Short answer: Scope a vCISO engagement around two or three priority outcomes (for example, “CMMC Level 2 readiness” or “a working risk register and board report”). Then define who owns what between the vCISO and your team, agree on how you’ll communicate and report progress, and set measurable milestones you review regularly. Most vCISO frustration comes from mismatched expectations about hands-on work versus strategy. Settling that up front is the single most important scoping decision.
Why do vCISO engagements go wrong?
When a vCISO engagement disappoints, it’s rarely a skills problem. It’s almost always a scoping problem:
- Strategy vs. execution mismatch. The client expected someone to configure firewalls; the vCISO expected to set direction while IT executes. Or the reverse.
- Too many priorities at once. Trying to fix policies, compliance, vendor risk, and incident response in the first month spreads the hours thin, and nothing gets finished.
- No owner on the client side. Recommendations stall because nobody internally is responsible for acting on them.
- No definition of “done.” Without milestones, months pass and leadership can’t tell whether the engagement is working.
Step 1: Start with outcomes, not hours
Before discussing hours or price, write down what must be true in 6–12 months. Common vCISO outcomes:
| Outcome | What “done” looks like |
|---|---|
| Compliance readiness | Gap assessment complete, remediation roadmap underway, evidence organized for CMMC, NIST SP 800-171, ISO 27001, or a customer audit |
| Risk visibility | A maintained risk register with owners and treatment decisions |
| Leadership reporting | A recurring report that tells owners or the board where security stands and what to fund |
| Program foundation | A current policy set, defined roles, and an annual security calendar |
| Customer trust | Security questionnaires answered quickly and consistently from a single source of truth (see how to answer security questionnaires) |
| Incident readiness | An incident response plan, contact list, and at least one tabletop exercise |
Pick the two or three that matter most now. Others can be added once the first are on track.
Step 2: Define roles — what the vCISO owns vs. your team
A simple responsibility split prevents most friction. A typical starting point:
| Activity | vCISO | Your team / IT provider |
|---|---|---|
| Security strategy and roadmap | Owns | Input |
| Risk register and risk decisions | Facilitates and maintains | Leadership approves risk acceptance |
| Policies and procedures | Drafts and maintains | Reviews; leadership approves |
| Technical implementation (MFA, logging, backups) | Defines requirements; verifies | Implements |
| Compliance evidence | Defines what’s needed; reviews | Collects day to day |
| Vendor and customer security questions | Reviews and approves answers | Routes requests; supplies facts |
| Leadership / board reporting | Prepares and presents | Leadership receives and decides |
| Incident response | Leads readiness; advises during incidents | Executes technical response |
If you need the vCISO to do more hands-on work, such as writing a System Security Plan or running an assessment, say so explicitly. That work takes more hours than oversight.
Step 3: Agree on how you’ll work together
Every organization needs a different rhythm, so settle the basics up front rather than assuming them:
- Who the vCISO works with day to day, such as your IT lead or managed service provider.
- How progress and decisions reach leadership, and how often leadership wants to hear about risk.
- How to reach the vCISO between meetings and expected response times, especially for incidents and time-sensitive customer requests.
Step 4: Set measurable milestones
Good milestones are specific and dated in your project plan. Examples:
- Gap assessment against NIST SP 800-171 complete, and SPRS score estimated
- Risk register created with the top 15–25 risks, each with an owner
- Core policy set approved by leadership
- First leadership report delivered
- Incident response tabletop exercise completed and lessons recorded
Review milestones on a regular schedule. As the program matures, the vCISO’s role usually shifts from build-out to oversight and advisory, and the scope (and cost) can shift with it.
What drives the cost of a vCISO?
vCISO pricing is usually a monthly retainer. Sometimes a fixed-fee project comes first, such as an initial assessment. The main cost drivers:
- Hands-on vs. advisory work. Writing documentation or running assessments costs more than oversight and reporting.
- Compliance burden. Formal frameworks (CMMC, ISO 27001, SOC 2 readiness) add evidence and documentation work.
- Environment complexity. Number of locations, systems, cloud platforms, and vendors.
- Meeting and reporting needs. Frequent working sessions and formal board reporting take more time than occasional check-ins.
- Response-time expectations. Guaranteed fast availability for incidents or customer escalations costs more.
When comparing proposals, line up the deliverables and level of involvement, not just the monthly price.
Frequently Asked Questions
How many hours a month does a vCISO need?
It depends on your outcomes and how much hands-on work is included. Start from the outcomes and how involved you need the vCISO to be. Hours follow from those, not the other way around. Expect more time in the first few months while the program is being built.
Should we start with an assessment before hiring a vCISO?
Often, yes. A one-time Security & Risk Assessment shows where you stand and what to prioritize, which makes the vCISO scope sharper. Many organizations roll assessment findings straight into a vCISO roadmap.
What should a vCISO contract include?
Defined outcomes and deliverables, a responsibility split, how you’ll communicate, response-time expectations, term and minimum commitment, how scope changes are handled, and confidentiality terms covering your security information.
How do we know the engagement is working?
You should see milestones completed on schedule, a risk register that changes over time, faster and more consistent answers to customer security questions, and leadership that can describe the organization’s top risks.
How USCIBER can help
USCIBER’s vCISO service starts from your priority outcomes and a clear responsibility split. It’s led by security leadership holding CISSP, CISA, and CISM credentials. Scoped after a call. For background on the decision itself, see vCISO vs. full-time CISO.
Sources
- NIST — Cybersecurity Framework (CSF) 2.0: Govern function categories for roles, responsibilities, and authorities (GV.RR), risk management strategy (GV.RM), and oversight (GV.OV)
- NIST SP 800-171 Rev. 2 — Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
This article is general information, not legal advice.