Blog · vCISO
vCISO guides: owning security without a full-time CISO.
What a part-time security owner does, where the first ninety days go, and who carries security when nobody has it in their job title.
vCISO first 90 days: the plan for a part-time security owner
A vCISO or part-time security owner's first 90 days should produce four things you can prove, not forty policies. The six fifteen-day phases, what to refuse, and the four yes-or-no tests that tell you at day 90 whether it worked.
Who is responsible for cybersecurity in an SME? (and when a vCISO makes sense)
Management is accountable, and one named person has to own the decisions. NIS2 puts approval and oversight on the management body, ISO 27001 requires the roles to be assigned, and neither requires a CISO. Where the job lands by default, what it involves, and when a vCISO fits.