The regulator and our clients ask who owns security. Nobody does, full time.
Fix: Our Swiss experts take the role on demand, and every review they run is kept in Acuna GRC, where you can see it.
Meet the expertsDone for you
CISO as a service
You need a CISO all year. Our Swiss experts take the role.
CISO as a service: our experts run the risk reviews, the BIA and the policy reviews in Acuna GRC all year. You review and decide. A virtual CISO, with all the work where you can see it.
1 · ASSESS THE RISKActual → Target
LikelihoodImpact
!Ransomware on file servers9 Risk · High4 Risk · Target
2 · WORK THE TASKSBoard
✓Patch the file serversDone
✓Test the backup restoreIn progressDone · record
Renew the firewall certificatesDue 30 Sep
Treatment plan healthAt riskHealthy
3 · PUBLISH THE POLICYDocument lifecycle
§Information security policyPending ApprovalPublished
Approvers signed2 of 33 of 3
✓Next review in 12 months
Does this sound like you?
When do you need a CISO as a service? When security has no owner with time for it.
Regulators, clients and auditors expect someone to own information security all year. Many companies cannot hire a full-time CISO, or theirs has too much on the plate.
The risk register was last reviewed for the audit.
Fix: Risk reviews run all year: each approved risk has a yearly review, reminded to its owner and confirmed in Operate.
See risk reviewsWe can’t hire a CISO, and one person would not cover everything.
Fix: You work with experts with different strengths: risk and governance, business continuity and auditing.
See what it coversWhat it covers
What does a CISO as a service do? The work that keeps security running.
Our experts run the risk reviews, the BIA and the policy reviews in Operate, follow up remediation and prepare your audits in Assure. Every step is recorded in Acuna GRC, so nothing lives in a report you only see once a quarter.
01 · Operate
Who keeps the risk register current?
Our experts prepare the risk assessments with your risk owners, who approve them, and run the treatment plans. Each approved risk gets a yearly review: the owner is reminded 30 days before, and Confirm review moves the date a year forward.
See Operate →02 · Operate
What if a critical process stops?
Our experts run the business impact analysis with you: RTO, RPO and MTPD per process, and a SPOF analysis that lists the assets several critical processes depend on, so you know where redundancy matters most.
See the BIA in Operate →03 · Operate
Who keeps the policies up to date?
Our experts draft or update your policies and send them for approval. Publishing sets the next review date, and the yearly review of each published document sits on the annual plan, so no policy quietly ages.
See documents in Operate →04 · Vulnerability management
Who follows up on vulnerabilities?
Our experts own the remediation follow-up and report to you. Each vulnerability becomes one issue with an owner and a due date set from its severity, and the owner is reminded before it is due. You decide what gets fixed and what gets accepted.
See Vulnerability management →05 · Assure
Who prepares the next audit?
Our experts prepare it with you in Assure: the records the auditor will ask for, the internal audit, the issues and corrective actions, and the management report. Your certification audit stays independent.
See Assure →Also part of the work
Aiko at your pace
Does AI replace the CISO? No. Aiko prepares, people decide.
Ask Aiko whether a risk still matches its evidence. It gathers the last control executions, the KPIs against target and the open vulnerable items on the risk’s assets, each with its source and date.
1Aiko proposes
Risk analysis · with sourcesRISK-004 · Ransomware on file serversScored Medium × Possible = 4 · evidence says higherBackup restore testLast two runs lateControl · 12 SepPatch level71% against a 95% targetKPI · 30 SepProposed: High × Probable = 92You confirm
You check, one risk at a timeChange Score✓Score changed and loggedRISK-004 risk value493You set the pace
How much Aiko doesSuggest only
Aiko explains. You do it.Ask me first · default
Aiko prepares. You confirm.Do it and tell me
Aiko does it and shows you.
A new score, with the evidence
Aiko can propose a new impact and likelihood for one risk, with the evidence on the card. Nothing changes until someone clicks Change Score.
Some things always ask first
Admins set the highest mode for each action.
Every step on record
Every Aiko action goes into the Activity log.
