Virtual CISO vs In-House CISO: Operating Model Decision Matrix

IG-Smart practical guides | Cyber leadership Edition: 24 October 2026 | Audience: Boards, CEOs, CIOs, procurement leads and security sponsors

Use this guide to make a better-evidenced decision. This is general information and an original working aid, not a client-specific legal opinion, certification, clinical safety authorisation or regulatory approval. Apply the relevant jurisdiction, current requirements and competent professional review to your circumstances. Examples are illustrative unless expressly attributed.

1. Define authority, incident coverage and the execution capacity the business requires.
2. Compare like-for-like scope and first-year versus recurring costs.
3. Use the operating-model gates to choose an accountable, sustainable arrangement.

How to choose accountable cyber leadership, governance capacity and a defensible engagement model without confusing advisory services with management responsibility or independent audit

Executive proposition: A vCISO is not automatically a cheaper substitute for a full-time executive. The right model depends on risk complexity, management accountability, authority, delivery capacity, coverage, board reporting and continuity. An outsourcing contract can supply expert capacity; it cannot transfer directors' governance responsibilities by default.

For: CEOs, Boards, CROs, CIOs, General Counsel, procurement leads, PE portfolio operators and security leaders planning a vacant or evolving leadership role. Scope: strategic procurement and governance decision support; not a salary survey, labour market forecast or commitment that IG-Smart accepts every executive or operational appointment described.

1. Which cyber risks, services, subsidiaries and regulatory frameworks must the leadership role cover?
2. Does the organisation need an accountable employed executive, retained independent adviser, fractional leadership, or a hybrid team?
3. Who controls budgets, accepts risks, signs decisions and responds to incidents outside office hours?
4. Is there enough internal implementation capacity to act on specialist advice?
5. What coverage, succession and conflicts arrangements will protect continuity?
6. How will effectiveness be measured beyond meetings held or documents written?

The UK Cyber Governance Code of Practice addresses directors' own responsibilities in five areas: risk management, strategy, people, incident planning/response/recovery and assurance/oversight. Choosing a virtual CISO does not remove these board-level responsibilities. [S1][S2]

A project security consultant or penetration tester does not automatically deliver the mandate of a virtual CISO. Scope matters more than job title.

The Fit Test is an original screening methodology; it is not a regulatory certification or numerical guarantee of outcomes. Failing a critical authority or incident-coverage gate cannot be offset by a low retainer.

A defensible financial comparison uses total comparable capability, not salary versus monthly retainer alone. For an employee, include recruitment, employer costs, specialist deputies, training, tooling, holiday cover and the organisation's actual incident support arrangements. For a vCISO, include the contracted mandate, capacity and availability, technical implementation resources, additional expertise, incident retainers, travel, reporting, onboarding and change requests.

Do not assume that a retained adviser provides unlimited availability, 24/7 SOC monitoring, penetration testing, breach response or accredited certification. If a service is excluded, cost its necessary complement rather than claiming the risk has disappeared.

Buyer-side economic model

First-year cash cost = recurring leadership fees or employment costs + required supporting delivery capacity + incident/recovery provision + separate assurance costs + one-off recruitment, mobilisation and transition.

Steady-state annual cost = the same recurring components, excluding one-off costs unless they genuinely recur. Avoid double-counting items already included in a fee or employment-cost estimate. Model ordinary demand and a stressed demand scenario separately.

Unpriced exposure is a separate decision input. Record uncovered dependencies, capacity constraints and consequences alongside the cost comparison. Do not add an arbitrary financial value to an unknown risk merely to make a cheaper model appear equivalent. Estimates require stated assumptions; the guide supplies no market salary, guaranteed saving or risk-price benchmark.

1. Mandate: precise services, sectors, legal entities and outcomes.
2. Authority: approvals the adviser can recommend versus decisions reserved for management.
3. Capacity: retained time, locations, meeting schedule, response assumptions and surge terms.
4. Incident boundary: when the adviser is available; what constitutes an emergency and what is out of scope.
5. Evidence and reporting: access to records, management cooperation and board-report cadence.
6. Independence: conflicts, self-review limits and separate audit procurement.
7. Continuity and exit: replacement personnel, secure handover, ownership of deliverables and transition.

An engagement described as “virtual executive” may still be advisory in law and practice. Do not promise delegated statutory board authority, 24/7 incident response or outcomes without an express contractual basis.

