Security leadership in an agreed volume
For example a fixed number of hours or days per month – you know in advance what you get and what it costs.
vCISO
Security manager as a service (vCISO) – an experienced security lead without a full-time salary
We take on the leadership of your information security in an agreed volume: risks, policies, supplier assessment, incidents, audits and reporting to management. The role gets filled without hiring for it.
Who it is for
Who this service is for
- Companies that need a security manager but not a full-time workload
- Growing companies whose clients and partners are starting to send security questionnaires
- Organisations that must appoint the role because of a law or a standard
- Companies that want to keep a certificate alive after passing the audit
What is included
What the service includes
Risk management and policy upkeep
The risk register stays alive, policies get reviewed and updated when something changes.
Supplier and contract security assessment
Security questionnaires, supplier assessment and reviewing contract terms – both incoming and outgoing.
Incident handling and readiness
An incident handling procedure, roles and exercises – and support when something actually happens.
Support for audits and client questions
We are the person who answers the auditor and the client's security team, so your team does not have to learn it.
Reporting to management
A regular overview in language management understands: what changed, what is open, what needs deciding.
Process
How we work
Introductory mapping
We review the situation, obligations and expectations and agree the volume and priorities.
The first 90 days
Quick wins and the foundation: the risk picture, the most critical policies and incident readiness.
A regular rhythm
Agreed meetings, tracking of actions and steady work – security is not a project but a process.
Management reviews
A periodic overview for decision-makers with proposals on what to do next.
Handover when you hire your own
If you decide to hire for the role, we hand the work over documented – our aim is not to make you dependent on us.
Outcome
What you end up with
- The security manager role filled without a full-time hire
- A living risk register and maintained policies
- Answers to clients' and partners' security questionnaires
- A regular, understandable overview for management
- Readiness for an audit and for an incident
FAQ
Frequently asked questions
How much time do you dedicate to us?
We agree the volume at the start – it might be a few days a month, or more when a certification project is running. The volume can change when the situation changes.
Do you replace our IT team?
No. A security manager directs, measures and is accountable – the IT team or partner implements. We do not take over your IT administration; we give it direction and requirements.
What happens if we have an incident?
We agree how and within what time you reach us and what role we play during an incident. For organisations with a statutory reporting duty we also help with the notifications.
Does this work even if we have no documents at all?
Yes – that is actually one of the most common starting points. We begin with the risk picture and the most important things, not with a perfect document set.
Let's work out the size of role you need
We will talk through your obligations, client expectations and current team, and set a volume that makes sense.
See also
Related services
ISO 27001 consulting
Preparing your company for the ISO 27001 audit.
Read more →Cyber-security roadmap
Assessing the current state and a clear roadmap for improving cyber security.
Read more →Information security audit and assessment
Independent assessment and an audit-readiness check.
Read more →