vCISO Services - 90-Day Plan for a Mid-Sized Company

Updated: 17 September 2026

What are vCISO services? vCISO services are a model in which an external expert performs the head-of-information-security function for an organisation – setting strategy, running risk management and maintaining regulatory compliance – billed for actual time worked rather than as a full-time salary. They suit mid-sized companies that carry real regulatory obligations (ISO 27001, NIS2, DORA, PCI DSS) but do not maintain an in-house security function.

Canonical definition: A virtual CISO (vCISO) is an external information security expert who performs the chief information security officer function on a service basis, responsible for the strategy, risk management and regulatory compliance of an organisation without its own security department.

vCISO services for a mid-sized company – in brief:

A vCISO owns security strategy, the risk register and regulatory compliance, working the number of hours that matches the organisation’s scale.
Implementation starts with a risk and gap assessment – the roadmap is built on that evidence, not the other way round.
A proven launch model is a first 90 days plan split into three phases: diagnosis (days 0-30), prioritisation (days 31-60) and first implementations (days 61-90).
One vCISO can run ISO 27001, NIS2, DORA and PCI DSS programmes in parallel by mapping shared controls instead of treating each regulation separately.
vCISO effectiveness is measured by concrete indicators – risk coverage, gap-closure rate and audit readiness – not by hours logged.
Patronusec delivers vCISO services as an accredited QSA with an in-house penetration testing team, combining strategic advisory with hands-on security testing and compliance maintenance.

What is a vCISO service and when does a mid-sized company need one?

A vCISO service outsources the chief information security officer function – an external expert owns strategy, risk and compliance but bills for real time worked rather than a salaried post. A mid-sized company needs one when a regulatory obligation or a customer requirement appears and nobody in the structure formally owns security.

The signals that it is time for a virtual CISO are usually specific:

a customer or supply-chain partner demands an ISO 27001 certificate or a completed security questionnaire,
the organisation falls within scope of NIS2 or DORA and must name someone accountable for risk management,
the company processes payment card data and faces a PCI DSS assessment,
after a security incident the board wants a single owner of the topic rather than diffuse responsibility inside IT.

A full-time CISO is hard to justify in a mid-sized company – expertise at that level is expensive, and for most of the year the workload does not fill a full post. The fractional model resolves this: the organisation buys exactly as much expert time as it genuinely needs.

A vCISO service differs from ad-hoc consulting in that the virtual CISO carries continuous accountability for the security programme, rather than delivering a single project and disappearing.

Patronusec Insight: In our project experience, the most common mistake is treating security as an IT task. IT maintains infrastructure, but it does not own business risk, data classification or residual-risk acceptance decisions. In the vCISO model we separate these roles – giving the board a single point of contact accountable for security strategy, and IT a clear operational remit.

How does a vCISO differ from a full-time CISO and from IT outsourcing?

A vCISO differs from a full-time CISO in billing model and flexibility – it delivers the same strategic function, but on a fractional basis and without employment costs. It differs from IT outsourcing in level of accountability: an IT provider maintains systems, whereas a vCISO owns risk, compliance and board-level decisions.

Three roles are often confused, so it helps to separate them concretely:

Role	Owns	Billing model	When it makes sense
Full-time CISO	Full-scope security strategy and operations	Full salary + employment costs	Large organisation, sustained high workload
vCISO (virtual CISO)	Strategy, risk, compliance, oversight of implementations	Hours / monthly retainer	Mid-sized firm with regulatory duties, no security team
IT outsourcing / MSP	Infrastructure and systems maintenance	Service agreement / SLA	Day-to-day IT administration, not risk management

The key difference is decision-making accountability. Cybersecurity outsourcing at the operational level (monitoring, patching, configuration) will execute technical tasks, but it will not accept business risk on the board’s behalf or build an information security management system aligned with audit requirements.

A vCISO owns what an IT provider does not: the risk register, the security policy, data classification and the organisation’s readiness for a compliance audit.

How do you choose a vCISO services provider – which criteria decide?

You choose a vCISO services provider on four criteria: genuine audit competence, experience in your specific regulation, the ability to support you technically (testing, scanning) and a clear billing model. Hourly rate is secondary to whether the provider will actually take the organisation to compliance rather than merely listing the gaps.

What to look for when selecting vCISO services for mid-sized companies:

Audit competence – whether the provider knows the requirement from the perspective of someone who runs audits (ISO 27001 lead auditor, accredited QSA), or merely summarises the standard’s documentation.
Regulatory fit – experience in the exact regulation that applies to you (DORA demands different competence from PCI DSS).
Technical backing – whether the vCISO can launch penetration testing and vulnerability scanning under one partner, instead of sending you to further vendors.
Billing transparency – a fixed quote after a scope assessment rather than an open-ended hourly meter.
Continuity – whether the provider ensures expert cover and retained knowledge of your organisation when one person is unavailable.