Early enterprise SaaS selling into regulated procurement: a retained vCISO may help establish governance, ISO readiness and supplier questionnaires while the internal technical team builds controls. Independence boundaries must be preserved for Clause 9.2 audit.

Complex financial services organisation: dedicated leadership may be important for regulatory interfaces, operational resilience, outsourcing concentration and constant risk decisions; a hybrid team can add challenge and specialist expertise. Check specific FCA/PRA requirements rather than assuming one mandated role for all firms.

NHS technology vendor: the role may coordinate DSPT, cyber governance and assurance evidence, but it cannot replace the necessary clinical safety or information governance professional roles.

Large group with newly acquired subsidiaries: interim/hybrid leadership may help harmonise reporting and accountability, but jurisdictional, privacy and transfer obligations require specific review.

A buyer may score candidate models against governance fit (20), risk complexity (15), senior availability (15), operational execution (15), incident capability (15), independence (10) and continuity/transition (10), totalling 100 illustrative points. Rate each from 0 to 4 based on documented evidence. Mandatory gates on authority, incidents, competence and conflicts remain independent of the arithmetic. Weightings are a proposed tool, not proven prediction of outcomes.

For each model record the source of the score. “Vendor says 24/7” is not proof of a staffed incident function; verify contractual and operational evidence.

Discovery and mandate: confirm critical services, risk ownership, board expectations and constraints. Baseline: map highest-consequence exposure, evidence limitations, existing control programmes and unfinished commitments. Action plan: agree achievable work packages with resources and decision ownership. Board evidence: produce the first decision-grade pack, document accepted uncertainties and establish incident escalation. Operational handover: integrate control owners, calendars, suppliers, exercises and succession arrangements.

The order and duration of these activities depend on actual engagement scope. This outline must never be interpreted as a guaranteed 90-day implementation or included services at an entry price.

• Which senior practitioner will actually deliver the work?
• What relevant expertise and independence claims are verified?
• Which legal entities, services and regulated obligations are in scope?
• Who can accept material risk, approve spend and stop deployment?
• What evidence will reach the board and in what form?
• How many retained days and meetings are included?
• How are urgent issues handled outside business hours?
• Is incident-response engineering included or separately contracted?
• Which internal staff must execute the recommendations?
• Who maintains supplier oversight and third-party assurance?
• Does readiness support create an internal-audit self-review issue?
• How does the provider handle sickness, resignation or key-person loss?
• What are the boundaries of penetration testing or security operations?
• Can the provider support multiple jurisdictions without overstating legal coverage?
• Who owns work papers, risk registers and reports on exit?
• What is the handover process to a future in-house CISO?
• How are confidentiality, access and conflicts addressed?
• What are the base and surge costs under realistic demand?

Risk context: __; models compared: __; critical requirements: __; mandatory gate outcomes: __; comparative weighted findings: __; capacity gap: __; incident escalation owner: __; cost scenarios and assumptions: __; proposed operating model: __; authorised approver: __; transition and review trigger: __.

The board should decide based on defensible governance and ability to execute—not solely the provider's proposed day rate or a branded role title.

Does a vCISO remove the board's responsibility? No. It can support oversight and expert advice; accountability remains with authorised directors and management.

Can a vCISO deliver an internal audit? Only if the actual assignment meets applicable objectivity and impartiality requirements; prior implementation work may create conflicts.

Does a vCISO replace a DPO or CSO? No. These are distinct specialist/legal/professional roles requiring separate suitability and scoping.

Is there a regulatory requirement for every business to employ a CISO? No universal rule; check applicable sector and organisational arrangements.

Can a vCISO operate 24/7? Only under a defined, resourced contract; do not infer it from the title.

What should procurement compare? Mandate, authority, competence, availability, execution capacity, assurance independence, continuity and fully loaded economics.

Next step: Talk to a Senior Practitioner about cyber leadership accountability, risk complexity, retained capacity and reporting needs.

• [S1] UK Government, *Cyber Governance Code of Practice* gov.uk/government/publications/cyber-governance-code-of-practice/cyber-governance-code-of-practice
• [S2] NCSC, *Cyber Security Toolkit for Boards* ncsc.gov.uk/collection/board-toolkit
• [S3] NCSC, *Principle C: People* ncsc.gov.uk/collection/board-toolkit/principle-c-people