Virtual CISO (vCISO)
A virtual CISO is a senior security lead who works with you a set number of days a month and owns your security program, without the cost of a full-time executive. We set the priorities, keep the risk register, prepare you for audits and customer questionnaires, and report to leadership and the board. Because Calibre assesses physical security as well as cyber, your vCISO also covers badge readers, server rooms and the visitor process, not just the cloud.
Who it is for
- Companies whose customers, investors or insurers now ask who is responsible for security, and the honest answer is nobody in particular.
- Teams preparing for a first ISO 27001, SOC 2 or regulatory audit that need one person to own it from scoping to report.
- Organizations between CISOs, or with an IT lead who needs senior security backing.
- Boards that want a regular, plain-language view of cyber and physical risk.
What we assess
- Security strategy and a 12-month roadmap, tied to the risks and deadlines that actually apply to you.
- The risk register and policies: written for how you work, approved and kept current, rather than templates nobody follows.
- Audit and compliance ownership: scoping, evidence and working with your auditor for ISO 27001, SOC 2, PCI DSS, NIST CSF, HIPAA or regional rules such as NIS2 and DORA.
- Customer security questionnaires and due diligence requests, answered accurately.
- Vendor and third-party risk: which suppliers can reach your data and what you require of them.
- Incident response: a written plan, a named lead, a tabletop exercise, and support during a real incident.
- Physical security: access control, office and data center controls, visitor management and the badge lifecycle, assessed by our own physical security team.
- Leadership and board reporting: a short, regular read-out of risk, progress and the decisions needed.
What you receive
- A 12-month security roadmap, with priorities and a price range for each item.
- A risk register and policy set your team maintains with us.
- A monthly report for leadership and a quarterly read-out for the board.
- A named senior lead your team, customers and auditors can call.
Every engagement has a fixed fee agreed in writing before we start, and we take no referral fee or commission on any product we recommend. Ongoing, a set number of days each month. The first month is a baseline assessment and the roadmap; after that, time follows what is in flight and is reviewed each quarter.
Common questions
What is the difference between a vCISO and a full-time CISO?
Time, not seniority. A vCISO does a CISO’s job for a set number of days a month, so you get the experience without a full-time executive salary. When the program outgrows part-time leadership, we help you hire your first full-time CISO and hand over.
How much time does a vCISO spend with us?
It is agreed at scoping and depends on what is in flight: usually a few days a month, more around an audit, a large customer review or an incident. We review it each quarter, so you are not paying for time you do not use.
Can our vCISO also audit us?
No. An audit should be independent of the people who run the program, and some rules, such as the DOJ Data Security Program, require it. While we are your vCISO, we prepare you for audits and work with your auditor, but we do not audit our own work. We take no referral fee from any audit firm.
Do you cover physical security as well?
Yes, which most vCISO services do not. ISO 27001 Annex A.7, SOC 2 CC6.4 and PCI DSS Requirement 9 all test physical controls, and a lost badge or an open server room can undo good cloud security. Your vCISO and our physical security team work from one risk register. See physical penetration testing.
Book a scoping call
Tell us what is in scope and any deadline. You get a fixed-fee proposal in writing before any work starts, and a mutual NDA before you share anything sensitive.
Virtual CISO (vCISO)
We reply within one business day.
Nothing you send is shared outside Calibre.