Services
Virtual CISO & fractional IT leadership.
Scoped, not a retainer.
Senior security leadership from outside — risk posture, identity, data governance, incident readiness — delivered as a fixed-scope assessment, optionally with a fixed-fee remediation project. No open-ended retainer, no hourly meter. The regulated mid-market usually needs the direction and the roadmap, not another standing subscription.
Two ways to engage
One assessment. Then only the work you choose.
Every engagement starts the same way and ends where you decide — there is no version of this that becomes a permanent line item.
Engagement 01
Security & IT-leadership assessment
A fixed-scope reading of where you actually stand, with a prioritized, costed roadmap. The deliverable is a written document your CIO can take to the board, the auditor, or the cyber-insurance renewal. Defined start, defined end.
Engagement 02 — optional
Assessment + fixed remediation project
If you want the gaps closed, the remediation is a separate fixed-fee project quoted against what the assessment found — so the assessment stays honest about the gaps rather than becoming a pitch for the fix. Each client's scope differs.
What a vCISO engagement covers
- Security posture and risk read against the framework you report to
- Identity & access — Active Directory, Entra ID, Conditional Access, MFA, privileged access
- Data governance — Microsoft Purview, sensitivity labels, oversharing, DLP
- Endpoint & threat protection — Microsoft Defender coverage and gaps
- Backup & recovery readiness, and whether restores have actually been tested
- A prioritized, costed remediation roadmap — board-, auditor- and insurer-ready
What it is not
- Not a monthly retainer or a fractional-hours subscription
- Not legal advice, and not a compliance certification — readiness is sold, never held
- Not a resale channel — vendor-neutral, no partner-program tier incentives
- Not a staffing seat — senior practitioners on a scoped engagement, not a rented title
Reviewed by the team at Pro IT NW — Seattle, delivered USA-wide.
Need the regulated-framework specifics — GCC High, CMMC, DFARS, NIST 800-171 — or the identity and governance work itself? That lives in Identity, Security & Compliance. Wondering where security responsibility actually sits when an MSP runs your systems? Read who owns security in your MSP contract.
FAQ
Common questions about the virtual CISO lane.
What is a virtual CISO (vCISO)?
A virtual CISO is senior security leadership brought in from outside — someone who sets security direction, reads your actual risk, and tells the board and the IT team what to do about it, without the cost of a full-time executive hire. The usual market version is a monthly retainer. Ours is not: we deliver it as a fixed-scope engagement — a security assessment, and optionally a fixed-fee remediation project to close what it finds — with a defined start, a defined end, and a written deliverable. The regulated mid-market usually needs the direction and the roadmap, not another standing subscription.
What is the difference between a virtual CISO and a fractional CIO?
A virtual CISO owns security: risk posture, identity and access, data governance, incident readiness, and the controls an auditor or a cyber-insurer will ask about. A fractional CIO owns IT direction more broadly: platform strategy, modernization sequencing, vendor decisions, and where the money goes next. Most mid-market organizations that ask for one actually need a defined slice of both, and the two overlap heavily on the Microsoft stack. We scope the engagement to the decision you are trying to make rather than to a title — same senior people either way.
Do you offer the vCISO as a monthly retainer?
No. We do not sell an open-ended fractional-hours subscription, and we would rather say that on the first call than bill it for a year. Every engagement is a fixed-scope assessment, optionally followed by a fixed-fee remediation project — each one priced to what your environment actually needs. The unlimited, always-on retainer is the model that quietly bills for availability rather than outcomes; a scoped engagement with a written deliverable is how you can tell what you paid for.
What does a virtual CISO assessment include, and what do we get?
A reading of your security posture across identity (Active Directory and Entra ID, Conditional Access, MFA, privileged access), Microsoft 365 and data governance (Purview, sensitivity labels, oversharing, DLP), endpoint and Defender coverage, backup and recovery readiness, and the gaps against the framework you report to. The deliverable is a written assessment with a prioritized, costed roadmap — the document your CIO can take to the board, the auditor, or the cyber-insurance renewal. If you want the gaps closed, the remediation is a separate fixed-fee project, so the assessment is honest about what it found rather than a sales pitch for the fix.
How is it priced?
Fixed fee, scoped on the first call. Each engagement differs — the assessment is sized to seat count, the number of systems, and the framework you answer to, and the optional remediation project is quoted separately against what the assessment surfaces. You get a scope and a fixed-fee range before anything starts; there is no hourly meter and no retainer to cancel.
Is this legal or compliance advice?
No. This is operational and technical security leadership — what the controls are, where the gaps are, and what to do about them. It is not legal advice, and we are not your compliance assessor or certifying body: we do the technical readiness work and hand you the documentation and posture a C3PAO, auditor, or insurer will examine. For regulated-framework specifics — GCC High, CMMC, DFARS and NIST 800-171 — see Identity, Security & Compliance; for the line between running security and owning it contractually, read who owns security in your MSP contract.
Who actually does the work?
Senior engineers and security practitioners, US-based, working out of Seattle and delivering nationwide. There is no junior analyst learning security on your environment and no tier-one queue. We are vendor-neutral — no resale, no partner-program tier incentives — so the roadmap recommends what your environment needs, not what carries a margin.
Get a security posture you can take to the board.
Tell us the seat count, the framework you report to, and what triggered the question — an audit, an insurance renewal, a board ask, or a new contract. We'll come back with scope and a fixed-fee range.