Patronusec Insight: The most common trap in provider selection is focusing on the hourly rate rather than on who will put their name to audit readiness. As an accredited QSA with a penetration testing team, we view the security programme through an auditor’s eyes from day one – so that vCISO recommendations are immediately acceptable in the later compliance audit rather than needing rework.

Not sure whether your company is ready for an ISO 27001, NIS2 or DORA audit?

As part of a free scope assessment we run an initial gap analysis of your security programme – in a single conversation we identify which areas need attention before a formal audit and what scope of vCISO work genuinely makes sense at your scale.

Book a free scope assessment

What does implementing a vCISO look like step by step (first 90 days)?

Implementing a vCISO over the first 90 days runs in three phases: diagnosis and risk assessment (days 0-30), prioritisation and roadmap (days 31-60), and first implementations and quick wins (days 61-90). This structure ensures decisions follow a real picture of risk rather than guesswork.

Phase 1 (days 0-30) – diagnosis and risk assessment

inventory of assets, data and critical systems,
risk assessment and building the risk register,
gap analysis against the target standard (ISO 27001, NIS2, DORA or PCI DSS),
review of existing policies versus actual practice.

Phase 2 (days 31-60) – prioritisation and roadmap

ranking gaps by risk and regulatory requirement,
a roadmap with deadlines and task owners,
decisions to accept, reduce or transfer residual risk,
agreeing the operating model with IT and the board.

Phase 3 (days 61-90) – first implementations

rolling out security policies and incident response procedures,
launching the first technical controls and staff training,
starting regular security testing where risk is highest,
a board report with the first measurable results.

A solid first 90 days plan begins with a risk assessment, not with deploying tools – the reverse order spends money on areas that were never the priority.

Example: an e-commerce firm entering NIS2 scope usually discovers in the first phase that its greatest risk is not infrastructure but the absence of a formal incident-reporting process and unmanaged privileged access. The vCISO addresses these first, because they deliver the largest risk reduction for the least effort.

Patronusec Insight: Our projects show that the first 30 days decide the success of the whole implementation. If the risk assessment is superficial, the roadmap rests on false priorities. That is why in the vCISO model we pair management-level diagnosis with penetration testing where claims must be verified technically – so the risk register reflects the actual state, not the declared one.

Which regulations does a vCISO cover – ISO 27001, NIS2, DORA and PCI DSS?

A vCISO covers every regulation that applies to the organisation within a single information security management programme – most often ISO 27001, NIS2, DORA and PCI DSS. Rather than running each regulation separately, the vCISO maps shared controls (risk management, access control, incident response), cutting duplicated work.

Briefly, the scope of each regulation:

ISO 27001 (the ISO/IEC 27001:2022 standard) – the international standard for an information security management system; certifiable and often required contractually across the supply chain.
NIS2 (EU Directive 2022/2555) – EU cybersecurity requirements for essential and important entities; organisations trading with the EU may fall within its reach even from outside the bloc.
DORA (Digital Operational Resilience Act) – in force since 17 Jan 2025, covering the operational resilience of financial-sector entities.
PCI DSS (currently v4.0.1) – the payment card data security standard for organisations processing card payments.

The common denominator across these regulations is risk management, access control, data classification and incident response. Information security management run by a single vCISO lets you build one risk register and one set of policies that satisfy several standards at once. For UK organisations, the same programme also underpins UK GDPR duties overseen by the ICO.

An organisation subject to several regulations at once does not need several security programmes – it needs one programme correctly mapped to every requirement that applies to it.

Patronusec provides regulatory advisory for ISO 27001, NIS2 and DORA end-to-end – from gap analysis, through control implementation, to compliance maintenance.

How much do vCISO services cost and how do you bill them sensibly?

The cost of vCISO services depends on the hours committed, the regulatory scope and whether the programme is being built or already maintained. A sensible model is a fixed monthly pool of hours matched to the phase – larger during implementation, smaller during maintenance – instead of an open meter or a rigid salary.

Three typical billing models for cybersecurity outsourcing in the vCISO role:

Monthly retainer – a fixed pool of hours (for example, days per month) for ongoing oversight and compliance maintenance.
Implementation project – a quote for a specific goal (ISO 27001 certification, DORA audit readiness) with a defined scope and deadline.
Hybrid model – an intensive implementation start, then a shift to a lighter maintenance retainer.

A sensible principle: the cost of a vCISO should be compared not with zero, but with the alternative – a full-time CISO plus employment costs, or the cost of an incident and a lost contract due to non-compliance. The fractional model is typically a fraction of the cost of a full post while retaining the same strategic function.

The cheapest vCISO in real terms is not the one with the lowest hourly rate, but the one who takes the organisation to compliance without repeat audits and documentation rework.

