--- title: "7 Advantages of using a \"virtual CISO\" (vCISO)" description: Outsourcing Information Security Team - vulnerability management; vendor risk management; answering customer questionnaires. (+) PCI DSS, HIPAA, SOC2 etc image: https://www.truvantis.com/hubfs/Blogs/7%20Advantages%20of%20using%20a%20virtual%20CISO.%20(vCISO).jpg --- [![truvantis-logo-reverse@2x](https://www.truvantis.com/hs-fs/hubfs/Truvantis%20Logo/truvantis-logo-reverse@2x.png?width=1117&height=250&name=truvantis-logo-reverse@2x.png "truvantis-logo-reverse@2x")](https://www.truvantis.com) [![truvantis-logo-main@2x-1](https://www.truvantis.com/hs-fs/hubfs/Truvantis%20Logo/truvantis-logo-main@2x-1.png?width=1117&height=250&name=truvantis-logo-main@2x-1.png "truvantis-logo-main@2x-1")](https://www.truvantis.com/) ** ## Blog ![](https://www.truvantis.com/hs-fs/hubfs/Truvantis%20Logo/truvantis-logo-main@2x-1.png?length=200) # 7 Advantages of using a "virtual CISO" (vCISO) May 16, 2018 --- A growing trend in the world of Cyber Security is companies outsourcing of some or all of their Information Security teams. This can be just a small part, like vulnerability management, vendor risk management, or responding to customer questionnaires. It could be just the leadership function--a virtual CISO or vCISO--or it could be the entirety of the Information Security team. As you evaluate the pros and cons of in-house vs. outsourced, consider the following. ---  1. Value Hiring a CISO can be expensive. I mean *really* expensive. Finding a leader for your InfoSec function that knows what he or she is actually doing will easily set you back over 240k, and that figure will be much larger in high demand areas such as the San Francisco Bay area. *[Top Cyber Security Salaries In U.S. Metros Hit $380,000](https://www.forbes.com/sites/stevemorgan/2016/01/09/top-cyber-security-salaries-in-u-s-metros-hit-380000/)* When you outsource InfoSec, you only pay for as much CISO as you need, and that may not be a full FTE. The rest of the Information Security activity can be performed by security analysts and engineers at a much more cost effective price point. Why pay for an expensive resource to answer the same questions in a customer security questionnaire over and over again? ## 2. Experience Even if you do bite the bullet and shell out for a full time CISO, are you really getting an industry veteran who has "been there, done that (and got the tee shirt)?" The candidates for a CISO hire are often pulled from the ranks of the Security Analysts at larger companies. This trend is more common with start ups that do not have the same brand-name cachet as large or public companies do.  Though they would often make fine team members, you are taking on a risk when you entrust a rising star with his or her first leadership role flying solo. It is better to rely on a team of industry veterans to define, implement, and monitor your Security Program. The Truvantis vCISO program makes that choice affordable. ## 3. Customer Perception A significant part of a CISO's role is articulating details of the security program to current or prospective customers in a way that reassures them. Sometimes this means joining sales calls to articulate why the organization is worthy of the customer's trust. Sometimes it can just mean explaining "what happened" or "what they heard" in a way that calms frayed nerves.  Just as the dulcet tones of an airline pilot's pre-flight announcement to passengers—channeling thousands of hours of flight experience—instills a sense of calm and trust, an experienced CISO can communicate authority, experience, and competence in meetings through just choice of vocabulary and confidence in the security posture of the organization. ## 4. Endurance We have encountered a number of smaller companies that cannot seem to keep hold of a CISO. There is an initial burst of activity as they set up the InfoSec program, define the controls, make some process changes, and perhaps attain a SOC2 certification. Then, life becomes a never-ending parade of customer questionnaires to fill out, and they start to