Home / Services / Compliance & vCISO
Compliance
Compliance & vCISO
A fractional security leader and the program behind them: SOC 2, HIPAA, PCI DSS, CMMC and NIST CSF without a full-time hire.
Most companies we work with need a security leader a few days a month, not a $300,000 salary. The vCISO retainer gives you a named senior consultant who owns the policy library, the risk register, vendor reviews, customer questionnaires, board reporting and the audit calendar. Readiness projects take you from nothing to audit-ready on a fixed price, and we stay through the audit.
from $4,500 per month
What is included
- Named virtual CISO with 16 or 32 hours a month, same person every month
- Policy library mapped to your framework, maintained and approved on a schedule
- Risk register, vendor risk reviews and customer security questionnaires answered for you
- Evidence collection in Vanta, Drata or a shared workspace, kept audit-ready
- Auditor selection and management through the audit
- Quarterly board or leadership reporting
What you receive
- Gap assessment against the framework with a dated remediation plan
- Policy set, procedures and control owners
- Risk register and treatment plan reviewed quarterly
- Audit-ready evidence package and the audit itself, managed end to end
How it runs
- 1
Assess
Gap assessment in the first 30 days: every control, who owns it, what evidence exists.
- 2
Build
Policies, procedures and controls implemented with your team, in priority order.
- 3
Prove
Evidence collected continuously; mock audit before the real one.
- 4
Sustain
The retainer keeps controls operating, questionnaires answered and the next audit on the calendar.
Questions about compliance & vciso
Which frameworks do you cover?
SOC 2 Type I and II, HIPAA Security Rule, PCI DSS 4.0, CMMC Level 2, NIST CSF 2.0, NIST 800-171, ISO 27001 and the California CCPA/CPRA security provisions.
Do you do the audit?
No. An independent CPA firm or C3PAO issues the report. We prepare you, pick the auditor with you and manage the audit. We work with several and will quote them with the project.
How long does SOC 2 take?
Type I in 10 to 14 weeks from a standing start for most companies. Type II needs a 3 to 12 month observation window after that; six months is the usual choice.
Other services
Scope compliance & vciso for your environment.
Thirty minutes with the people who will do the work, and a fixed price in writing the same day.