vCISO or full-time CISO: which do you need?

Whoever holds it, the CISO role owns the information security programme: the risk assessments and treatment plans, the policies and their reviews, business continuity, the follow-up of vulnerabilities and incidents, preparation for audits, and reporting to management. Neither ISO 27001 nor NIS2 requires the title CISO. They require that responsibilities are assigned and that management approves and oversees the measures.

• You need the role covered but the workload does not fill a full-time position.
• You cannot find or keep a senior security hire.
• You are building towards a first certification or a new regulation such as NIS2 or DORA.
• Your CISO has too much on the plate and needs extra hands on risk reviews, policies or audits.
• You want people with different strengths, such as risk, business continuity and auditing, rather than one person.

• Security decisions come up every day across many teams and sites.
• There is a security team to hire, lead and develop.
• The board or a supervisor expects a named internal executive.
• The role needs deep knowledge of your own systems and culture that only builds up in-house.

Many organisations combine both: a full-time CISO who sets direction, with external experts who run part of the recurring work.

A vCISO is usually sized by scope rather than by headcount: the frameworks you run, the number of entities and sites, how often reviews fall due and how much of the work the experts take on. A full-time CISO costs a senior salary plus recruiting time, and still needs tools and often outside help for audits.

With CISO as a service, Swiss experts run the risk reviews, the business impact analysis and the policy reviews in Operate, follow up remediation and prepare your audits in Assure, all inside your Acuna GRC workspace. You see every review as it happens, and your risk owners and approvers keep the decisions. If you already have a CISO, the same experts can work with them instead. See CISO as a service.