The security lead left
The role is open, the search takes months, and the decisions are already queuing.
Security leadership · vCISO (Fractional)
A security function, run by one person, with the team behind it
Strategy, programme and action plan to work from, and the practitioners who act on them already on the account.
- The same person all year
- Practitioners already on the account
- CISA · CISM · CISSP
Ownership
Ask any vCISO provider how they measure their own work
The five instruments a security function is measured against: what each one tells you, who keeps it, and from when it exists.
| Instrument | What it tells you | Who keeps it | Exists from |
|---|---|---|---|
| Risk registerEvery risk with an owner, an inherent score, a residual score and a review date | Whether exposure is going down, and which gaps closed since last time | The vCISO, reviewed monthly | Built in the first weeks |
| Key risk indicatorsA short set of measures chosen against your own environment | Whether the things most likely to hurt you are trending the right way | The vCISO, updated monthly | Defined once the register exists |
| Incident recordWhat happened, how it was found, how long it took to contain, what changed afterwards | Whether detection and response are improving or the same event keeps recurring | The vCISO, with whoever handled it | From the first incident onward |
| Audit and review findingsWhat auditors, customers and internal reviews have raised, and the state of each | Whether the same finding comes back next year | The vCISO, against the compliance readiness plan | From the first external review |
| Compliance statusWhere you stand against each framework that applies, control by control | Whether a deadline is reachable, and what is in the way | The vCISO, with the framework owner | From the readiness plan onward |
A security function is judged against its own instruments — and if none of them are being kept, there is nothing to judge it against.
Ask which of them will exist, who maintains them, and what happens when one moves the wrong way. Ours are built in the first weeks and reported on to the end of the engagement, and the practitioners who close the gaps are already on the account, joining when there is something to do.
Get startedSituation
Five moments when this gets raised
An enterprise deal needs answers
The customer review is about governance, and nobody owns the reply.
Something external has a date attached
An ISO 27001 audit window, a SOC 2 reporting period, or a NIS2 or DORA obligation — and somebody has to own the answer and put their name on it.
A product is launching fast
It needs somebody with deep product security knowledge answering for compliance, and it needs them now.
Four teams hold a piece each
IT, engineering, compliance and management. Nobody holds the whole.
Fit
Who this is for, and who it is not
The right-hand column turns work away on purpose — with what to do instead.
This fits
- Own product in development
- 50–300 people
- Nobody owns InfoSec end to end
- Growing faster than the processes
- A framework deadline set by somebody else
This does not, and here is what does
- You already have a security leader
- There is nothing here you are not already getting.
- You can justify a full-time role and want one
- Hire. This exists because most companies at this stage cannot justify it yet.
- You want hands on keyboards only, without the decisions
- That is project work — a penetration test, an assessment, a piece of engineering.
- You want a document rather than an owner
- A one-off audit-preparation engagement is cheaper and will do it.
- You want a clean report with no governance behind it
- We would not be able to sign it.
Three tiers
By the size of the company. The level is proposed after the gap analysis, and moves during the year.
LightSmaller companies
StandardMid-size
EmbeddedEnterprise
Comparison
Every engagement has the same four steps — what differs is how many of them the provider is engaged for
What the market sells
Engaged for Partly Not engaged forA vCISO who advises
A consultant, a small practice, or a part-time CISO of your own
Find the riskRank and planDo the workVerify and report
≈ 4 monthsThe plan is delivered and the engagement is done. Before anything changes the work has to become a budget round, a job advert or a tender.
A vCISO bundled with tooling
Leadership added to a monitoring or platform contract
Find the riskRank and planDo the workVerify and report
Days inside, months outsideWhatever the platform covers moves quickly. Governance, process and anything outside the product goes out to tender.
One-off audit preparation
A fixed engagement aimed at a single deadline
Find the riskRank and planDo the workVerify and report
≈ 6 weeks, then nothingIt closes the deadline in front of you and leaves no register, no owners and nothing to answer next year's questions from.
What we do
Leadership with the team behind it
One named leader holds the register and the action plan. The practitioners are already on the account.
Find the riskRank and planDo the workVerify and report
Nothing has to be advertised, tendered or briefed from scratch. Anything critical is worked the day it is found, and the register shows it moving.
Same dayAll four find the same risk. The difference is how many of the four steps the provider is engaged for — and every step they are not engaged for becomes a hire, a tender or a wait.
What it replaces
What is usually bought separately
Held by the role, instead of buying
- A consultant for ISO 27001, SOC 2, NIS2 or DORA readiness
- An external reviewer to prepare for the audit
- A security architect for design reviews
Practitioners on the account, instead of buying
- Penetration testing and vulnerability work
- Implementing the controls that come out of all of the above (or the client's team)
Held by the role, instead of buying
- Finding and onboarding a permanent security person (the role writes the specification, sits in the interviews and onboards them)
Bought separately
Each line bought separately is a selection process, a contract and a wait before anything starts.
