customers, how many questionnaires you receive, whether you have had an incident, and how much of the work your IT team can already evidence.
4. Ask for a cap and a rollover rule, so you know what happens in a quiet month and in an incident month.

As a rough rule of thumb, not a fixed rule: if the estimate comes to more than about two days a week for a small company, either the scope is too wide or you may need an in-house role.

When do you need one?

1. Customers send you security questionnaires and nobody owns the answers.
2. Nobody is named as responsible for security. It sits "with IT" by default.
3. You have a mix of cloud services and devices and no agreed standard.
4. You have had an incident or a near miss and want a proper plan afterwards.
5. You are growing, moving into regulated customers or opening new offices.
6. Management wants an independent view of how you are doing.

You probably do not need one if you are a handful of people with simple tools: a clear checklist and a one-off security review may be enough.

vCISO vs CISO vs managed security provider

1. Full-time CISO: an employee who leads a security team. Suits larger organisations.
2. vCISO: part-time leadership and governance, no operational tooling by default.
3. Managed IT or security provider: runs the day-to-day controls and monitoring. See MSSP vs MSP vs MDR and our managed IT security services.

The vCISO sets the standard; the provider operates to it. Ask whether your vCISO also resells the tools they recommend (see the evaluation questions below).

How do you evaluate a candidate?

1. Ask for sample deliverables: a redacted risk register, policy set, board report and roadmap.
2. Ask who does the work. Is it the person you meet, or a junior team?
3. Ask about conflicts of interest. Do they or their firm resell tools they will recommend?
4. Ask how they report and how often, and whether they will speak to your customers.
5. Ask what they would do in the first 30, 60 and 90 days.
6. Ask about credentials and experience. Certifications such as CISSP or CISM are a signal of knowledge, not proof of fit. Ask for relevant experience in your size and sector.
7. Check references from companies of similar size.
8. Check the contract: scope, monthly hours, response time for incidents, confidentiality, and the handover documents you get if you leave.

Common mistakes

1. Hiring a vCISO to buy tools. The role is to set priorities, not to add products.
2. No decision rights. If management will not approve policies or accept risk in writing, the role cannot work.
3. Scope as a list of tasks, not outcomes. Define outputs such as "approved policy set" and "tested incident plan".
4. Expecting hands-on fixes. Who patches and who monitors should be named separately.
5. Never reviewing hours. Reset the estimate after the setup phase.
6. Keeping the documents with the vCISO. Store the policies, register and reports in your own tenant.

How to check it worked

After about 90 days you should be able to point to:

1. An approved policy set with an owner and a review date.
2. A risk register with owners, dates and the decisions management made.
3. A short incident response plan, with contacts, that has been read out in a tabletop exercise.
4. A security roadmap for the year with priorities and a budget request.
5. A monthly report you can show to management or a customer.
6. Fewer questionnaires that stall, because answers and evidence are ready.

FAQ

What does vCISO stand for?

Virtual chief information security officer. It is also called a fractional or virtual CISO.

What is the difference between a vCISO and a CISO?

A CISO is usually a full-time employee who leads a security team. A vCISO provides the same leadership and governance part-time, from outside the company.

How much does a vCISO cost?

It depends on monthly hours, scope, the number of sites and customers who ask for evidence, and whether you need setup work. We do not publish a figure here. See our security services pricing and use the hours method above to compare quotes.

What qualifications or vCISO certification should I look for?

Look for hands-on experience at your company size and sector, sample deliverables you can inspect and references. Credentials such as CISSP or CISM are a supporting signal, not proof of fit.

For the IT strategy side of the same conversation, see our vCIO service.