Every growing company reaches the point where someone has to be in charge of security. Usually the trigger is external. A large customer sends a security questionnaire with two hundred questions. An investor's due diligence asks who owns information security. A public tender requires the ENS. The board asks what would happen after a ransomware attack, and nobody in the room can answer with authority.
At that point the CTO or the head of IT has usually been carrying security on top of everything else. The work gets done, but the decisions are made in the gaps between other priorities, and nobody can say with confidence what the company's risk actually is. A virtual CISO is one way to close that gap without creating a new executive position.
What does a CISO do, and what changes when the role is virtual?
A Chief Information Security Officer is the person accountable for an organisation's information security. The CISO sets the security strategy, owns the risk assessment and the policies, decides which risks are treated and which are accepted, leads the response to serious incidents and reports to management in business terms. In a large company the CISO leads a team. In a smaller one, the role often has no full time owner at all.
In practice, the CISO is the person who turns a vague worry about security into decisions. Which systems hold the information that matters most. Which threats are realistic for this company and which are noise. How much risk management is willing to carry, and what it costs to reduce the rest. Without someone in that position, those questions are answered implicitly, by whoever happens to be configuring a firewall or signing a supplier contract that week.
A vCISO covers the same responsibilities, but the person works with the company on a retained basis instead of joining the payroll. The senior judgement is the same; what changes is how it is delivered. The vCISO shares time between several organisations, works through the company's own documentation and systems, and steps in when a decision needs senior security input. Because they see several organisations, they also bring a sense of what auditors, customers and attackers are actually doing at the moment, which a single in house hire builds more slowly.
What does not change is accountability. A vCISO is not an adviser who sends recommendations and leaves. The point of the role is that someone is in charge of your security and answers to your management for it, with decisions that are documented and owned.
The regulatory context makes this more pressing. NIS2 requires management bodies of essential and important entities to approve cybersecurity risk measures, oversee their implementation and follow training, and it allows them to be held liable for failures (Article 20). DORA places final responsibility for ICT risk on the management body of financial entities (Article 5). In both cases, management needs someone who can advise it on security with real authority, because "we trusted IT" is not an answer either regulation accepts.
vCISO, full time CISO or MSSP: what each one covers
These three options are often compared as if they were substitutes. They are not. They answer different questions, and the useful comparison is about scope and responsibility.
A full time CISO is an employee who owns the security strategy and usually leads a team. Their advantage is depth: they are inside every conversation, know the business closely and are available at any moment. They still need people and tooling underneath them to operate security day to day. A CISO hired into a company with no security team often spends the first year building that team and choosing tools before the programme itself moves.
A vCISO owns the same strategy and judgement on a retained basis. Context comes from an ongoing engagement and from access to the company's ISMS, risk register and evidence, rather than from sitting in every meeting. A vCISO decides and advises; on their own, they do not operate monitoring or detection tools. The quality of a vCISO therefore depends heavily on the quality of the information they work from: with a current risk register and real evidence, they can make sound decisions quickly; with scattered documents, they spend their time reconstructing the basics.
A managed security service provider (MSSP) operates security technology under contract: monitoring, detection, response, sometimes vulnerability scanning. An MSSP reports on the service it runs. It does not set the company's security strategy, own the risk decisions or answer a customer's questionnaire about your governance. When an MSSP raises an alert about an exposed server, someone inside the company still has to decide whether to take it offline, accept the risk or fix it next sprint.
.png)
In practice, many companies combine them: a vCISO for direction and judgement, and an operated monitoring layer for detection and response. The real question is which gap you have. If nobody can make security decisions with authority, the gap is judgement. If decisions are made but nobody watches the systems, the gap is operation. Most companies preparing for a first certification have both gaps at once, which is why the choice is rarely one option alone.
What a vCISO handles in practice
The work of a vCISO is mostly decisions and documents that other people depend on. These are the areas that take most of the time.
Customer security questionnaires and due diligence
Enterprise customers send questionnaires before they sign, and many repeat them every year. They range from short custom spreadsheets to standard formats such as the Shared Assessments SIG or the Cloud Security Alliance CAIQ, with hundreds of questions about access control, encryption, incident response, suppliers and business continuity. Investors run security due diligence before a round or an acquisition, and their questions go further into governance: who owns security, how risk is reported to the board, what incidents have occurred.
