Virtual CISO for SMBs: what it is and when it makes sense to hire one

By Kike Gandia · Co-Founder & CEO, OSCP

A senior CISO salary in Spain typically sits somewhere between €80,000 and €130,000 a year, a figure most SMBs can neither afford nor need full-time. The virtual CISO (vCISO) is the alternative: an external professional or team that takes on strategic security responsibilities part-time, without the cost or commitment of an in-house hire. This guide explains exactly what they do, what they don't replace, and how to tell if your company needs one now.

What a virtual CISO actually does

They define the company's security strategy, prioritize spend based on real risk, oversee applicable regulatory compliance (NIS2, ENS, ISO 27001), coordinate technical providers (pentesting, managed security, training), and act as the point of contact for clients, auditors or the board when security assurances are requested. It's the leadership layer almost no SMB has, even if someone is already handling day-to-day technical work.

What a vCISO doesn't replace

It doesn't replace the team that executes (in-house IT or an MSSP monitoring systems), nor one-off pentesting or technical audits. The vCISO directs strategy; others execute the operational work. Hiring only a vCISO without operational technical support leaves execution uncovered.

Real cost: vCISO vs in-house CISO

A vCISO service for an SMB usually runs €800 to €3,000/month depending on dedicated hours and company complexity, versus €80,000-130,000/year (plus employer social security contributions and benefits) for a full-time senior CISO. For a company under 100 employees, a vCISO delivers the same strategic judgment at a fraction of the cost, without the risk of depending on a single person who could leave.

When an SMB genuinely needs one

The clearest signals: a client or investor starts demanding evidence of security governance, not just technical controls; the company falls under NIS2 or ENS and nobody internally can translate that into an action plan; or leadership wants to stop making security decisions blind and needs someone to explain real risk in business terms.

What a vCISO delivers, and how often

The most common question before signing isn't the price, it's what actually lands in the inbox each month. A well-defined vCISO service has dated deliverables, not generic availability hours:

When	What gets delivered	Who uses it internally
First weeks	Situation assessment and prioritized risk map	Leadership
First quarter	12-month security plan with estimated cost per line	Leadership and finance
Monthly	Follow-up minutes: what moved, what's blocked, what decision leadership owes	Management or committee
Quarterly	Indicator dashboard: incidents, patching status, training, access reviews	Leadership and clients demanding evidence
On demand	Answers to security questionnaires from clients, auditors or insurers	Sales and legal

If a vCISO proposal doesn't spell out that middle column, what you're buying is availability, not governance. Ask for the deliverables and their cadence to be named in the contract.

What access a vCISO needs — and what they shouldn't have

A vCISO doesn't administer systems, they review them. To work they need read access to the environment's admin console (Google Workspace, Microsoft 365 or whichever you run), the audit logs, the asset and vendor inventory, and contracts with security implications. They don't need — and shouldn't have — write permissions, global admin credentials, or access to the content of employees' mailboxes or drives. In practice, a read-only role with auditing (a delegated read role in the console, not a super administrator) covers 100% of the work and leaves a trace of every query. If a provider asks for global admin rights "to speed things up," that's a sign they intend to execute changes, which is precisely the work someone else should do to keep separation of duties intact.

FAQ

Can a vCISO sign the NIS2 or ENS declaration of conformity?

They can prepare it and coordinate the whole process, but final legal responsibility rests with company leadership, not the external provider.

How many hours a month does a vCISO dedicate to a typical SMB?

Usually 8 to 20 hours a month, adjusted by phase: more intensive in the first months (assessment and plan) and lighter during maintenance and follow-up.

Can I start with a vCISO and move to an in-house CISO later?

Yes, that path is common. Many companies use the vCISO to build the security program and, once volume justifies it, hire someone in-house with the approach and documentation already in place.

Can the vCISO answer our clients' security questionnaires directly?

Yes, and it's usually the use that saves the team the most time. The vCISO drafts the answers and supplies the evidence, but the company signs and owns the declaration: a client questionnaire is your contractual commitment, not the provider's. Keep every completed questionnaire alongside the evidence that supported it on that date — it's the first thing reviewed if a discrepancy comes up later.

What happens if we have an incident out of hours? Does the vCISO respond?

It depends on what the contract says, and it's worth settling before signing. A standard vCISO service is governance, not a 24/7 on-call rota: they coordinate the response, decide whether the AEPD (Spanish Data Protection Agency) or the competent authority needs to be notified and talk to leadership, but technical containment in the middle of the night belongs to an incident response service or the MSSP. What should exist from month one is a one-page document naming who calls whom, in what order, and with which phone numbers.

Is there a minimum commitment, or can the service be stopped?

The assessment and initial plan make sense as a closed project; from there, ongoing oversight is usually contracted in renewable periods. What matters on exit isn't the notice period, it's that the documentation (plan, risk assessment, inventory, minutes) stays with the company in an editable format, not inside provider tools you lose access to when it ends.

Sources

Talk about a virtual CISO for my company