Virtual CISO (vCISO): What a Fractional CISO Does and When You Need One

A vCISO (virtual chief information security officer) is a senior security leader who works for your organisation part-time, usually for an agreed number of days a month, instead of as a full-time employee. The role is the same as an in-house CISO’s: set the security strategy, own the risks, report to the board and keep compliance programmes such as PCI DSS, ISO 27001 and Cyber Essentials on track. You pay for the time and deliverables you agree, not a permanent salary.

For many small and mid-sized UK firms, a virtual CISO is the most practical way to get that leadership when the workload does not justify a full-time executive. This guide explains what a vCISO does, how the different labels compare, what drives the cost, what a vCISO cannot do for you and how to choose one.

What does a vCISO do?

A vCISO turns security from a list of IT tasks into a managed programme with an owner. The typical scope looks like this:

The risk work is the foundation for everything else. Our guide to cyber security risk assessment explains how that assessment is done.

vCISO vs fractional CISO vs CISO as a service: what is the difference?

The labels overlap, and none has a legal or industry-standard definition. In common use:

Read the contract rather than the label. It should name who does the work, how many days you get, what happens to unused days and who covers holidays and absence.

When does a vCISO beat a full-time hire?

A vCISO makes sense when you need senior judgement but not a full-time executive. Typical triggers:

• A compliance deadline: a first PCI DSS assessment, an ISO 27001 certification target or a contract that requires Cyber Essentials Plus.
• Customer pressure: enterprise buyers sending long security questionnaires, or investors running due diligence.
• A board that wants assurance: directors who need to show they are governing cyber risk.
• A gap: your security lead has left and recruitment will take months.
• Specialist knowledge: your IT team is capable, but nobody has run a PCI DSS or ISO 27001 programme before.

A full-time CISO is usually the better choice when security is a daily operational job: a large or complex estate, a sizeable security team to manage, round-the-clock incident leadership, or regulation that expects a dedicated executive. Many organisations use a vCISO first, then hire once the programme is built and the workload is clear.

What happens in the first three months of a vCISO engagement?

A well-run engagement starts with discovery and ends the first quarter with a roadmap the board has signed off. A typical shape:

After that, the retainer usually settles into a monthly cycle of roadmap delivery, risk review and reporting. If you have a single goal, such as a first ISO 27001 certification, a fixed-scope project with a defined end point may suit you better than an open-ended retainer.

How much does a virtual CISO cost?

There is no standard price. Fees depend on how much time you buy and what is included. These are the main cost drivers:

To compare a vCISO with a permanent hire, cost the hire properly: salary, employer National Insurance, pension, benefits, recruitment fees, training and the months the post may sit empty. Then ask each vCISO provider for a fixed monthly fee with defined days, deliverables and a notice period.

Remember that a vCISO fee rarely covers independent assessments. A PCI DSS assessment by a Qualified Security Assessor, an ISO 27001 certification audit, Cyber Essentials certification and penetration testing are separate budget lines.

What can a vCISO not do for you?

Three limits are worth knowing before you sign:

1. Take on your accountability. Under ISO 27001:2022 clause 5, top management must lead the information security management system. PCI DSS v4.0.1 Requirement 12.4.1 requires executive management of service providers to take responsibility for protecting cardholder data and for the PCI DSS compliance programme. A vCISO can run the work, but your leadership still owns it.
2. Audit their own work. The person who designed your controls should not be the one assessing them. ISO/IEC 17021-1 bars a certification body from providing management system consultancy to the organisations it certifies, and the PCI SSC’s qualification requirements for QSAs include independence rules. Expect a separate, independent assessment.
3. Replace operations. A vCISO leads and decides. Monitoring alerts, patching and incident handling still need people and tools, in-house or from a managed provider.

How do you choose a vCISO?

Ask these questions before you commit:

How does a vCISO report to the board?

A good vCISO makes board reporting routine. The UK government’s Cyber Governance Code of Practice, published in April 2025 with the NCSC, sets out what boards and directors should do under five principles: risk management; strategy; people; incident planning, response and recovery; and assurance and oversight. A vCISO can structure each board pack around those principles and use the NCSC’s Board Toolkit to brief directors. Our guide to the Cyber Governance Code of Practice covers the director actions in detail.

Where Sovereign Secure fits

Sovereign Secure provides the specialist compliance and testing work that a vCISO or in-house security lead plans and commissions:

• PCI DSS: we are a PCI SSC Qualified Security Assessor (QSA) company, also approved as a Qualified PIN Assessor (QPA) and Card Production Security Assessor (CPSA), and a member of the PCI SSC Global Executive Assessor Roundtable (GEAR) 2026-2028. See our PCI DSS consultancy.
• Cyber Essentials: we are an IASME-licensed certification body and issue Cyber Essentials and Cyber Essentials Plus certificates.
• ISO 27001: we are ISO 27001 certified and provide ISO 27001 consultancy; certification audits are carried out by our partner certification body, MQA International.
• Testing: penetration testing and vulnerability scanning across web, API, network, cloud, mobile and AI systems.

Sovereign Secure Ltd was founded in 2012 and is based in Accrington, Lancashire, with offices in Los Angeles, Singapore, Dubai and Dhaka. For an overview of how these services fit together, see our cyber security consultancy page.

Next step

If you have a security roadmap, or need one, talk to us about the PCI DSS, Cyber Essentials, ISO 27001 and testing work on it, and we will give you a fixed quote for each piece.