IT service
Virtual Information Security Officer (vCISO)
Customers, auditors and regulators ask who is responsible for information security. Most businesses need a clear answer but not a full-time officer. We take that role for a set number of days a month, and work with the people who run your IT and your Information Officer under POPIA.
What is included
- A security strategy and plan, reviewed each quarter
- Security policies written, approved and kept current
- A risk register with owners, dates and regular reviews
- Readiness for ISO 27001, CIS benchmarks and customer audits
- Incident response plans and practice runs
- Supplier security checks and answers to customer questionnaires
- Security reports for directors and the board
What you get
- A clear answer to who owns security
- Audits and customer questionnaires met with evidence
- Security risks the board can see and decide on
One engineer handles it from start to finish, so a change requested today can be in production the next day, once change-control documentation and testing are complete.
Virtual ISO: common questions
What is a vCISO?
A virtual Chief Information Security Officer: an experienced security lead who works for you part-time instead of as a full-time employee. We call the service Virtual ISO. The role is the same: someone responsible for your security strategy, policies, risks and reporting.
When does a business need one?
Usually when someone starts asking who is responsible for security: a customer questionnaire, an audit, an insurer or the board. It suits a business that needs a clear answer to that question but not a full-time security officer.
How many days a month does it take?
That depends on your size, your systems and what your customers and auditors ask for. Tell us where you stand and we will suggest a set number of days a month.
Does a vCISO replace our IT team or IT provider?
No. Your IT team or provider keeps running your systems. The vCISO sets the plan and policies, tracks the risks and reports on progress, working with the people who do the day-to-day work.
Is a vCISO the same as an Information Officer under POPIA?
No. An Information Officer is a role POPIA requires, registered with the Information Regulator, and is usually the head of the business. A vCISO looks after information security and works with that person.
Can a vCISO get us ISO 27001 certified?
A vCISO can get you ready: the policies, risk register and evidence an audit looks for. The certificate itself comes from an accredited certification body.
Who stays accountable for security?
Your directors stay accountable for the decisions. The vCISO's job is to make the risks clear, with owners and dates, so that the board can decide on them.
Topics covered
- virtual ISO
- virtual CISO
- vCISO services
- information security officer as a service
- fractional CISO
- outsourced information security officer South Africa
Related services
IT Security
Harden what you already have, close the gaps attackers use, and know where you stand.
Privileged Access Management
Admin rights only when needed, passwords in a vault, and every privileged action on record.
Hardening & Vulnerability Management
Hardened to CIS benchmarks, scanned for vulnerabilities, and proven with reports.
Talk to us about Virtual ISO
Tell us what you need. You will hear back from the person who will do the work.