A full time CISO costs a 50 person company north of $250K fully loaded. A non-CISO who owns security part time, with a half finished policy and a one week old risk register, costs the company the SOC 2 audit. The virtual CISO program exists to fill that gap, and the gap is filled well or filled badly depending on three structural decisions the small org makes on day one.
Most small orgs do not need a full time CISO. Most small orgs do need someone who owns the security program, shows up to the board, and can be handed to the assessor when SOC 2 lands. The vCISO model has been around for fifteen years and is now mature enough that the assessors and the audit committee both understand the shape. The shape still varies wildly between a vCISO program that works and a vCISO arrangement that is just an outsourced signature.
What the program actually is
Fractional engagement at a fixed cadence, typically a day a week or a day a month, with a defined scope and a defined deliverable. The vCISO writes the policy, builds the risk register, runs the incident response plan, and sits in the audit kickoff. The artifacts get signed off by an executive sponsor inside the org, which matters more than the vCISO signature on the document itself. The sponsor owns the program. The vCISO executes against it.
Audit liaison is the work most small orgs underestimate. The assessor asks a question in a language the small org does not speak. The vCISO translates the question, the answer, and the follow up into a language the executive sponsor can defend in a board meeting. Without that translation, the small org ends up answering the wrong question for the wrong reason and paying for a remediation cycle the vCISO would have avoided.
What makes the program work
Executive sponsor first. The CEO, the COO, the person the assessor will ask if the policy is being followed. The sponsor has to have authority over the IT lead and the operations lead, otherwise the vCISO writes a playbook nobody runs. The vCISO cannot fire the IT lead. The sponsor can. The relationship is the program.
Internal owner second. The IT manager or the operations lead who does the day to day, the patching, the access reviews, the endpoint management. The vCISO writes the playbook. The internal owner runs the playbook. The handoff has to be clean or the playbook does not get run. The vCISO who tries to do both jobs is the vCISO who does neither well and the small org ends up with no internal capability and a disengaged vCISO by month eight.
Cadence third. Weekly standup, monthly board update, quarterly risk review, all on the calendar before the vCISO starts. The cadence is what makes the program feel like a program rather than a reaction. The small org that has a vCISO for a fire drill during the audit and then disbands the engagement is the small org that pays for the same audit a second time two years later.
What the small org should do
Pick the sponsor before the vCISO. Pick the vCISO for the industry. A vCISO who has done SOC 2 in a SaaS org is the right fit for a SaaS company. A vCISO who has done HIPAA in a healthcare practice is the right fit for a clinic. Industry match beats resume match, every time. Set the cadence on the calendar in the first week, not the first quarter.
Audit the program at month six. Same way the small org would audit a vendor. If the artifacts are landing, the cadence is running, the sponsor is showing up, the program works. If any of those three is broken, fix it in writing, with a date, or end the engagement. The vCISO program that drifts is the vCISO program that costs the small org the next audit.
The bottom line
Pick the sponsor, pick the vCISO for the industry, set the cadence in week one, audit at month six. The vCISO program is a contract between the small org, the consultant, and the assessor. The contract is only as good as the sponsor who owns it.
Sources & Further Reading
All claims in this article are sourced from primary documentation, vendor advisories, and reputable security researchers.
Spotted an error? Email the editor. Corrections are issued with a visible correction note.
Editorial standards. Every article on humanrequired.org is reviewed by a human editor before publication. AI may assist with drafting or research; final editorial control is human. Read the full standards.
