Executive IT and Security
Leadership, On Demand.

A virtual chief information officer (vCIO) is an executive technology leader who sits with your leadership team on a fractional basis instead of as a full-time hire. The vCIO owns the forward-looking technology picture, including the annual technology roadmap, IT budget planning, vendor negotiation, and quarterly business reviews with your executive team. It gives businesses in the 25 to 500 person range a strategic seat at the table without the headcount.

A virtual chief information security officer (vCISO) is a designated senior security leader who owns your security program, including policy, risk, incident response, audit, and regulator-facing reporting. A business needs one when a regulator or insurance carrier expects a named senior-level security officer, or when no one inside the company owns the security program and finding and affording a full-time hire is very hard.

A vCIO owns technology strategy: the roadmap, the budget, vendor decisions, and translating business priorities into technology plans. A vCISO owns the security program: policies and procedures, the risk register, incident response leadership, evidence collection, and annual board reporting. Many businesses need both seats, and we scope the engagement to the real need.

Yes. Our vCISO engagement is built to satisfy the New York Department of Financial Services (DFS) cybersecurity regulation, 23 NYCRR Part 500, which requires covered entities to designate a CISO and have that CISO report to the board or a senior officer at least annually. The engagement also gives an insurance carrier or a regulator a compliant, reportable security officer, with documentation that holds up under regulator review.

We scope the engagement to the real need and price it against the real budget. Some businesses need a strategic CIO voice at the quarterly meeting, while others need a compliant, reportable CISO to satisfy an insurance carrier or a regulator. The work covers the seats an in-house CIO and CISO would carry: strategy and roadmap, budget and vendor management, security program ownership, policy authoring, board and executive reporting, and audit and regulator liaison.