A virtual CISO for when you need a security lead, not a full-time hire
Someone who owns security strategy, speaks to the board, answers the auditors and the customer questionnaires, and tells your teams what to do next. Part time, by arrangement.
Overview
What a virtual CISO does
Many organisations reach the point where security needs an owner before they can justify a full-time chief information security officer. Customers send questionnaires, auditors ask who is accountable, the board wants to know where the risks are, and the work lands on whoever was nearest.
A Black Fox virtual CISO takes that role on a part-time basis. We set the strategy and the roadmap, own the policies, report to management and the board in plain language, and handle the audits and questionnaires that would otherwise eat your engineers' week. We are stubborn about priorities and polite about it.
You keep the accountability that the law or your frameworks place on management. We give management the information and the plan to carry it.
Who it is for
Growing companies whose customers or tenders ask who is responsible for security, organisations facing NIS2, DORA or certification requirements without a security lead, and teams whose CISO has left and who need cover while they hire.
The work, from scoping to evidence.
What we do
Strategy and roadmap
A security strategy tied to your business goals and risks, and a roadmap your teams can actually deliver, reviewed as things change.
Board and management reporting
Regular reporting on risks, progress and decisions needed, written for people who do not read security reports for pleasure.
Policy ownership
Your security policies written, approved and kept current, with someone accountable for them.
Audits and certifications
We prepare for and represent security in audits, and coordinate with certification bodies and auditors on your behalf.
Customer questionnaires
Security questionnaires and due diligence requests answered accurately and consistently, from a maintained set of approved answers.
Vendors and incidents
Oversight of third-party risk, and a calm voice that coordinates when something goes wrong.
How the engagement runs
Kickoff
We meet the people involved, agree what the role covers and how much of it, and sign an NDA first if you need one.
Assessment
A review of where security stands today: risks, controls, obligations, documents and the people already doing the work.
Strategy and roadmap
A prioritised plan agreed with management, with owners and a realistic sequence.
Running the role
We lead the roadmap, chair the security meetings, own the policies and handle audits and questionnaires as they come.
Reporting and review
Regular reports to management and periodic reviews of the strategy, and, if you later hire a full-time CISO, a clean handover.
What you receive
- Security assessment and risk overview
- Security strategy and prioritised roadmap
- Board and management reports
- Maintained policy set with named ownership
- Library of approved questionnaire answers
- Handover pack if you hire a full-time CISO
Questions
How much time does a virtual CISO spend with us?
It is agreed with you, based on what the role needs to cover and how much your teams already do. It can change over time, for example around an audit or a major project.
Who is accountable, you or us?
Your management keeps the accountability that laws such as NIS2 or your frameworks place on it. We provide the leadership, the plan and the information management needs to carry that accountability properly.
Can a virtual CISO deal with our auditors and customers directly?
Yes, if you want that. We can attend audits, answer questionnaires and join customer calls as your security lead, within what you authorise.
What if we later hire a full-time CISO?
That is often the right outcome. We document everything as we go and hand over the strategy, the roadmap, the policies and the open items to your new hire.
Related services
- Governance and riskSecurity risk assessmentInfrastructure, network and application risk assessment by Black Fox Security: probability versus severity, a risk register your owners use and treatment options.
- Governance and riskPolicies and proceduresBlack Fox Security writes and reviews your security policies: acceptable use, access control, incident response, suppliers, backup and more, in plain language.
- Managed securityContinuous complianceContinuous compliance from Black Fox Security: evidence calendar, internal audits, control testing, policy reviews and surveillance audit support.
- Governance and riskThird-party risk managementSupplier risk management from Black Fox Security: inventory, tiering, questionnaires, evidence review and contract clauses, aligned with NIS2 and DORA expectations.
Give security an owner
Tell us where security sits today and who is asking about it. We will propose what a virtual CISO role should cover for you.