One Aikoacross Acuna GRC. Add a module and it helps there too. How Aiko works
Swiss experts
Who takes the CISO role? Our Swiss experts, on demand.
Extra hands to stay compliant all year: our experts run the security work inside Acuna GRC, with you. You keep the decisions.
.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
.png&w=3840&q=75&dpl=dpl_Ba6pf7ueYcNioUvDkWkKkJsULeG7)
CEO of Abilene Group
Henri Haenni
Business continuity
Auditing expert
Jean Munyarugerero
Management systems auditor
Do it yourself
You run the program in Acuna GRC, with Aiko.
Done with you
Guidance, reviews and audit preparation with your team.
Done for youCISO as a service
Our experts run it. You review.
CISO as a service, done for you
- Run the risk reviews and treatment plans
- Keep the BIA and the policies reviewed
- Follow up remediation and report to you
Integrations
Does our expert see live evidence? Yes, from 100+ connectors.
Connectors pull data from your identity, device and cloud tools on a schedule and record it as KPI measurements or control executions, so your expert and your team read the same numbers.
Animation: a robot arm takes data from Microsoft Entra ID, Microsoft Defender, Azure, AWS, GitHub and Jira and puts it on a belt into your workspace in Acuna, where your evidence, KPIs and security alerts stay current.
Entra ID
Entra Access Reviews
Okta
Intune
Defender
CrowdStrike
Jamf Pro
AWS
Azure
Microsoft 365
GitHub
KnowBe4
Acronis
Jira- 100+ connectors in all
Your tools feed Acuna GRC
Connectors pull security data on a schedule, and API keys let your own systems push data in. Every call is logged.
Missing a connector? We build it.
We design the integration around your setup. Every native connector we have exists because a client needed it.
Fixes land where your team works
Tasks sync both ways with Jira and ServiceNow. See Integrations and API
How it connects
Where in Acuna GRC does the CISO work happen? Operate, with the core around it.
Risk reviews, the BIA and policies run in Operate. Implement holds the controls and owners, Assure the records and reports, and Comply your frameworks.
Acuna GRC core
Add-on modules
FAQ
What else do companies ask about a CISO as a service?
Is a vCISO the same as CISO as a service?
Yes. Virtual CISO, fractional CISO, external CISO (externer CISO) and CISO as a service all describe a security lead you do not employ full time.
We already have a CISO. Is this for us?
Then Done with you fits better: our experts give your CISO extra hands, in the same Acuna GRC workspace. Acuna GRC for CISOs
Who makes the decisions?
You do. Our experts run the work and prepare the decisions. Your risk owners approve the risks, your approvers sign off the policies, and your team decides what gets fixed.
What does a CISO as a service cost?
It depends on your scope: the frameworks you run, the number of entities and sites, how often reviews fall due and how much of the work our experts take on. Tell us your scope and we size the service with you.
Does a CISO as a service cover NIS2 management accountability?
It supports it but does not replace it. NIS2 asks your management body to approve the cybersecurity risk-management measures, oversee them and follow training. Our experts prepare the risk reviews, policies and reports your management approves and oversees, and the decisions stay with them. NIS2 explained
Can your experts certify us?
No. Our experts help you prepare, and your certification audit stays independent: only an accredited certification body can certify you. Certification audit preparation
Which frameworks can it cover?
The frameworks you adopt in Comply, such as ISO 27001, NIS2, DORA, FINMA requirements or the NIST CSF. NIS2 compliance software
Do we need Acuna GRC?
The service runs inside Acuna GRC, so you see every review, risk and policy as it happens, not in a report at the end of the quarter.
We sell vCISO services ourselves. Is this for us?
Not this page: see Acuna GRC for MSSPs, built for firms that deliver security and compliance services to their clients. Acuna GRC for MSSPs
Where is our data hosted?
In Switzerland, the EU or the US, as you choose.
Need a CISO without hiring one? Start with one conversation.
Tell us your frameworks and where you stand. We show you how our experts would run the work in Acuna GRC, and what stays with your team.
Hosted in Switzerland, the EU or the US