Transparent Engagement Models for Growing Businesses
Choose the engagement model that fits your stage, budget, and security maturity. All models include access to our experienced vCISO team.
Program Assessment
Strategic Baseline
One-Time Engagement
- ✓Comprehensive program maturity assessment
- ✓Gap analysis against industry frameworks
- ✓Prioritized remediation roadmap
- ✓Executive summary and recommendations
- ✓2-4 week engagement timeline
Best for
Companies that want to understand their current state before committing to a program engagement.
Most Popular
vCISO Retainer
Ongoing Program Leadership
Monthly Retainer
- ✓Everything in Program Assessment
- ✓Continuous security program leadership
- ✓Compliance program management (SOC 2, ISO 27001, etc.)
- ✓Vendor questionnaire response management
- ✓Monthly steering committee & executive briefing
- ✓Quarterly maturity assessment
- ✓Risk register management
- ✓Policy & standards lifecycle management
Best for
Companies that need sustained security leadership and program management.
Compliance Sprint
Targeted Certification Readiness
Fixed-Scope Engagement
- ✓Certification-specific scope and roadmap
- ✓Control implementation and evidence prep
- ✓Policy and procedure development
- ✓Auditor coordination and management
- ✓Finding remediation support
- ✓Post-audit monitoring setup
Best for
Companies pursuing SOC 2, ISO 27001, HITRUST, or similar certifications for the first time.
What to Expect
A Typical vCISO Engagement
Monthly
- Security program steering committee
- Compliance program status review
- Risk register review and updates
- Vendor questionnaire pipeline management
- Security metrics reporting
Quarterly
- Program maturity assessment
- Policy and standards review cycle
- Compliance readiness checkpoint
- Strategic planning and priority adjustment
Annually
- Comprehensive program assessment
- Roadmap refresh and strategic planning
- Audit coordination and management
- Budget and resource planning
FAQ
Frequently Asked Questions
What exactly does a vCISO do?
A virtual CISO provides the same strategic security leadership as a full-time CISO — program governance, risk management, compliance oversight, vendor coordination, and executive reporting — on a fractional basis. We operate as a member of your leadership team.
How is this different from hiring a security consultant?
Consultants typically deliver a project and move on. A vCISO provides ongoing leadership and accountability. We don't hand you a report and wish you luck — we own the program, drive execution, and stay engaged.
Do you provide SOC/MDR or security engineering services?
No, and that's by design. We focus exclusively on governance and program management. For detection/response and engineering, we help you evaluate, select, and manage the right partners.
What size companies do you work with?
We primarily serve companies with 50 to 1,000 employees — organizations that have outgrown ad-hoc security but aren't ready for a full-time CISO.
How quickly can you help us get SOC 2 certified?
A typical first-time SOC 2 Type I takes 3–6 months. ISO 27001 typically takes 6–12 months. We'll give you an honest timeline assessment during our initial consultation.
What frameworks do you support?
SOC 2, SOC 1, ISO 27001, NIST CSF, NIST 800-53, HIPAA, HITRUST CSF, and PCI DSS. If you're facing a framework not listed, reach out — we likely have experience with it.