And the questions between those lines belong to no one:
- whether a supplier can be given access to production,
- whether an incident has to be reported,
- what the technology engineering picked will cost to run safely.
Here
Here they sit with the person who already holds the rest. One person holds the role; the practitioners are already on the account and join when there is something to do.
You pay for the decisions continuously, and for the hands only while they are working.
The person
One person holds the role, the same one all year
The same individual from the first conversation to the end of the year. They hold your architecture, your politics, and why last quarter's decision went the way it did — none of which survives a handover.
One named leadFrom the first conversation to the end of the year
CISACISMCISSP
A second lead is on the account from the start and sits in the monthly reviews, so cover already knows the environment.
Decisions and the reasoning behind them are written down as they happen.
Method
What exists at each point of the year
Select any point to see what happens there and what exists afterwards.
Weeks 1–2
Gap analysis
What exists, what is missing, and how decisions actually get made here. Interviews with leadership, IT, engineering and compliance, alongside a review of the company's own structure.
What exists after it
- A plan proposal
- A written list of what each part of the business expects security to do
Month 1
The documents the year runs on
Every client gets all three documents. The strategy says what security is for here; the programme says which domains are in scope and who owns each; the action plan says what happens in what order and against whose name.
What exists after it
- Information security strategy
- Information security programme
- Action plan
- Security baseline
- Risk register
- Top ten priorities
Month 2
Governance in place
The policies that apply, and a written answer to who owns what. Everything after this point is auditable because of it.
What exists after it
- Policy framework
- Governance structure
- Written ownership per domain
Month 3
Roadmap and readiness
Both written in a form a board or an auditor can read without translation.
What exists after it
- Security roadmap
- Compliance readiness plan
- Budget against both
Months 3–4
Answerable from the record
The evidence exists before it is asked for, so a customer security review stops being a project of its own.
What exists after it
- Customer questionnaires answered from the register
- Audit and sales-review support
Month 5 onward
The register moves
Progress on this engagement is measured as a change in the register. The work itself follows the action plan and whatever has become urgent since it was written.
What exists after it
- Monthly register review
- Key risk indicators updated
- A report for management
Month 12
A year on the record
The register carries its own history, so the year can be shown in full — including the risks that were accepted, and who signed for them.
What exists after it
- What was closed and when
- What was formally accepted, by whom
- Where the indicators moved
Three documents, every client
Every client gets the same three documents out of the gap analysis: a strategy, a programme and an action plan. After that the work follows the action plan, and whatever has become urgent since it was written.
Terms
Annual subscription, minimum six months. Fixed monthly payment; work beyond the agreed scope runs on the rate card.
Three places the work comes from
These are the usual names for three areas of security practice, not a numbered list from a framework. The role also covers training, privacy, continuity, procurement, budget and hiring.
Governance, risk and compliance
The register, policies, the board conversation, answers for auditors and customers, regulatory obligations turned into named owners.
Security operations
Migrations, integrations, access, monitoring, incidents, vulnerabilities, third parties: requirements set before the change and verified after it.
Security architecture, design and development
Requirements set at design, architecture and integration decisions, security checks in the release process, threat intelligence turned into changes here.
Findings rarely stay inside one area. A single one usually needs work in all three, and the role covers all three without passing part of it on or waiting for somebody to be found.
Where the boundary sits. The role sets the security requirement, defines the framework and the roles, and verifies the result before accepting it. It does not administer systems day to day and does not replace the client's team.
What this looks like in practice
- Standing production access replaced with access granted per task and logged, then tested by attempting access without a request.
- Security requirements set for a data migration, then verified afterwards that the environment could not be reached from outside.
- An integration design changed so a failure in one component could not reach customer data.
- A risk the board had accepted brought back to them when the condition it was accepted under expired.
How the work is measured
The risk register is the instrument: an owner's name on each line, inherent score against residual, a review date ahead rather than behind. Progress is movement in those columns, not a count of documents. New risks are added as they are found; existing ones are re-scored once the control meant to reduce them has been tested.
Alongside it, key risk indicators chosen against your environment rather than off a standard list. Both are reviewed monthly and reported to management, and an indicator moving the wrong way is raised at the next review with its cause and a proposed response rather than held until the quarter closes. Audit outcomes and framework readiness are secondary evidence.
What to ask any provider, including us
Open the register and read four columns: owner, inherent score, residual score, review date.
OwnerNames rather than teams.
Inherent score · Residual scoreResidual different from inherent.
Review dateReview dates ahead, not behind.
Then ask which risk has recently moved the wrong way, and what was done about it.
Next step
Start with who owns what today
One conversation about how security decisions get made now, and where they stall. From there: the current-state review, the risk register, and the ten priorities that come out of it.
contact@defencelab.io