Virtual CISO (vCISO) services from your fractional security team

Most fractional CISO firms have made "vCISO" a synonym for "we run your SOC 2." We start with security architecture review, data-flow analysis, and threat modeling, then build the program around your actual environment. Frameworks map onto the program when needed. Companies hire us when they want the security to actually work, not just the badge to clear the deal.

In practice, none. "Fractional CISO" emphasizes part-time senior leadership; "vCISO" emphasizes remote or outsourced delivery. We use "fractional security team" because the seat involves more than one person, a senior operator backed by analysts, GRC platform admins, and framework specialists.

The math typically flips somewhere between 250 and 500 employees, or earlier when a board, regulator, or major customer specifically requires a named full-time CISO. Below that, a fractional team delivers the same program quality without the $300K+ all-in cost and the six-to-nine-month executive search.

The platform surfaces what's missing. We operate it, configure controls to match your environment, drive remediation owners, manage evidence, respond to alerts. We run Vanta, Drata, Secureframe, Scrut, Sprinto, Cocoon, and Mycroft.io. No platform yet? We'll help you pick the right one first.

Both. We don't issue the audit report, that's the auditor's role, and the independence boundary matters. We prepare your environment, manage the auditor relationship through fieldwork, coordinate evidence requests, and remediate findings. We work alongside Prescient Assurance, MHM, and others.

Transition planning is part of the engagement. We document the program, hand over institutional knowledge, and stay on for a defined transition window so the new CISO inherits a running program, not a recovery project. About a third of long-running engagements end this way.

They are not substitutes, so the honest comparison is what each one leaves you holding. A GRC platform runs USD $20,000 to $60,000 a year and surfaces what is missing. It does not decide what to fix first, configure controls against your actual systems, chase the owners, or answer an auditor. Someone still operates it. A fractional security team starts at USD $2,500 a month and includes that operator, and we run Vanta, Drata, Secureframe, Scrut, Sprinto, Cocoon and Mycroft.io, so the platform stays yours either way. If you already have a security operator on staff, buy the platform alone. If you do not, the platform is a line item with a person-shaped hole behind it.

By building one program and mapping it, rather than running one project per framework. Controls are implemented against your real systems once, and each framework becomes a lens over the same evidence. SOC 2 and ISO 27001 overlap heavily, so the second certification is mostly mapping rather than new work. ISO 42001 is where a fractional team earns the most, because it extends the management system you already have with AI-specific risk and impact assessment, data governance, model lifecycle and human oversight, so most of the effort is deciding which of your AI uses are in scope rather than starting again. We operate SOC 2, ISO 27001, ISO 42001, ISO 27701, CMMC, CPCSC, HIPAA, PIPEDA, Quebec Law 25, GDPR and HITRUST from a single program.

Four things, and price is not the first. One, who holds the seat, and whether you meet that person before you sign, because a named senior operator and an account manager are different products. Two, whether the engagement opens with architecture review, data flow analysis and threat modeling or with a policy pack, because that decides whether you get a security program or a document set. Three, what happens after the audit, because a provider scoped to readiness leaves at the point the program needs operating. Four, whether the provider will tell you something you do not want to hear during fieldwork. Ask each one what they would flag to an auditor that would slow your certification down, and see who gives you a straight answer.