Virtual Chief information security officer services · Outsourced CISO
Virtual CISO Services · Outsourced CISO
Virtual CISO services — also sold as outsourced CISO — give you a CISO who is not on your payroll and may work largely off-site.
The CISO owns cyber and information security risk: the strategy, the controls, the incident plan and the board’s understanding of the risk.
Ask what sits behind the label: a firm delivering a bundled service, or a named senior individual.
This page sets out the difference, what the service should cover, and how we shortlist named chief information security officers: 3–5, each with rate, availability and IR35 position set out.
How a brief runswhat we undertake
- 01Brief30-MINUTE SCOPING CALLDay 0
- 02Shortlist of 3–5VETTED · RATE BENCHMARK · IR35After the brief
- 03InterviewsYOU MEET THE SHORTLISTYour diary
- 04Scoped startFIRST-MONTH OUTCOMES AGREEDYou set the date
- 05Fractional, interim and permanentIR35 POSITION SET OUTOn every brief
Shortlist3–5
15 minutes · video or phone
Book 15 minutes to hire a virtual CISO
Tell us the scope and the days a week. We come back with Virtual CISO Services candidates, their day rates and availability.
- 0115 minutes, video or phone
- 02We scope the role and the days a week
- 03A shortlist of 3–5 after the call
- 04Fractional, interim and permanent briefs
Pick a day that suits · live availability
01/ the role
What virtual CISO services cover
An virtual CISO is bought as a service rather than hired as an employee.
In UK usage the label covers two different things: a provider that runs the function with a team and a named lead, or one senior chief information security officer working remotely on a standing commitment, which is the fractional model under another name.
Whichever you buy, the scope is the seat’s: the information security strategy and risk register; security policies, controls and certification such as Cyber Essentials or ISO 27001; incident response planning and exercises; supplier and third-party security assurance; board reporting on cyber risk.
The same seat is also bought as fractional CISO services, interim CISO services, part-time CISO services, virtual CISO services, or a permanent hire, set out on the CISO services hub.
What the seat does day to day is set out in the CISO role explained; executives looking for this work can see current CISO roles; the full cost picture is on the CISO cost guide.
02/ scope
What is in scope — and what is not
In scope
The information security strategy and risk register; security policies, controls and certification such as Cyber Essentials or ISO 27001; incident response planning and exercises; supplier and third-party security assurance; board reporting on cyber risk.
Not in scope
Hands-on security operations, monitoring and penetration testing are usually delivered by an engineering team or a managed provider; the CISO directs and assures them.
CISO or a neighbouring seat?
The CISO owns security risk; the CIO owns systems.
Keeping them separate gives the board an independent view of risk.
The scoping test: write down the three decisions you need the CISO to own in the next ninety days. If you cannot, you are not ready to brief.
03/ the week
How a week divides.
Part of a week is the point of the model: the days you buy are yours, the rest of the week goes to other clients. Move the days a week and the week redraws.
Illustration only: one way a virtual CISO’s week can divide at 2 days a week for you. Each block is half a day.
04/ rates by stage
CISO rates what the published benchmarks say
Every figure is the named source’s own published band. Fractional Quest publishes no fees: each candidate on a shortlist states their own rate. A fractional engagement is priced on the day rate times the days committed each week.
05/ comparison
Four ways to buy a CISO fractional, interim, part-time or permanent
The same CISO seat can be filled four ways. The difference is commitment, contract and how long you need it.
06/ timing
When fractional CISO services are the right call
Three situations where the fractional shape beats the alternatives.
Scenario 01
Before full-time
You need someone to own the information security strategy and risk register and security policies, controls and certification such as Cyber Essentials or ISO 27001, but the work does not fill five days a week yet.
Scenario 02
Signals
A customer security questionnaire you cannot answer, a tender requiring certification, an incident, or an insurer or investor asking who owns cyber risk.
Scenario 03
Alongside a team
The team can deliver; it needs someone senior to set direction on incident response planning and exercises and hold the standard.
07/ vetting
How we vet the shortlist
Five stages: qualification, mandate fit, reference deep-dive, shortlist and analysis, kick-off.
- 01
Qualification screen
Verify Virtual CISO Services tenure, sector context and stage fit.
SOURCING - 02
Mandate fit
Match to your situation — stage, board dynamics, timing.
MATCHING - 03
Reference deep-dive
We take references ourselves, from recent past clients — real outcomes, not titles.
VERIFY - 04
Shortlist
Three to five candidates with day rate, availability and IR35 position set out.
SHORTLIST OF 3–5
08/ firm or person
Virtual CISO services a firm, or a named person?
A provider gives you continuity and a team behind the work; ask who the named lead is, how many days they personally give you, and who attends the board.
A named individual gives you one accountable senior person; ask how many other clients they hold and how urgent issues are handled between their days.
Either way, check standing before you sign: what the board should expect from its security lead; see the NCSC Cyber Security Toolkit for Boards.
And whoever you appoint, the directors stay accountable: GOV.UK’s guidance on being a company director is explicit that responsibility is not outsourced with the work.
09/ before you sign
Before you buy fractional CISO services three checks
Standing.
Check professional standing and references before you sign: what the board should expect from its security lead; see the NCSC Cyber Security Toolkit for Boards.
Status.
Agree how the engagement will run in practice, because that decides its IR35 status; HMRC’s guidance for clients sets out who makes the status determination.
Scope.
Write down what is out of scope.
Hands-on security operations, monitoring and penetration testing are usually delivered by an engineering team or a managed provider; the CISO directs and assures them.
10/ questions
Virtual CISO services FAQ
The questions people ask before bringing in a virtual CISO.
Book 15 minutes · shortlist of 3–5
Bring the brief. We architect the team.
A shortlist of 3–5 with day rate, availability and IR35 position set out, after five-stage vetting.
