Virtual CISO (vCISO) services
Senior security leadership a few days a month: a clear roadmap, owned risks and reports your board can read.
- Model
- Fractional
- Cadence
- Monthly · Quarterly
- Lead
- CISM · 27001 LA
- Covers
- Risk · Policy · Audit
Who our virtual CISO service is for
A fractional CISO for companies that need security leadership but not a full-time hire. The founder, who holds CISM and ISO/IEC 27001 Lead Auditor credentials, owns your security roadmap, risks and reporting on a monthly or quarterly cadence agreed in the proposal.
- Startups whose enterprise customers send long security questionnaires
- SMEs preparing for ISO 27001 or SOC 2 without a security lead
- Boards and founders who want a clear, regular view of cyber risk
- Companies that need someone accountable for CERT-In and DPDP incident duties
Before
- Security questionnaires answered by whoever is free
- No one owns cyber risk at leadership level
- Audit preparation keeps slipping
After
- A named security lead and a written roadmap
- A risk register reviewed on a fixed cadence
- Questionnaires answered from evidence, once
Fractional CISO for startups
Most startups do not need a full-time CISO, but they do need someone who can answer a customer's security questionnaire honestly, decide which controls come first and explain risk to the board. A fractional CISO gives you that judgement for a few days a month.
We start from what your customers and investors are asking for, build a roadmap you can afford, and reuse the same evidence for questionnaires, ISO 27001 and SOC 2 so the work is done once.
vCISO for small business
For a small business, the vCISO role is mostly about focus: knowing which few controls (MFA, backups, device management, email authentication, access reviews) remove the most risk, and making sure someone owns each one.
You get a short monthly or quarterly report in plain language: what changed, which risks went up or down, and which decisions need you. Incident duties under the CERT-In Directions and the DPDP Act are written down and practised, so nobody is guessing on the day.
Outsourced CISO or a full-time hire?
An outsourced CISO suits companies that need senior judgement but not 40 hours a week of it, or that want leadership in place while they decide whether to hire. When the programme grows to the point where a full-time security leader makes sense, we help write the role, interview candidates and hand over the roadmap, risk register and evidence.
What you get from a virtual CISO
Named documents and outcomes you keep. Scope is agreed per engagement.
- 01
Security roadmap
Twelve months of priorities with owners and review dates.
- 02
Policy set
Information security, access, acceptable use, incident and supplier policies.
- 03
Risk register
Each risk scored, owned and linked to a treatment.
- 04
Leadership report
Monthly or quarterly summary of risk, progress and decisions needed.
- 05
Questionnaire answer library
Evidence-backed answers reused across customer reviews.
- 06
Incident response plan
Roles, CERT-In and DPDP notification steps, and an exercise record.
How a vCISO engagement runs
Open each phase to see what it produces and who does what.
Sample vCISO deliverable
An illustrative sample with placeholder names and data, not a real client document.
| Risk | Rating | Treatment | Owner | Status |
|---|---|---|---|---|
| Customer data in shared drives open to all staff | High | Restrict and review access | IT lead | In progress |
| No tested restore for the finance system | High | Quarterly restore test | Finance + IT | Planned |
| Supplier with admin access, no contract clause | Medium | Add security terms, limit access | Operations | Open |
| Laptops without disk encryption | Medium | Enforce through MDM | IT lead | Done |
Decisions needed this quarter: approve access policy · budget for backup testing
VCISO engagement formats
Fixed-scope project
- When it fits
- You have a defined outcome: a migration, a test, a certification or a rollout.
- Included
- Agreed deliverables, a named lead, progress updates and handover.
- How it is priced
- Quoted after a scoping call; the price depends on the number of users, sites, applications or controls in scope.
Ongoing support retainer
- When it fits
- You want someone to run, monitor and improve things month after month.
- Included
- Monitoring, changes, reviews and a monthly report within an agreed scope.
- How it is priced
- A monthly fee quoted after a scoping call, based on users, devices and systems covered.
Advisory hours
- When it fits
- Your team does the work and wants expert review or answers.
- Included
- Calls, document and design reviews, and written recommendations.
- How it is priced
- A block of hours agreed in advance; the rate is quoted after a short call.
VCISO tools we use
- Microsoft Defender
- Jamf
- Zoho
ITCCS is an independent consultancy. Product names and logos are trademarks of their respective owners, shown only to identify the platforms we work with. No partnership, certification or endorsement is implied.
Standards for vCISO
- ISO/IEC 27001Information security, certification-ready ISMSLearn moreRead about ISO/IEC 27001
- India DPDP Act 2023Personal data protection complianceLearn moreRead about India DPDP Act 2023
- NIST CSF 2.0Security programme baselineLearn moreRead about NIST CSF 2.0
- SOC 2Readiness for US customersLearn moreRead about SOC 2
We implement and prepare organisations for these standards. Certification is issued by accredited bodies.
Related certifications
All certificationsA virtual or fractional CISO is a part-time security leader who does the work of a Chief Information Security Officer (strategy, risk, policy, reporting and audit oversight) for a set number of days or hours each month.
Usually when enterprise customers start sending security questionnaires, when ISO 27001 or SOC 2 becomes a sales requirement, or when investors or the board ask who owns cyber risk.
The founder, Akash Sengar, leads every vCISO engagement personally. Hands-on technical work such as testing or migrations can come from our other services when you need it.
No. A vCISO sets direction, owns risk and reports to leadership. Monitoring and day-to-day operations stay with your IT team or provider; we can help you choose and oversee them.
No. We prepare you and oversee readiness. Certification and SOC 2 opinions come from independent certification bodies and licensed CPA firms.
The cadence (monthly or quarterly), the number of days each period, how many frameworks and customer reviews are in scope and how much hands-on work is included. It is agreed in the proposal.
We use named accounts with the least access needed, prefer your own admin tools over shared passwords, move files only through encrypted channels and remove our access at handover. As your vCISO we usually work with read-only or reviewer roles in your admin consoles, plus access to the shared folder where policies and evidence are kept. Our full practices are on our Trust page.
We keep the roadmap, risk register and reporting running on the agreed cadence, or hand everything over to your own security lead with a documented handover.
Let's build what's next.
Tell us about your infrastructure, security or automation goals. We reply with questions, then a written plan with scope and next steps.
- Response
- Usually within one business day
- Location
- Worldwide
What happens next
- 01
Reply
- 02
Discovery call
- 03
Proposal