Overview
Many UK scale-ups, charities and mid-sized firms need senior security leadership but not a full-time CISO salary. Our vCISO joins your leadership meetings remotely, owns the security roadmap and speaks to customers, auditors and insurers on your behalf.
Growing companies need security leadership long before they can justify a full-time Chief Information Security Officer. Customers ask hard questions, auditors want evidence, boards want assurance — and someone needs to set priorities.
Our vCISO service provides an experienced security leader for a defined number of days per month. Your vCISO assesses your current posture, builds a risk-based roadmap, owns security policies and governance, leads compliance programmes such as SOC 2 and ISO 27001, answers customer security questionnaires and reports progress to leadership and the board.
Because the vCISO is backed by our offensive, SOC and GRC teams, strategy turns into execution quickly.
Compliance support for UK organisations
- A practical roadmap from Cyber Essentials to Cyber Essentials Plus and on to ISO 27001
- Data Security and Protection Toolkit (DSPT) support for NHS suppliers
- UK GDPR security controls, breach procedures and supplier assurance questionnaires
- Readiness for the Cyber Security and Resilience Bill if you are an MSP or supply essential services
What's included
Our approach
- AssessCurrent-state review of people, process and technology.
- PrioritiseRisk-based roadmap with quick wins and milestones.
- GovernPolicies, ownership and security committee.
- ExecuteDrive projects with your teams and ours.
- ReportMonthly and quarterly progress and risk reporting.
What you receive
- Security maturity assessment
- 12-month security roadmap
- Policy framework
- Risk register
- Board-ready security reports
Standards & frameworks
- NIST CSF 2.0
- ISO/IEC 27001:2022
- CIS Controls v8
- SOC 2
- UK GDPR & DPA 2018
- UK GDPR Art. 32
Frequently asked questions
How much time does a vCISO spend with us?
Engagements are typically a set number of days per month, adjusted to your stage and priorities.
Can the vCISO answer customer security questionnaires?
Yes. Supporting sales with questionnaires, calls and trust documentation is a common vCISO responsibility.
When should we hire a full-time CISO instead?
Usually when security needs daily executive attention or a large team to lead. A vCISO can help you define and hire that role.
Can you help us get Cyber Essentials?
Yes. We run a readiness review against the current Cyber Essentials requirements, help you fix gaps and prepare evidence. The certification itself is issued by an IASME-licensed Certification Body, which you choose. We don't issue certificates ourselves.
Do you quote in pounds sterling?
Yes. UK proposals are fixed-price and quoted in GBP. Prices exclude VAT where VAT applies to cross-border services. We confirm the treatment for your organisation in the proposal.