What is a vCISO?
A vCISO (virtual or fractional CISO) is the figure who leads your company's cybersecurity —strategy, risk, budget, liaison— but as an outsourced service, part-time.
You get the judgment and accountability of a CISO without paying a full salary or depending on finding (and keeping) that profile.
What does a vCISO do?
- Risk governance and security strategy.
- Priorities and budget, tied to the business.
- Liaison with management and IT.
- Oversight of suppliers and audits.
- Incident response at decision level.
- Reporting to management, in plain language.
Who is it for?
A vCISO fits when you need security leadership but not a full-time CISO.
- Companies that need a security leader but can't or won't hire one.
- Required by NIS2 to have security governance and an accountable figure.
- That want judgment on the board without a high fixed cost.
How we provide it
- Kick-off and diagnosis. Where you stand and what you need.
- Plan and committee. We set up security governance.
- Regular presence at board level.
- Ongoing management of risk and suppliers.
- Reporting to management with metrics.
Contract company ↔ Tria (not staff secondment) + a named vCISO designation, with professional liability cover. Regulatory responsibility stays with your management (NIS2 art. 20): we bring the judgment and the execution, we don't shift the obligation onto you.
Frequently asked questions
vCISO or in-house CISO?
A vCISO gives you the same leadership with more flexibility and less cost. An in-house CISO makes sense when volume and criticality justify a full-time role.
Is the legal responsibility yours?
Regulatory responsibility before the law stays with the company's management (NIS2 art. 20). The vCISO brings judgment, management and evidence so that responsibility is well covered.
How much time does a vCISO dedicate?
Tailored: from a few hours a month to weekly presence, depending on your size and risk.
Is the vCISO part of Plan Tria?
It's a specialised service added to Plan Tria when you want security leadership at the highest level.