vCISO (Virtual CISO)

Definition

A vCISO (virtual chief information security officer) is a fractional executive role that owns a client's security program: the risk register, the policy set, the compliance posture against whatever framework applies, and decision authority during an incident. It is distinct from a vCIO, which owns technology strategy, roadmap, and budget. The vCIO decides what the business builds; the vCISO decides what risk it accepts, which controls are mandatory, and who is in charge when something goes wrong.

Why it matters to an MSP

Most SMBs cannot justify a full-time CISO, but more are being asked for one – by a cyber insurance questionnaire, a customer's vendor-security review, or a CMMC or SOC 2 auditor asking who owns the program. That creates a service line with different economics: it is billed as advisory, typically $1,500–$5,000 per month for an SMB, and carries little tooling cost because the deliverables are policies, risk assessments, control reviews, leadership reporting, and tabletop exercises, not agents and licenses. It sits above compliance as a service: that work collects evidence; the vCISO interprets it and decides what to do about the gaps.

The risk sits on your side. A vCISO signs off on the client's posture, so a breach after a documented "accepted risk" is a conversation with lawyers. The role needs errors-and-omissions coverage, an engagement letter that separates advice from operations, and a person with real security judgment – not a technician with a new title; small MSPs often partner with an independent vCISO rather than staffing it. Conflict of interest matters: if the same team runs the controls and grades them, an auditor will discount the assessment, so keep the vCISO's reporting separate from operations. How the two roles fit together is in vCIO service design.

Related terms: vCIO, Compliance, Cyber Insurance