You don’t have a tooling problem. You have nobody senior enough to decide.

FAQ

Frequently asked

Don’t see your question? Talk to a real person — we’re 833-92-CYBER.

• What is a virtual CISO?

  A virtual CISO (vCISO) is an experienced security executive who leads your security program on a part-time, contracted basis instead of as a full-time hire. The role is the same as an in-house CISO: own the risk register, set the roadmap, decide what gets funded, report to the board and regulators, and hold vendors accountable. The difference is that you are buying a fraction of a senior person's time rather than a $250,000-plus salary line. It is sometimes called a fractional CISO, and the two terms mean the same thing.

• How is a vCISO different from a security consultant?

  A consultant delivers an assessment and leaves you with a findings document. A vCISO owns the outcome of that document. We sit in your leadership meetings, carry the roadmap quarter over quarter, answer the auditor's questions directly, and are accountable when a control slips. If what you need is a one-time gap assessment, hire a consultant, and we will happily scope one. If what you need is someone who is still there in month nine making sure the POA&M actually closed, that is a vCISO.

• How much do virtual CISO services cost?

  Mid-market vCISO engagements in 2026 typically run $4,000 to $15,000 per month depending on hours committed, the number of frameworks in scope, and whether audit or assessment support is included. We scope to a fixed monthly retainer with a defined hour band and a written deliverable schedule, so you are not billed in surprise increments. A 10-hour monthly engagement covering one framework sits at the low end; a multi-framework program with CMMC assessment support and board reporting sits at the high end.

• Do we still need a vCISO if we already have an IT director?

  Usually yes, because they are different jobs. Your IT director runs systems and keeps the business operating. A CISO decides what risk the business accepts, which is a governance function that reports alongside IT rather than inside it. Asking an IT director to audit their own controls creates a conflict of interest that assessors, cyber insurers and boards all flag. A vCISO gives you the separation without a second headcount.

• Which frameworks can you lead a program against?

  CMMC 2.0 Level 1 and Level 2 with NIST 800-171, plus NIST CSF 2.0, HIPAA Security Rule, GLBA and the FTC Safeguards Rule, NCUA and NYDFS Part 500 for financial institutions, SOC 2, ISO 27001, and NIS2 and DORA for EU-exposed operations. Most of our engagements carry two or three at once, because mid-market organizations are rarely subject to only one.

• Are your vCISOs U.S.-based, and can they support CUI environments?

  Yes. All Cyberuptive vCISOs are U.S.-based. For DFARS 252.204-7012 and CMMC engagements involving controlled unclassified information we assign U.S.-citizen personnel and document the arrangement in your System Security Plan so it survives assessor scrutiny.

• What does the first 90 days look like?

  Weeks one and two are discovery: current state, existing evidence, contractual and regulatory obligations, and the real deadlines driving the work. Weeks three through six produce a scored risk register and a prioritized roadmap with owners and dates. Weeks seven through twelve start executing the top items and establish the reporting cadence, including your first board- or prime-ready summary. You have a written roadmap in hand inside six weeks, not at the end of the year.

• Can a vCISO help us answer a prime contractor or customer security questionnaire?

  Yes, and it is one of the most common reasons companies call us. We own the response: SPRS score, System Security Plan, POA&M, shared responsibility documentation, and the follow-up questions that arrive after you submit. For contractors, a defensible answer here is often the difference between staying on a bid and being dropped from it.