Virtual CISO · How we work
What a Spirity vCISO actually does, week by week
Not advisory hours you draw down against. A team takes the security leadership role for a fixed monthly fee, and the work shows up in one place — your Spirity vCISO portal, where every decision, task and document lives. This is the first month, a normal month, and what reaches your board each quarter.
A team holds the role, so the role does not go on leave
An engagement staffed by one consultant stops when that consultant is ill, on holiday or busy with another client. Four people with different jobs hold yours, and the obligations sit with the team rather than with somebody’s calendar.
Lead vCISO
Owns the security strategy, the risk picture and the reporting your management and board actually read. The professional accountability for the engagement is theirs.
Security officer
Takes the named officer role where a framework, a contract or the law requires one — including contact with the supervisory authority.
Audit-readiness consultant
Runs the assessment workshops, assembles the evidence, and knows what an auditor will ask for before the auditor asks it.
Technical expert
Reviews the controls, reads the scan results, and specifies what has to change in terms your IT team or provider can act on.
Across those four roles sit ISO/IEC 27001 Lead Auditor, NIS2 auditor, ISO/IEC 42001 Lead Auditor, CISA and CISM qualifications.
The first ninety days, and every month after them
Nothing here waits for a quarterly steering committee. The first scan runs while the gap analysis is still going.
- 01
The first 30 days
Kick-off in the week you sign, and portal access for your people in the same week. The named officer role designated and registered where the law requires it. Scope approved by management — which systems are in, and where the boundaries run. Your organization profile completed, the starting template applied, and the first external scan run.
- 02
Days 30 to 90
Assessment workshops: one question at a time with the person who actually owns the answer, rather than a spreadsheet mailed round and chased. The risk register built from your business rather than downloaded. The remediation roadmap agreed and phased against your real capacity. The first policies drafted.
- 03
A normal month
A short weekly status call on open tasks and what is blocking them, worked from the portal’s task list rather than from memory. Scans on their schedule. One monthly report: progress against the milestones, the open risks, and the decisions we need from you.
- 04
Every quarter
A management review. The posture trend and what moved it, the key risks re-checked, residual scores recalculated as mitigation lands, and the plan re-phased against what actually happened rather than what was planned in month one.
The division of labor, agreed before it is tested
Most of what goes wrong in this kind of engagement is a disagreement about who was supposed to do something. These are the rows we settle at kick-off.
- 01
Policies and documentation
We draft; you approve. A policy nobody signed is not a policy, and an auditor knows where to look for the signature.
- 02
Risk decisions
We quantify, present and recommend. You accept, reduce, transfer or avoid — and we record who decided, when, why, and until when.
- 03
Technical fixes
Your IT team or your provider implements. We specify, review and verify. We do not touch your production systems, and we say so in the contract.
- 04
Evidence
Whoever does the work attaches the evidence to the task, while they are doing it. Collecting evidence at audit time is how audits are failed.
- 05
Contact with the supervisory authority
Ours: registering you, filing the notifications, handling the correspondence and coordinating the audit itself. The regulator gets one contact who has done this before, not somebody learning on the job.
- 06
Awareness and training
Your HR schedules it; we specify what the frameworks require and verify the evidence. This often runs as a program of its own.
- 07
Supplier assessments
We run the assessment and rate the result. You own the commercial relationship, and the decision to keep a supplier or replace one.
Awareness and training is the one row that usually becomes a program in its own right, with its own schedule and its own evidence.
Log in and see where you stand, today
You do not get a monthly PDF and a promise. Everything above lands in the Spirity vCISO portal under your own logo — the security posture score, compliance status per framework, the open task list with owners and dates, the risk register and the documents — and your people log in and read it whenever they want.
What they see is the current state of the work, not a snapshot assembled for a meeting: a task closed this morning has already moved the numbers. Access is by role, so each person sees the part that is theirs and is not asked to navigate the rest.
- Management: a read-only view of posture, open risks and progress against the plan
- IT and your provider: the tasks assigned to them, each with a step-by-step guide and somewhere to attach the evidence
- Process owners: the assessment questions that are theirs to answer, and nothing else
- Everyone: exports — assessment answers, the register, the reports and the evidence files — while the engagement runs and when it ends
Hosted and operated inside the EU
The Spirity vCISO portal is hosted and operated by Spirity, inside the EU by default — any other region is agreed before the platform is initialized, not after. Regulated clients can have it installed on their own infrastructure instead.
Each client account is separated from every other, access is granted by role, and your exports are available at any time and at no charge — during the engagement and on the day you leave, not on request and not as a leaving fee.
The things that actually arrive
- A kick-off plan, and a scope your management has approved
- The named officer role designated and registered, where the law requires one
- An assessment report per framework, with the gaps named rather than scored
- A risk register with owners, treatment decisions and a tolerance threshold
- A phased remediation roadmap with dates, owners and attached evidence
- A policy set written for how your organization actually works
- A monthly report, and a quarterly management review pack
Frequently asked questions
The questions we hear most often from security and IT leaders.
Something not covered here? Ask us directly
Less than running it yourself, and the demand is front-loaded. The assessment is the heaviest part: expect about two weeks of elapsed time, driven by your people’s availability rather than by the work itself. It could be done in a day if everyone sat down together, and almost nobody can — the questions reach across IT, HR, operations and whoever owns your contracts. After that it settles into a short weekly status call and whatever time your own team needs for the fixes we specify.
That is the normal case, not the awkward one. Your provider keeps doing the technical work; we specify what has to change, review it and verify it. They can be given tasks directly in the portal, with the step-by-step guide and somewhere to attach the evidence, or work from tickets in their own system. Outsourcing does not put any of it beyond reach: the provider itself is assessed as one of your suppliers, against its contract and its own reporting.
Yes, and it is usually the better order. The first thirty days are the same either way: scope, profile, the starting template and the first scan. A date changes the sequencing of the roadmap, not the work in front of it. If the date arrives mid-engagement we re-phase the plan against it — which is a quarterly exercise anyway.
The Spirity vCISO portal is hosted and operated by Spirity, inside the EU. Regulated clients can have it installed on their own infrastructure instead. Each client account is separated from every other, access is granted by role, and your exports — assessment answers, the register, reports and evidence files — are available at any time, during the engagement and at the end of it.
That is a setting on your account rather than a property of the service: the assistants in the portal can be switched on or off per client, and which it is for you is something we agree with you rather than decide for you. Two things hold either way. Your material is never used to train an AI model — not the platform’s own, and not its providers’ — and that is the question most procurement forms are really asking. And nothing an assistant drafts reaches you unread: a vCISO reviews it and puts their name to it, which is the same rule that governs everything else we hand over. If your own policy is that none of it may be used at all, say so at kick-off and it is off before your first assessment.
Where this sits, and what comes next
The assessment
Two weeks, your answers and our review, scored against the frameworks you are held to.
Framework mapping
One control answered once, and counted against every framework that asks for it.
Ready to get started?
Partner with Spirity Enterprise to implement the right security and IT solutions for your organization.