Designing a vCIO Service

What a vCIO is for

A vCIO owns a client's technology direction. Every MSP claims to provide one. Few define what the client receives, who does the work, and what it costs, so it appears as a line in the proposal and never as a deliverable. Defined properly, it is the usual first step up in average revenue per client and the strongest retention tool you have: a client who has handed you their three-year plan does not leave over a slow ticket.

What the vCIO actually delivers

Five deliverables, refreshed on a schedule, cover almost all of it:

• Technology roadmap. A 12–36 month plan of projects, sequenced and dated, each tied to a business reason – the server exits support, the office moves, the insurer requires it.
• Budget forecast. The roadmap priced: recurring services, projects, hardware refresh, licensing, contingency. Delivered ahead of the client's fiscal year so IT becomes a planned line rather than a surprise invoice.
• Risk register. Every open finding from assessments and standards audits, with an owner, a rating, and a status – accepted, deferred, funded, or closed. The register makes declined recommendations the client's decision on paper.
• Vendor management. An inventory of the client's technology vendors and contracts with renewal dates, and the vCIO as the point of contact for evaluating the next tool the client wants to buy – which absorbs shadow IT before it accumulates.
• Lifecycle planning. Hardware and software age tracked against replacement policy – typically five years for workstations, five to six for servers, five for network gear – so refresh is scheduled and budgeted, not reactive.

If a deliverable cannot be templated, it is consulting, not a service.

The cadence

Two rhythms hold the service together. The QBR is the formal review where roadmap, budget, and risk register are presented and decisions requested; the agenda and preparation are in the QBR process. Between reviews, a monthly touch – a 20–30 minute call or a short written update – keeps momentum: what landed, what is next, anything on the client's side that changes the plan. Without it, a quarterly meeting becomes a quarterly surprise.

Scale the cadence to the client: quarterly reviews plus monthly touches for the top tier, semi-annual reviews plus quarterly touches for the middle, an annual written plan with an offer to meet for the smallest.

vCIO, vCISO, and technical account manager

The three roles are conflated constantly.

The vCIO owns direction and budget: what technology the business should have and when. The vCISO owns security governance: policies, control frameworks, compliance programs, risk assessments, and the audit relationship. Clients under a regulatory framework or a demanding insurer need the vCISO scope and will pay separately for it; general SMB clients need a vCIO who can speak to security risk without running a formal program. Do not sell one and deliver the other.

The technical account manager is operational: the escalation point, the person who knows the environment. A TAM looks at last quarter; a vCIO looks at the next three years. In small shops one person wears both hats, which works as long as the two conversations are not held in the same meeting.

Who does it on a small team

Under about 300 managed seats, the vCIO is the owner. It is the highest-value use of the founder's time and why clients chose a small provider. Between roughly 300 and 1,000 seats, the first dedicated hire is usually an account manager with technical depth who takes the monthly touches and the deliverable preparation, with the owner still attending top-tier reviews. Beyond that, a full-time vCIO carries 25–40 clients.

Whoever does it needs enough technical judgment to be credible, enough business vocabulary to talk about cash flow and headcount rather than firmware, and a protected calendar. The service dies when review preparation is the first thing dropped in a busy week.

How to price it

Two models work – see MSP pricing models for the wider context.

Bundled per-seat uplift. The deliverables are included in the top service tier and priced into the seat – typically $8–20 per user per month over the tier below as of 2026. Every client at that tier receives it and the MRR is predictable; the risk is that the work is invisible on the invoice and gets under-delivered.

Separate monthly retainer. A named line item, scoped by cadence and deliverables. Typical ranges: $500–1,500 per month for a client under 50 seats with semi-annual reviews, $1,500–3,500 for quarterly reviews and monthly touches at 50–200 seats, and $3,500–7,500 for larger or regulated clients where the role approaches a fractional executive. The retainer makes the service visible at renewal and lets you decline it for clients who will not pay.

A hybrid is common: a light version bundled for all managed clients, a retainer for those who want the full cadence. Either way, price to the value of the decisions being made, not the hours in the meeting – the clearest case for value-based pricing in the catalog.

Deliverable templates

Build these once:

• A one-page roadmap with quarters across the top and projects placed by date, each with a cost and a reason.
• A budget worksheet: recurring, projects, refresh, licensing, contingency, by quarter, with a three-year view.
• A risk register with the columns above and a rule that nothing is removed, only closed.
• A vendor and contract inventory with renewal dates flagged 90 days out.
• A lifecycle report from RMM asset data, sorted by age against policy.

Preparation should take two to four hours with these in place; if it takes a day, the templates are missing something.

Failure modes

Becoming free consulting. The client calls for opinions on their phone system, their website vendor, and their nephew's laptop, none of it scoped. Scope the deliverables and cadence in the agreement, route ad-hoc requests to the monthly touch, and quote anything beyond that as a project.

Running it as a sales pitch. If every review ends with three quotes and no finding the client could decline without pressure, the client learns the meeting exists to sell. Present risk and let the register hold the decision; project revenue follows a credible roadmap, not the other way around.

Delivering it inconsistently. Reviews slip, the roadmap goes stale, the budget never ships. Inconsistency is worse than absence, because the client was told they had a strategic partner and can see they do not. Track review completion as a KPI alongside service metrics – see MSP KPIs and benchmarks.

Bottom line

Define the vCIO service as five deliverables on a stated cadence, staffed by someone with a protected calendar, and priced as a visible per-seat uplift or a named retainer. Keep it distinct from security governance and from account management, keep the reviews about the client's next three years, and let the risk register carry the decisions. That is the difference between a vCIO line in a proposal and a vCIO service a client will pay for and stay for.