get bored. Then, the appeal of a larger organization with more complex demands, a higher budget, and a larger team starts to look appealing. By outsourcing to a vCISO, you get all the attention you need from a career CISO when you need it, while the more day to day work is handled by journeymen who are happy to be part of a well functioning team where they can learn. ## 5. Maturity & Methodology When you bring on a CISO full time, you will need to agree strategic goals, monitor progress, and supervise the development and implementation of a security program based on an industry framework such as the CIS Controls that is the right size for your business. *[The CIS controls](https://www.truvantis.com/cis-controls)* An experienced CISO should be able to handle this. If they have built InfoSec functions a few times before, they probably have an idea of how they want to approach the task. A vCISO team, however, does this as their basic way of functioning. They should bring a tried and tested methodology for analyzing operations, classifying data, assessing risks, and developing a lean and manageable control set that can be turned into routine procedures and standards that will appropriately manage risk. They should also be able to present a baseline of reporting that will allow executive oversight of the function identifying status and maturity development. An in-house CISO may be building this from scratch. ## 6. Adaptive sizing How big should your InfoSec team be? Larger than a breadbox? Smaller than a two car garage? It can be difficult to justify any proposed headcount. Many smaller entities start by hiring a CISO and then expect that hire to perform all the functions at every level until the size of the company will support a larger team. With a vCISO team, you can ramp the delivery team size up and down on demand. More customer security questionnaires this month? Pull in some extra resources. Need to build out operations to support a new certification (SOC2, PCI DSS, HIPAA)? Just ask for some burst bandwidth. It is much easier to vary the level of effort than hiring and firing staff. ## 7. Staff Turnover Resilience It is a fact of work life that employees come and go. There will always be the unexpected resignation that was not on the business plan and causes an impact. Losing a CISO is such a concern. Not only do you have the usual headache of finding a replacement and needing to hope that operations are well documented and portable, you may also find yourself worrying about your next audit. Will you be able to maintain the SOC2 certification that is so essential to supporting sales with a change of CISO mid term? vCISO teams are adept at capturing this process in a methodical way that will support a headcount change. They need to be able to assure you that the commitment to maintaining your InfoSec controls is between you and the vCISO company—not with any individual person. They must have sufficient maturity in their delivery model to make sure that that remains true. **CONCLUSION:** Not only is outsourcing your Information security function possible, it is recommended. Leave Cyber Security to companies that are great at it, so you can focus on what *you* are great at. ---   #### Related Articles By Topic [PCI DSS](https://www.truvantis.com/blog/tag/pci-dss) [SOC2](https://www.truvantis.com/blog/tag/soc2) [CISO](https://www.truvantis.com/blog/tag/ciso) [vCISO](https://www.truvantis.com/blog/tag/vciso) [HIPAA](https://www.truvantis.com/blog/tag/hipaa) [CIS Controls](https://www.truvantis.com/blog/tag/cis-controls) [Security Program](https://www.truvantis.com/blog/tag/security-program) ### Subscribe Here! ### Recent Posts ### Related Articles By Topic - [Security Program (76)](https://www.truvantis.com/blog/tag/security-program) - [vCISO (38)](https://www.truvantis.com/blog/tag/vciso) - [CISO (35)](https://www.truvantis.com/blog/tag/ciso) - [PCI DSS (28)](https://www.truvantis.com/blog/tag/pci-dss) - [SOC2 (28)](https://www.truvantis.com/blog/tag/soc2) - [Penetration Testing (27)](https://www.truvantis.com/blog/tag/penetration-testing) - [Privacy (26)](https://www.truvantis.com/blog/tag/privacy) - [Risk Assessment (19)](https://www.truvantis.com/blog/tag/risk-assessment) - [CIS Controls (12)](https://www.truvantis.com/blog/tag/cis-controls) - [Red Teaming (8)](https://www.truvantis.com/blog/tag/red-teaming) - [HIPAA (7)](https://www.truvantis.com/blog/tag/hipaa) - [Threat Intelligence (7)](https://www.truvantis.com/blog/tag/threat-intelligence) - [ISO27001 (6)](https://www.truvantis.com/blog/tag/iso27001) - [CCPA (5)](https://www.truvantis.com/blog/tag/ccpa) - [CPRA (2)](https://www.truvantis.com/blog/tag/cpra) - [GDPR (2)](https://www.truvantis.com/blog/tag/gdpr) - [Ransomware (2)](https://www.truvantis.com/blog/tag/ransomware) - [Red Team (2)](https://www.truvantis.com/blog/tag/red-team) - [HITRUST (1)](https://www.truvantis.com/blog/tag/hitrust) [See all](https://www.truvantis.com/blog/7-advantages-of-using-a-virtual-ciso#) Contact Us Chat with one of our specialists about our vCISO service. [![Schedule a call](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/4366475/6fd3ce80-58b6-462c-9776-54af1b5f36a4.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/4366475/6fd3ce80-58b6-462c-9776-54af1b5f36a4) [![Contact Us](https://hubspot-no-cache-na2-prod.s3.amazonaws.com/cta/default/4366475/ccf084a3-d095-4418-80d6-891f8fdade46.png)](https://hubspot-cta-redirect-na2-prod.s3.amazonaws.com/cta/redirect/4366475/ccf084a3-d095-4418-80d6-891f8fdade46) ### Recent Articles ![Truvantis - Cybersecurity Maturity - One Size Does Not Fit All ](https://www.truvantis.com/hubfs/Blogs/Cybersecurity%20Maturity%20-%20One%20Size%20Does%20Not%20Fit%20All.png) PCI DSS, CIS Controls, Security Program, Privacy, ISO27001 [ Cybersecurity Maturity - One Size Does Not Fit All – Rick Folkerts ](https://www.truvantis.com/blog/cybersecurity-maturity-one-size-does-not-fit-all-rick-folkert) It's common knowledge that enterprise organizations need effective security, privacy and compliance programs to survive and grow. There are a handful of generic best practices but beyond that, cybersecurity programs must be tailored to... [Read more **](https://www.truvantis.com/blog/cybersecurity-maturity-one-size-does-not-fit-all-rick-folkert) ![The Silver Bullet Defense to Ransomware – by Andy Cottrell](https://www.truvantis.com/hubfs/Blogs/The%20Silver%20Bullet%20Defense%20to%20Ransomware%20%E2%80%93%20by%20Andy%20Cottrell.png) Ransomware [ The Silver Bullet Defense to Ransomware – by Andy Cottrell ](https://www.truvantis.com/blog/the-silver-bullet-defense-to-ransomware-by-andy-cottrell) In an era of cost-cutting, downsizing and generally insufficient budgets for everything, we are often asked, what is the one, main thing to do to protect against a ransomware attack? According to Statista, in 2022, there were 493.33 mi... [Read more **](https://www.truvantis.com/blog/the-silver-bullet-defense-to-ransomware-by-andy-cottrell) ![Cryptographic Agility – by Jeff Hall (the ’PCI Guru’)](https://www.truvantis.com/hubfs/Blogs/Cryptographic%20Agility%20%E2%80%93%20by%20Jeff%20Hall%20(the%20%E2%80%99PCI%20Guru%E2%80%99).png) Security Program [ Cryptographic Agility – by Jeff Hall (the ’PCI Guru’) ](https://www.truvantis.com/blog/cryptographic-agility) With the advent of quantum computing, a new threat has been added to the information security mix. The threat is today’s secure cryptography may not be secure once quantum computers reach their potential. The threat to cryptography has... [Read more **](https://www.truvantis.com/blog/cryptographic-agility) [![truvantis-logo-white@2x-1](https://www.truvantis.com/hs-fs/hubfs/Truvantis%20Logo/truvantis-logo-white@2x-1.png?width=1117&height=250&name=truvantis-logo-white@2x-1.png "truvantis-logo-white@2x-1")](https://www.truvantis.com/) [info@truvantis.com](mailto:info@truvantis.com) +1 (415) 422-9844 © 2024 Truvantis, Inc All Rights Reserved. [Privacy Policy](https://www.truvantis.com/privacy-policy)    [Terms of Service ](https://www.truvantis.com/terms-of-service) ![](https://px.ads.linkedin.com/collect/?pid=2614233&fmt=gif) ![](https://ws.zoominfo.com/pixel/dnjpprEKcMtv41HRInFR)