• A virtual Chief Information Security Officer improves IT security, offers manpower flexibility and cost efficiency.
• The vCISO’s responsibilities range from developing a customized security strategy to implementing an information security management system and monitoring day-to-day operations.
• Good vCISOs are highly qualified, certified and are equipped with industry knowledge and communication skills.

Over 2,000 cyber attacks on companies are registered every day and, with increasing digitalization, the potential damage that a successful attack can cause to a company is increasing. At the same time, the range of security solutions, frameworks and methods for protecting against attacks is also growing, but regulation in the area of IT security is at the same time becoming increasingly complex. Many large companies therefore now employ a Chief Information Security Officer, or CISO for short. The CISO is responsible for ensuring that the company’s IT security strategy is cost-efficient, effective and legally compliant.

But what can medium-sized and small companies do if they cannot afford or do not want their own CISO? Then a virtual Chief Information Security Officer (vCISO) is a good alternative to gain access to highly qualified security management and avoid breaches in the IT security architecture.

A CISO is responsible for the cyber security strategy, i.e. the reliability of the company’s IT, and at the same time ensures that all regulatory requirements for a company’s IT, software and data infrastructure are complied with.

The CISO usually reports to the Chief Information Officer or the Chief Technology Officer. Occasionally, they also report directly to the Chief Executive Officer.

The internet platform kununu states an average annual salary of around 95,000 euros for this position.

Virtual CISOs are experts who can be deployed by companies as required. This means that they are not a cost factor for the payroll budget, but are requested whenever projects are pending, urgent problem solutions are required or problems need to be avoided in advance.

• The implementation process usually begins with a security audit. Here, the vCISO determines how the respective company is positioned in the areas of IT security and regulation. It examines the security architecture, identity and access management as well as compliance with the legal framework.
• In the second step, the vCISO draws up a recommendation for the expansion or conversion of the existing security architecture. In addition to the efficiency of the systems, the focus is also on cost optimization, reliability and future-proofing.
• The vCISO then supports the implementation of the revised security measures. An Information Security Management System (ISMS) or the connection to a Security Operations Center (SOC) often support the evaluated measures.
• The quality of the system is then reassessed at regular intervals in order to keep the risk situation in the areas of operations, data protection, IT security and cyber resilience as low as possible.
• And, of course, the vCISO is available at any time in the event of a problem, for example to close acute security gaps or prevent the loss of valuable company data.

Further tasks of a vCISO include:

• Consulting on security strategy and on the choice of software, frameworks, etc.
• Support and monitoring of Managed Service Providers (MSP)
• Further development of the IT security strategy
• Preparation of IT security reports
• Consulting the management in the area of cyber security
• Maintaining contact with supervisory authorities
• Reviewing the IT security of partners and suppliers
• Regular updating of security guidelines

In addition, a vCISO is a highly valuable sparring partner for all IT departments in the company. He brings an external perspective and market experience to projects as part of the planning process. This enables them to identify vulnerabilities in existing security architectures quickly and reliably.

Apart from this, a vCISO can of course also take on the tasks of a permanent CISO as an interim solution, e.g. to compensate for parental leave, illness, vacations or other absences or to provide support in the event of a temporarily high workload.

As a virtual CISO communicates with the IT department as well as the management and sometimes the employees of a company, he or she must have good communicative skills in addition to professional qualifications. The candidate should be able to break down complex issues and explain them clearly. Negotiation skills, strategic thinking and experience in stakeholder management are also among the soft skills of a good vCISO.

The technical requirements for working as a vCISO include a degree in computer science (or comparable qualification) and relevant additional experience. Further qualifications such as an MBA with a focus on information security also show that a candidate is well prepared for the role of vCISO. In any case, the vCISO should be able to demonstrate good industry knowledge and several years of professional experience in the management of IT security programs and projects.

Important certificates that prove a comprehensive qualification when working as a vCISO:

• CISSP (Certified Information Systems Security Professional): This internationally recognized certificate is regarded as the most important proof of expertise in the field of information security.
• CISM (Certified Information Security Manager): Demonstrates that the candidate has mastered the management aspects of information security.
• CEH (Certified Ethical Hacker): The CEH certificate demonstrates that the holder has extensive experience in ethical hacking and penetration testing.
• ISO 27001 Lead Implementer: Certifies the ability to set up an information security management system in accordance with ISO 27001.
• ISO 22301 Business Continuity Management System: Ensures the continuity of the operations of the company even in the event of major incidents and in crisis and emergency situations.

By the way: Opting for a virtual CISO offers the opportunity to choose a partner that perfectly matches the current requirements of your own business sector – and to be able to replace them easily and flexibly if these requirements change in the future.

In addition to all these considerations, the availability of a vCISO in an emergency should also be clarified when deciding on a vCISO.

For small and medium-sized companies in particular, the decision to appoint a virtual Chief Information Security Manager is an opportunity to raise the quality of their own IT security to a higher level. The external consultant takes on tasks for which the CTO or CIO usually lacks the time and for which other IT employees are often not sufficiently qualified. Some guidelines also require the separation of CTO and CISO personnel.

In this way, a vCISO brings external expertise and competence to the company’s security management and at the same time offers personal flexibility and full cost control.