Answering well requires knowing what controls actually exist, where the evidence is and how to describe residual risk honestly. The most common mistake is optimism: a salesperson or a CTO under deadline pressure answers "yes" to a control that exists only on paper, and the answer becomes a contractual commitment. If the customer later audits it, or an incident exposes the gap, the company has a commercial problem on top of a security one.
A vCISO answers from the ISMS documentation, so the answers are consistent from one questionnaire to the next and match what an auditor would find. Over time, the answers become a reusable library, and the questions that cannot be answered well become a list of improvements with priorities attached. The questionnaire stops being a fire drill and becomes an input to the security programme.
Architecture and tooling decisions
A move to a new cloud provider, a new product feature that processes personal data, the choice of an EDR or an identity provider: each of these has security consequences that are cheaper to address before the decision than after it. Retrofitting single sign on across twenty SaaS tools, or adding encryption to a data pipeline already in production, costs far more than designing it in.
A vCISO reviews the design, points out the risks and records the decision. The review is usually short and practical: where the data will live and who can reach it, how access will be granted and removed, what logging exists, what happens if the supplier fails, and whether the change affects the scope of an existing certification. Sometimes the answer is to go ahead as planned; sometimes it is a small change, such as enforcing MFA or separating a production environment, that removes most of the risk.
Recording the decision matters as much as making it. ISO 27001 auditors and enterprise customers regularly ask why a system was built the way it was. A short decision record, with the risk considered and the reason for the choice, answers that question a year later, when the people involved may no longer remember or may have left.
Audits and certification support
For ISO 27001 or the ENS, the vCISO prepares the organisation for internal and external audits, leads the management review, and makes sure risk acceptance decisions are taken by the right people and documented. ISO 27001 expects top management to show leadership of the ISMS (clause 5.1), risk owners to approve the risk treatment plan and accept residual risk (clause 6.1.3), and management to review the system at planned intervals (clause 9.3). These are exactly the requirements that fail when nobody senior owns security.
Before an audit, the vCISO checks that the evidence shows controls operating over time rather than appearing the week before, runs or commissions the internal audit, and makes sure nonconformities from previous audits have been closed with a real root cause rather than a cosmetic fix. During the audit, they are the person who can explain why a control was designed a certain way or why a risk was accepted.
The certificate itself is issued by an accredited certification body after its own audit; the vCISO's role is to make sure the management system behind it is real. Our article on what a certification audit actually tests explains what the auditor looks for.
The ENS security officer role
The ENS requires separation of responsibilities. Under article 11 of Royal Decree 311/2022, the security officer must be a different person from the officer responsible for operating the systems. The ENS defines several roles: the information owner, the service owner, the security officer and the system officer. The security officer decides on security requirements and supervises them; the system officer operates the systems that meet them. The separation exists so that the person checking security is not marking their own work.
In a small or medium company this is hard to staff internally, because the people who know the systems are usually the ones running them. Naming the IT manager as both security officer and system officer is a common finding in ENS audits, and naming someone without real security knowledge as security officer just to satisfy the organisation chart does not survive the auditor's interviews either.
A vCISO can act as the security officer, keeping that separation real. In practice, that means approving the security policy and its updates, reviewing the system categorisation and the Statement of Applicability, supervising incident management and reporting to the organisation's management. The CCN-STIC 801 guide describes these responsibilities in detail. If you are unsure whether the ENS applies to you, start with which ENS level and type of conformity you need.
Reporting to management
Management bodies under NIS2 and DORA have to understand the risk they are approving. A vCISO translates technical findings into business terms: what could stop operations, what a customer would see, which risks are being accepted and why. A list of two hundred vulnerabilities means nothing to a board; three risks that could stop invoicing for a week, with the cost of reducing each, are something management can decide on.
Good reporting is regular and comparable from one period to the next. It shows the status of the main risks, progress on the treatment plan, incidents and near misses, results of audits and tests, and the decisions management needs to take. It also records those decisions, so that when management accepts a risk, the acceptance is explicit and dated.
That reporting is also evidence: it shows an auditor or a regulator that governance exists beyond the policy documents. Under NIS2, where management can be held liable, a documented record of what management was told and what it decided protects the people in the room as much as the company.
