A vCISO (virtual Chief Information Security Officer) is a senior security lead who works for your company on a fractional basis: they own the security program, report to your leadership and set the standard for whoever runs your systems, whether that is your IT staff, OAC or another provider. OAC Technology quotes the role as a flat monthly fee based on scope and cadence, with no long-term contract, and is itself examined by independent auditors under SOC 2 every year.
Most companies with fewer than a few hundred employees cannot hire a full-time security executive, but they are now held to the same expectations as companies that can. Customers send questionnaires. Insurers ask for evidence; our cyber insurance readiness check shows what they look for. Regulations and frameworks such as HIPAA, SOC 2, CMMC and PCI DSS assume someone is accountable for security. A vCISO from OAC Technology is that someone: a senior security lead on a fractional basis, backed by a company that has been supporting Minneapolis businesses since 2000 and is itself audited under SOC 2 every year.
Security tools are not a security program. A program has an owner, a risk assessment, written policies, a plan, evidence that the plan is being followed and someone who reports on it to leadership. A vCISO provides that ownership without the executive salary:
The service fits companies that have outgrown “our IT provider handles security” as an answer. Common triggers include a large customer’s security questionnaire, a cyber-insurance renewal with new conditions, a compliance requirement such as SOC 2 or CMMC, a near-miss or an actual incident, a merger or acquisition, or a board that has started asking what the plan is. Law firms, healthcare organizations, manufacturers in the defense supply chain, financial and professional services firms and software companies are the most frequent.
A baseline against a recognized framework, typically the CIS Controls or NIST Cybersecurity Framework, or the specific framework your obligations name. You receive a written assessment, a risk register and a prioritized plan.
Acceptable use, access control, incident response, data classification, vendor management, business continuity and the other documents auditors and insurers ask for, written to fit your company and maintained as it changes.
Gap analysis, remediation planning, evidence collection and support during the audit or assessment, whether it is a SOC 2 examination, a HIPAA risk analysis, a CMMC assessment or a PCI attestation.
A written incident response plan with roles, contacts, decision points and communication templates, exercised with your leadership team at least annually. If an incident does occur, your vCISO leads the response alongside our remediation team.
Ownership of the training program, phishing simulation results and the culture around reporting. See our security awareness training service for how the training itself is delivered.
The vCISO sets requirements and verifies results for the controls our operations team runs: 24/7 managed detection and response, endpoint protection, email security, multi-factor authentication, firewalls, patching, logging and backups. Our managed cybersecurity services page describes each layer.
A standing review with leadership covering posture, incidents, open risks, compliance status, spend and the decisions that need an owner.
Security leadership and IT operations are different jobs, and it helps when they are not the same person. Your vCISO works with your internal IT staff, with our managed services team, or with another provider you already use. The vCISO sets the standard and verifies it; the operations team implements it. That separation is what auditors and insurers are looking for, and it is how a company of 40 people ends up with the structure of a company of 400.
Pricing is quoted as a flat monthly fee based on the scope and cadence, with no long-term contract. It is a fraction of the cost of a full-time security executive, and it usually pays for itself the first time it prevents an incident or shortens an audit.
The company that sets your security direction should be able to show you its own. OAC Technology is examined by independent auditors every year under SOC 2, covering how we control access to client systems, how we handle data and how we manage change. Our SOC 2 compliance page explains what that involves and what questions to ask any provider about theirs.
Our article on what SOC 2 compliance is explains the audit in plain terms.
A vCIO leads technology strategy as a whole: budget, roadmap, vendors, projects. A vCISO leads security specifically. Smaller companies often start with one role covering both; companies with compliance obligations usually separate them. Our vCIO service covers the broader role.
Not always. Managed cybersecurity runs the controls. A vCISO is worth adding when you need policy, compliance, insurance and leadership accountability on top of them, or when a customer or auditor asks who owns your security program.
Yes. Completing questionnaires accurately, and closing the gaps they expose, is a routine part of the role.
Yes. The role is independent of who runs your systems.
The assessment typically begins within a couple of weeks and produces the baseline and roadmap within the first one to two months.
No. A SOC (security operations center) is a team of analysts who watch your computers and servers around the clock, investigate alerts and isolate a machine when something is found; OAC offers that through Huntress 24/7 managed detection and response, an add-on priced at $9 per computer or server per month on our published rates. A vCISO is a person who owns the security program: risk assessment, policies, the compliance roadmap, and setting and verifying the requirements for controls such as the SOC. Neither is SOC 2, which is an independent audit of how a service provider protects its customers’ data; OAC Technology is examined under SOC 2 every year.
If someone has asked who is responsible for security at your company and the answer took a moment, call 952-548-5558 or contact us. We will walk through what you have, what you are being asked for and what a program would look like at your size.
