A CISO owns the cyber-risk decision, sits between the technology estate and the executive team, and is accountable when an incident lands.
We staff the role with a named person, not a policy subscription. Subscriptions don't own decisions. People do.
The NCSC's Cyber Security Toolkit for Boards sets out how a board oversees cyber risk. The CISO is the person who makes that oversight work. The CISO owns the cyber-risk decision in the executive team, briefs the board on the security investment plan, signs off the incident-response stance when an incident lands, and is accountable to the regulator under the ICO accountability principle in Article 5(2) of the UK GDPR.
A named individual on your board pack, with sign-off on the security investment plan and the incident-response stance.
Month-one walkthrough of the asset register, the SaaS estate including shadow IT, patching cadence, and identity sprawl.
The vCISO prepares you for Cyber Essentials Plus, owns the remediation of anything the assessment finds, and reports the outcome to the board. NetSec is an IASME Certification Body.
The recurring pattern from CE Plus assessments where the organisation already had a vCISO retained: the vCISO had written a policy library and run a tabletop exercise. They had not seen the asset register, did not know which SaaS tools the marketing team had bought directly, and could not name the patching cadence on the firewall stack. When the assessor flagged a gap, the vCISO's response was procedural, “we'll add it to the policy”, rather than directional, “patch it by Friday and remediate the underlying onboarding gap by month-end”. The CE+ pass took an extra round of engagement to land.
Our vCISO owns the work before and after the Cyber Essentials Plus assessment.
The point of the role is that one person owns the outcome: scope the controls, get them in place, prepare for the assessment, fix what it finds, and report the result to the board.
My view shifted from offering vCISO retainers as a packaged-hours product. The hour count is not the point. What clients hire a vCISO for is a person who can stand in front of the board, defend a security investment plan, sign off the incident response when it happens, and own the assessment outcome end-to-end.
Hours bill themselves. Decisions don't. The government's Cyber Security Skills in the UK Labour Market 2024 report found that 44% of UK businesses have a basic cyber-skills gap and 27% an advanced technical one.
Source: gov.uk Cyber Security Skills in the UK Labour Market 2024
CE Plus is a point-in-time control assessment of the technical estate. The vCISO role is continuous governance ownership. NetSec is an IASME Certification Body, so the vCISO work and the Cyber Essentials Plus assessment can be planned together from the start.
The five Cyber Essentials controls are sampled at a single point in time. The assessment is the proof artefact your customers and regulators look at.
Continuous oversight of the asset register, the supplier surface, the security investment plan, and the incident-response stance between assessments.
MDR detects and responds to attacks that bypass preventative controls. The vCISO decides what counts as an incident requiring board notification, ICO disclosure inside the 72-hour Article 33 clock, and customer communication. One layer is detection. The other is decision.
A vCISO sits in the role over time, signs off the security investment plan to the board, owns the incident-response stance when one lands, and is accountable to the ICO for documented governance. The NCSC's Cyber Security Toolkit for Boards covers the board's side of that relationship, whether the CISO is a permanent hire or a retained partner.
A Head of IT runs the technology estate. The CISO role is governance-facing: board reporting, regulatory accountability, security investment prioritisation, incident sign-off. The two roles are complementary. The DSIT Cyber Security Breaches Survey 2024 found that only 31% of UK businesses had undertaken a cyber-risk assessment in the last year, which is governance work, not IT work.
NetSec is an IASME Certification Body, so the vCISO work and the CE+ assessment can be planned together from the start. If you already have a separate assessor, the vCISO acts as your single point of accountability across the engagement. We'll set out the seam where it makes sense to consolidate, on the scoping call.
The vCISO owns the incident-response stance and signs off the regulatory clock when an incident is declared. The incident-response retainer is the operational team that executes containment, evidence preservation, and forensics. Some clients buy both from us. Others pair our vCISO with a separate IR firm. The scoping call covers which arrangement fits your threat model.
Pricing depends on the size of the estate, the regulatory regime you operate under, the cadence of board reporting your customers expect, and whether the vCISO sits alongside a CE+ engagement. The scoping call covers tier selection. We don't publish a public price band because the right answer is usually different by an order of magnitude across the regulated and non-regulated tiers.