Signs your company needs a vCISO
The need rarely announces itself directly. These are the situations where it usually becomes visible:
- Security questionnaires sit on the CTO's desk. Answers take weeks, vary between customers and depend on one person's memory.
- A deal or a tender requires a certification. ISO 27001, the ENS or SOC 2 has become a commercial requirement, and nobody owns the programme.
- A certification project has stalled. Documents exist, but nobody has the authority to make decisions and move it forward. We cover this case in how to restart a stalled ISO 27001 project.
- The board or investors ask about security. The answer needs to come from someone who can speak to risk, not only to tools.
- The ENS requires role separation you cannot staff. The people who know the systems are the same ones operating them.
- Incidents are handled from scratch every time. There is no agreed process, no owner and no record of what was decided.
None of these on its own proves you need a vCISO. Two or three together usually mean security decisions are being made by default rather than by someone accountable for them.
The cost of leaving it that way tends to appear at the worst moment: a deal that slips a quarter because the questionnaire cannot be answered, a tender lost because the ENS certificate is not ready, or an incident where nobody knows who decides whether to notify. None of these is caused by a missing tool. Each is caused by a missing owner.
When a company with a CISO still uses a vCISO
A vCISO is not only for companies without a security function. Many organisations with their own security team use one to add senior capacity where it is missing.
The most common case is a saturated CISO. One person cannot run daily security operations, answer every customer questionnaire, prepare the next audit and attend every architecture review. A vCISO takes part of that load, usually the governance and customer facing work, so the internal team can focus on operating security. The split needs to be explicit: who owns which decisions, who signs off risk acceptance, and how the two keep each other informed.
Specialist frameworks are another reason. A company that knows ISO 27001 well may need experience of the ENS for a public tender, or of DORA because it supplies ICT services to banks. Each framework has its own logic: the ENS assigns measures by system category rather than by risk selection, and DORA adds requirements on ICT third party risk and resilience testing. A vCISO with that background shortens the learning curve without a permanent hire.
Companies also use a vCISO as a second opinion before a major decision, or to cover a transition when a CISO leaves. The reverse is also true: if your company already has a CISO with time and the relevant experience, a vCISO is probably not what you need.
How to tell a real vCISO from a support channel
The term vCISO is used for very different offerings, from a senior person who knows your business to a shared chat channel answered by whoever is available. Before you choose one, check these points:
- Continuity. Will the same person work with you over time and build knowledge of your business, or does each question go to a different expert?
- Access to your ISMS. Does the vCISO work from your risk register, policies and evidence, or does every answer start from zero?
- Accountability. Are decisions documented, attributed and reviewed, or are they suggestions you have to own alone?
- Scope. Does the role cover judgement on architecture, risk acceptance and customer questions, or only answers to compliance tickets?
- Connection to operations. Does the vCISO work alongside whoever monitors your systems, so that decisions and alerts inform each other?
The difference shows up quickly in practice. A support channel answers the question you asked. A vCISO asks why you are asking it, notices that the question reveals a gap in your risk assessment, and follows up until the gap is closed.
Ask for an example of a recent decision a vCISO took for a client of a similar size, and what documentation came out of it. The answer tells you more than any description of the offering.
How a vCISO works on the Qalea platform
On the Qalea platform, the vCISO is senior security judgement anchored in the ISMS that already lives there. The risk register, policies, Statement of Applicability and evidence are in the same place, so customer questionnaires are answered from the existing documentation, and architecture or tooling reviews start from what the company has already decided.
The vCISO works alongside Qalea's team, which runs compliance operations on the platform and the security monitoring layer, so a decision about a risk and the alerts related to it are not handled in separate worlds. When monitoring shows that a risk the vCISO accepted is being actively exploited elsewhere, the decision can be revisited with the facts in front of everyone. The same applies to companies with their own security team: the vCISO adds senior capacity and specialist framework experience on top of the people who already run the programme.
This is also why a compliance platform alone does not replace the role. A platform keeps the documentation current; it does not take decisions or answer to your management. Our article on what a compliance platform does not do covers that distinction in detail. For more on running security as a repeatable process, see the compliance operations articles.