Wondering what level of vCISO engagement makes sense for your company?

After a free scope-assessment call we present a fixed quote with a clear hours envelope matched to the implementation phase – no open meter. We also identify which tasks are worth assigning to the vCISO and which to keep in-house within IT.

Request a vCISO services quote

How do you measure vCISO effectiveness – which KPIs make sense?

vCISO effectiveness is measured by the results of the security programme, not by hours worked. Sensible indicators are the coverage of identified risks by controls, the gap-closure rate, audit readiness and incident response time – all measurable and reportable to the board.

Indicators worth writing into a security strategy advisory agreement:

Risk coverage – the share of risks in the register covered by a control or a conscious acceptance decision.
Gap-closure rate – the number of non-conformities closed against the roadmap plan.
Audit readiness – the share of the standard’s requirements with complete as-built documentation.
Response maturity – the existence and testing of incident response procedures.
Security testing results – the trend in the number and criticality of vulnerabilities between successive tests.

Well-defined KPIs turn a vCISO service from abstract advisory into a measurable programme. The board then sees not hours on an invoice, but falling risk and rising audit readiness.

A security programme without indicators cannot be defended to the board or the auditor – measurability is what separates risk management from firefighting.

Is a vCISO alone enough, or do you also need a security team?

For most mid-sized firms a vCISO alone is enough as the owner of strategy and compliance, provided it has access to technical backing – penetration testers, vulnerability scanning and operational IT support. The vCISO owns direction and decisions; technical delivery is provided by the team or partner that runs the tests.

In practice this means a division of roles:

vCISO – strategy, risk register, policies, compliance, contact with the board and auditor,
technical backing – penetration testing, vulnerability scanning, control configuration,
in-house IT – day-to-day administration and delivery of operational recommendations.

A model in which the vCISO and the penetration testing team come from one provider removes a common problem: strategic recommendations drifting apart from technical findings. When the same partner combines the advisory and the testing role, the security programme is coherent from board level down to a single vulnerability.

A vCISO for companies without a security team works best as part of one ecosystem of services – strategy, testing and compliance from one partner rather than three independent vendors whose findings must be reconciled by hand.

Patronusec combines the vCISO role with penetration testing, vulnerability scanning and regulatory advisory under one partner – so that security strategy translates directly into verifiable technical action.

Common mistakes when implementing a vCISO

❌ Running each regulation separately – this duplicates work and cost instead of mapping shared controls across several standards at once.

❌ Starting by buying tools instead of by assessing risk – technology deployed before diagnosis usually hits the wrong priority.

❌ Treating the vCISO as an ad-hoc consultant for a single project – without continuous accountability the security programme will not survive after implementation ends.

❌ Confusing the vCISO role with IT outsourcing – an IT provider will not accept business risk or build an information security management system.

❌ No defined KPIs – without indicators the service becomes unverifiable and the board sees no result.

FAQ – vCISO services

What is the difference between a vCISO and a virtual CISO?

They are the same model – “vCISO” and “virtual CISO” are synonyms. Both mean an external expert who performs the chief information security officer function on a fractional basis, responsible for the strategy, risk management and regulatory compliance of an organisation without its own security department.

Does a mid-sized company really need a vCISO?

Yes, if it is subject to a regulation (NIS2, DORA, PCI DSS), must certify to ISO 27001, or answers customer security requirements. A vCISO gives an accountable owner of security without the cost of a full post. Firms with no regulatory duties and no sensitive data can start with an ad-hoc risk assessment.

How long does a vCISO implementation take?

The core launch programme covers the first 90 days, split into diagnosis (days 0-30), prioritisation (days 31-60) and first implementations (days 61-90). Full certification, such as ISO 27001, takes longer and depends on the organisation’s starting maturity, but measurable results appear within the first quarter.

Will a vCISO replace the in-house IT department?

No – a vCISO and IT play different roles. IT maintains infrastructure and systems, whereas a vCISO owns security strategy, the risk register, compliance and board-level decisions. The vCISO sets direction and is accountable for results; IT delivers the operational recommendations. It is collaboration, not replacement.

How much do vCISO services cost at Patronusec?

The cost depends on the hours committed, the regulatory scope and the programme phase (implementation versus maintenance). After a free scope-assessment call we present a fixed quote with a clear hours envelope, with no open meter. For clients combining a vCISO with security testing or an audit we offer preferential packages.

How do I start a vCISO engagement with Patronusec?

The engagement starts with a free scope assessment, during which we run an initial gap analysis and define the realistic scope of vCISO work at your scale. On that basis we present a fixed quote and a first 90 days plan covering the risk assessment, the roadmap and the first implementations.

Blog space

vCISO Services for a Mid-Sized Company – How to Implement a Virtual CISO (First 90 Days Plan)

In this article you will learn:

Table of Contents