Last updated: 2 November 2026
Quick answer: Core vCISO deliverables each month are a board-ready security report, an updated risk register, a remediation tracker, policy and exception updates, vendor risk reviews, incident and near-miss summaries, and a compliance status view against the client’s frameworks. Quarterly and annual deliverables add testing, training, audits and strategy refreshes.
Clients who buy a virtual CISO service rarely complain about the price. They complain when they cannot see what they got for it. Clear vCISO deliverables solve that problem, because every month the client receives the same set of outputs, in the same format, with visible progress.
This guide is written for MSPs, MSSPs and consultancies delivering vCISO services in the EU, UK and US. It sets out a monthly deliverables pack, what to add each quarter and year, how regulation shapes the list, and a template you can adapt for your own service.
What vCISO deliverables should clients get each month?
Every month, a client should receive a short, repeatable pack that shows current risk, progress against the plan and decisions needed from management. Seven deliverables cover most engagements, whatever the client’s size.
| Monthly deliverable | What it contains | Evidence it produces |
|---|---|---|
| Security status report | One to three pages: risk trend, top issues, decisions needed | Management oversight record |
| Risk register update | New, changed and closed risks with owners and treatment | Documented risk assessment |
| Remediation tracker | Open actions, due dates, overdue items, completed work | Proof of risk treatment |
| Policy and exception log | Policies reviewed or approved, exceptions granted or expired | Policy governance trail |
| Vendor risk review | New suppliers assessed, reassessments, open vendor findings | Supply chain due diligence |
| Incident and near-miss summary | Incidents handled, reporting decisions, lessons learned | Incident handling records |
| Compliance status view | Control coverage against ISO 27001, NIST CSF, NIS2, SOC 2 or others | Readiness and audit evidence |
In practice: Keep the monthly report to a length a busy director will actually read. The detail lives in the register and tracker; the report tells the story and asks for decisions.
1. The security status report
This is the one document most clients will read. Use a consistent structure: overall risk rating and trend, three to five headline issues, progress on the roadmap, metrics, and a short list of decisions or approvals needed. Ending with explicit decisions turns the report into a governance record rather than a newsletter.
2. Risk register and remediation tracker
The register shows what could go wrong; the tracker shows what is being done about it. Update both monthly, even if the only change is a status update. A risk register that has not moved in three months is a warning sign for auditors and for the client.
3. Policy, vendor and incident updates
Policy reviews, supplier assessments and incident summaries are where a vCISO shows continuous activity between strategic milestones. Batch them into the monthly pack so the client sees work that would otherwise stay invisible.
Why do regulations shape the vCISO deliverables list?
Because many regulations now require management to approve, oversee and understand cybersecurity, and a vCISO’s monthly outputs are often the evidence that they did. The deliverables should be designed to satisfy those duties, not just to report activity.
In the EU, Article 20 of the NIS2 Directive requires management bodies of essential and important entities to approve cybersecurity risk-management measures, oversee their implementation and follow training. They can also be held liable for infringements. Article 23 sets reporting stages for significant incidents: an early warning within 24 hours, an incident notification within 72 hours and a final report within one month.
In the UK, the Cyber Security and Resilience (Network and Information Systems) Bill was still before the House of Lords in September 2026. The government’s factsheet on relevant managed service providers says in-scope MSPs, other than small and micro enterprises, would register with the Information Commission, take appropriate security measures and report significant incidents. For many UK boards, the NCSC’s Cyber Security Toolkit for Boards, organised around the Cyber Governance Code of Practice published in April 2025, is a useful structure for board reporting.
In the US, listed companies follow the SEC rules announced in 2023. According to the SEC press release, material cybersecurity incidents are generally disclosed on Form 8-K within four business days of determining materiality, and annual reports must describe risk management processes and board oversight. Private clients often align with the NIST Cybersecurity Framework 2.0, released in February 2024, which added a Govern function.
| Region | Main driver | Deliverable to emphasise |
|---|---|---|
| EU | NIS2 management body duties and staged incident reporting; DORA for financial entities | Board approval records, training logs, 24h/72h/1-month incident timelines |
| UK | UK NIS Regulations, the Cyber Security and Resilience Bill, Cyber Governance Code of Practice | Board reporting against the Code’s principles, supplier risk evidence |
| US | SEC disclosure rules for listed companies, NIST CSF 2.0, sector rules such as HIPAA | Materiality assessment support, governance narrative, CSF profile updates |
Common mistake: Delivering the same pack to a NIS2 essential entity and a small US software company. The structure can be identical, but the compliance view, incident timelines and board evidence should reflect each client’s regulatory position.
What should vCISO clients get each quarter and year?
Quarterly and annual deliverables are where strategy, testing and assurance happen. They should be scheduled at the start of the engagement so the client knows what is coming and when.
Quarterly deliverables
- board or leadership briefing with risk trend and roadmap progress;
- review of key risk indicators and security metrics against targets;
- vulnerability and penetration test results review, with remediation planning;
- access review sign-offs for critical systems;
- tabletop exercise or incident response drill, rotating scenarios;
- reassessment of high-risk vendors.
