A vCISO (virtual Chief Information Security Officer), provides cybersecurity leadership to businesses virtually at a fraction of the cost if hiring them full-time. By hiring a third-party provider to manage your cyebrsecurity program remotely, a business gains access to staff and resources that it doesn’t have in-house, and can better keep up with information security and compliance requirements.
With a vCISO you can fulfill your cybersecurity needs no different than having a General Practitioner doctor for yourself or a lawyer for your company look over your contracts. You wouldn’t normally hire a lawyer or doctor full-time into your business so why would you hire a full-time cybersecurity professional.
Cybersecurity leadership is essential in modern business, as digital transformation increases an organization’s overall magnitude of vulnerabilities. There is an industry-wide cybersecurity skills shortage, meaning affordable skilled security leaders are hard to find. A vCISO provides a potential solution to this problem by providing access to cost-efficient security leadership on an as-needed basis.
Responsibilities
The tasks assigned to a vCISO deviates from business to business, but can do virtually all tasks that an in-house CISO can do:
- Protecting confidentiality, integrity and availability of data in your business or your client’s businesses
- Long-term cybersecurity strategy and program development
- Policy governance, risk and compliance program framework development
- Risk assessments
- Risk management
- Security awareness training
- Developing secure business and communication practices
- Reporting on security operations
- Monitoring for critical vulnerability alerts like the Domain Controller Zerologin Vulnerability from Aug. 2020
- Defining metrics to measure program success
- Management of personnel and vendor relationships
- Integration and management of other third-party security services
Source: TechTarget
Additional Reading: VCISO: A Pragmatic Path To Cybersecurity In Pandemic Times And Beyond
Related Terms: Risk Management
What does this mean for an SMB?
- Subscription/Contract
- Paid monthly at a fixed rate, helping whenever needed.
- Per-Use Basis
- Paid at an hourly rate, oftentimes less prioritized than the contracted customers.
- Hybrid
- Combination of Subscription and Per-Use model.
- Ex: vCISO contractually agreed to assist business (planning, risk assessment, training, etc) up to 20 hours a month, at a fixed monthly rate. If the vCISO is needed more than 20 hours in a month they charge the business an hourly rate for the extra hours.
- Combination of Subscription and Per-Use model.