Annual deliverables
- full risk assessment and updated risk treatment plan;
- security strategy and roadmap refresh for the next 12 months;
- full policy suite review and re-approval;
- internal audit or readiness assessment against target frameworks;
- business continuity and disaster recovery test;
- security awareness programme review and management training;
- budget recommendation for the next financial year.
A monthly vCISO report template
Use this outline as the front page of every monthly pack. It fits on two pages and gives the client the same view each month.
- Headline: overall risk rating (for example low, medium, high) and trend since last month.
- Top issues: three to five items, each with impact, owner and next step.
- Roadmap progress: planned versus completed milestones for the quarter.
- Metrics: five to eight indicators, such as critical vulnerabilities open beyond target, phishing test click rate, overdue remediation actions, vendors without a current assessment and policy reviews overdue.
- Incidents: incidents and near misses, with any regulatory reporting decisions and dates.
- Compliance view: control coverage by framework and changes since last month.
- Decisions needed: risk acceptances, budget approvals, policy sign-offs.
- Next month: planned activities and client inputs required.
In practice: Agree the metrics in the first month and keep them stable. Changing metrics every quarter makes trends impossible to read and undermines trust in the numbers.
How can MSPs deliver vCISO outputs at scale?
By standardising the pack and generating most of it from one system of record. If each monthly report is built by hand from spreadsheets, margins shrink with every new client.
Three practices help. First, use one control library and map it across frameworks so a single control update refreshes each client’s ISO 27001, NIS2 or SOC 2 view. Second, keep risks, remediation actions, policies, vendors and incidents linked, so the report pulls live status rather than copied figures. Third, template the report per client tier so that a small client gets a lighter version of the same structure.
Enactia, the GRC platform for vCISO and vDPO services, is built for this model: a multi-tenant, white-label workspace where AI-driven control mapping across frameworks links to risk registers, policy management and vendor risk assessments for every client. If you want to see how a monthly pack looks across a client portfolio, book a partner demo.
Many clients will also ask for privacy work alongside security. Our guide on vCISO vs vDPO differences explains how the two services fit together.
How do you stop vCISO deliverables turning into scope creep?
Write the deliverables into the contract with quantities, frequencies and exclusions. Anything not on the list is either a change request or a separately priced project.
- Define what each deliverable includes, for example “up to four vendor assessments per month”.
- List exclusions, such as hands-on remediation, 24/7 incident response or legal advice.
- Set client obligations: named contact, timely evidence, attendance at monthly reviews.
- Agree an escalation route for incidents and who makes regulatory reporting decisions.
- Review the deliverables list at each annual strategy refresh.
Key takeaways
- A monthly vCISO pack should include a status report, risk register, remediation tracker, policy log, vendor review, incident summary and compliance view.
- Quarterly and annual deliverables cover board briefings, testing, audits and strategy.
- Design deliverables to evidence management oversight under NIS2, UK and US governance expectations.
- Keep metrics stable so clients can read trends over time.
- Contract deliverables with quantities and exclusions to protect margins.
Frequently asked questions
What is the most important vCISO deliverable?
The monthly security status report, because it is the document management actually reads and the main record of their oversight. It should show risk trend, top issues, roadmap progress and decisions needed. The risk register and remediation tracker sit behind it and provide the detail an auditor or regulator would ask for.
How long should a monthly vCISO report be?
Two to three pages for the summary is usually enough, with the risk register, remediation tracker and compliance dashboard attached or linked. Directors are more likely to read a short report consistently than a long one occasionally. If a client needs more detail, add appendices rather than lengthening the front page.
Should vCISO deliverables differ for EU, UK and US clients?
The structure can be the same, but the content should reflect each client’s regulations. EU clients under NIS2 need management approval and training evidence and staged incident timelines. UK clients may follow the Cyber Governance Code of Practice. US listed companies need support for SEC materiality and governance disclosures.
Does a vCISO make regulatory incident reporting decisions?
A vCISO usually advises on classification and timelines, but the client’s management remains responsible for the decision and the notification. Agree in the contract who assesses significance, who approves the report and who submits it, so that the 24-hour or 72-hour clocks under frameworks such as NIS2 are not missed.
Which metrics belong in a vCISO monthly report?
Choose five to eight metrics tied to the client’s risks, such as critical vulnerabilities open beyond target, overdue remediation actions, phishing simulation results, vendors without a current assessment, policy reviews overdue and incidents by severity. Keep them stable month to month so leadership can see trends and judge progress fairly.
Make every month visible
vCISO deliverables are how clients experience the service. A consistent monthly pack, a scheduled quarterly and annual calendar, and a contract that defines scope make the value visible and protect your margins. Start with the template above, tailor the compliance view to each client’s region, and automate as much of the pack as you can. For the full partner model, see Enactia for MSPs.
To discuss building a scalable vCISO service, contact us or book a partner demo.
