Last updated: 6 November 2026
Quick answer: A vCISO is an outsourced, part-time security leader; a full-time CISO is an in-house executive. A vCISO usually fits organisations that need strategy, governance and audit readiness without a full executive salary. A full-time CISO fits organisations with complex environments, large security teams, heavy regulation or a need for daily leadership. Many use a hybrid.
Choosing between a vCISO vs full-time CISO is one of the first governance decisions a growing organisation makes. Regulators now expect named accountability for cybersecurity, boards want regular reporting, and customers send security questionnaires before they sign.
Both models can meet those expectations. The right answer depends on your risk, complexity and the amount of leadership time you actually need. This guide compares the two, explains what regulators in the EU, UK and US say about outsourcing the role, and gives you a decision framework you can use in a board paper.
vCISO vs full-time CISO: what is the difference?
The core difference is employment and time. A full-time CISO is an employee who leads security every day. A virtual CISO (vCISO) is a senior practitioner, usually from a consultancy or managed service provider, who delivers the same leadership functions on a fractional basis under a service contract.
The responsibilities overlap heavily. Either model can own the security strategy, the risk register, the policy framework, board reporting, audit preparation and incident oversight. What changes is availability, depth of organisational knowledge and how the cost is structured.
What a full-time CISO typically does
- Leads and hires the internal security team
- Owns the security budget and roadmap
- Sits in executive and risk committees and reports to the board
- Is on call for major incidents and makes real-time decisions
- Builds relationships across the business and embeds security into projects
What a vCISO typically does
- Runs risk assessments and sets a prioritised security roadmap
- Writes or refreshes policies and the control framework
- Prepares the organisation for ISO 27001, SOC 2, NIS2 or customer audits
- Reports to the board or leadership team on a fixed cadence
- Oversees vendors and internal IT staff who carry out the work
- Supports incident response under an agreed escalation model
How do the two models compare side by side?
A vCISO gives you senior expertise on a fractional, contracted basis; a full-time CISO gives you continuous, embedded leadership. The table below sets out the practical trade-offs.
| Factor | vCISO | Full-time CISO |
|---|---|---|
| Time commitment | Agreed days or hours per month | Full-time, embedded |
| Cost structure | Retainer or project fee, no recruitment or benefits costs | Salary, bonus, benefits, recruitment and retention costs |
| Speed to start | Typically weeks | Recruitment can take months |
| Breadth of experience | Exposure to many clients, sectors and audits | Deep knowledge of one organisation |
| Availability in a crisis | Defined by the contract and escalation terms | Immediate, on site |
| Team leadership | Directs existing staff and suppliers | Hires, builds and manages a team |
| Culture and influence | Limited by time on site | Strong, day-to-day presence |
| Continuity risk | Depends on provider bench and handover | Key-person risk if the CISO leaves |
| Independence | External view, less internal politics | Internal authority, may face budget pressures |
In practice: The biggest hidden variable is not the vCISO’s skill but the capacity of the people who execute. A vCISO who spends four days a month on strategy needs someone internal, or a managed service provider, to implement controls in between.
Can you legally outsource the CISO role?
In most cases, yes. Major EU, UK and US frameworks focus on accountability and competence, not on whether the security leader is on the payroll. What you cannot outsource is responsibility.
EU: NIS2 puts accountability on the management body
Under Article 20 of the NIS2 Directive, Member States must ensure that management bodies of essential and important entities approve cybersecurity risk-management measures, oversee their implementation and can be held liable for infringements. Members of management bodies must also follow training. NIS2 does not require a CISO job title, so a vCISO can support the board, but the board keeps the liability.
US: New York DFS and the FTC allow third-party security leaders
The New York Department of Financial Services’ cybersecurity regulation, 23 NYCRR Part 500, allows the CISO to be employed by an affiliate or third-party service provider. DFS guidance is clear that the covered entity retains full responsibility for compliance, and the CISO must report in writing at least annually to the senior governing body.
Similarly, the FTC’s Safeguards Rule in 16 CFR Part 314 lets the “Qualified Individual” who runs a financial institution’s security programme work for a service provider, provided a senior staff member oversees that provider.
US listed companies: disclosure of expertise
The SEC’s 2023 cybersecurity disclosure rules require registrants to describe board oversight of cybersecurity risk and management’s role and expertise in assessing and managing material cybersecurity risks. A vCISO arrangement is not prohibited, but you will need to explain it credibly in your annual report.
UK: board-level governance
The NCSC’s Board Toolkit is organised around the Cyber Governance Code of Practice and focuses on what directors should own: risk, strategy, people, incident planning and assurance. Again, the emphasis is on board ownership, with the security leader in an advisory and delivery role.
| Region | Key source | Can the security lead be external? | Who stays accountable |
|---|---|---|---|
| EU | NIS2 Article 20 | No CISO title required; external support permitted | Management body |
| UK | NCSC Cyber Governance Code and Board Toolkit | Guidance is role-neutral | Board of directors |
| US (New York financial services) | 23 NYCRR Part 500 | Yes, affiliate or third party | Covered entity and senior governing body |
| US (non-bank financial) | FTC Safeguards Rule | Yes, with internal oversight | Financial institution |
Common mistake: Treating the vCISO contract as a transfer of accountability. Regulators look at what the board approved, oversaw and challenged. Keep minutes of board reporting and decisions, whoever presents them.
When is a vCISO the better choice?
A vCISO is usually the better fit when you need senior security judgement but not a full-time executive. Common signals:
- You are building your first security programme. You need a risk assessment, policies and a roadmap more than you need someone to manage a team that does not exist yet.
- A certification or audit is driving the timeline. An experienced vCISO who has taken other organisations through ISO 27001 certification or SOC 2 can shorten the learning curve.
- Your IT is largely outsourced. If an MSP runs your infrastructure, a vCISO can provide independent oversight of that provider.
- You need cover during a gap. An interim vCISO can hold the role while you recruit a permanent CISO.
- Budget is limited. Fractional engagement lets you buy leadership time in proportion to your risk.
Many vCISO providers also offer vDPO services. If personal data is central to your business, it is worth reading about the difference between a vCISO and a vDPO before you scope the contract.
When do you need a full-time CISO?
You typically need a full-time CISO when security decisions are needed daily and the organisation is large or complex enough to justify a dedicated executive. Signals include:
- A security team of several people who need day-to-day leadership
- Multiple regulated entities, jurisdictions or business lines
- Continuous product or platform development where security must sit in every release
- A high volume of incidents, customer security reviews or regulatory engagement
- A board or regulator that expects an executive with authority over budget and staff
Even then, a full-time CISO often draws on external specialists for penetration testing, forensics or niche regulation.
What does a hybrid model look like?
A hybrid combines an internal security lead with a vCISO who provides strategy, governance and board-level experience. This is common in mid-sized organisations.
Typical patterns include:
- Internal security manager plus vCISO. The manager runs operations; the vCISO sets direction, reviews risk and reports to the board.
- Full-time CISO plus specialist vCISO. The CISO leads, and a vCISO covers a specific framework such as DORA or NIS2 in one subsidiary.
- vCISO as a bridge. A vCISO builds the programme for 12 to 24 months, then helps recruit and hand over to a permanent CISO.
If you want to see what a shared governance workspace looks like before choosing a model, you can start your 14-day free trial and set up a risk register and policy set with your current team.
How to decide: a five-question framework
Answer these questions honestly and score each one. Mostly “low” answers point to a vCISO; mostly “high” answers point to a full-time CISO; a mix suggests a hybrid.
| Question | Low (vCISO) | High (full-time CISO) |
|---|---|---|
| How many hours of security leadership do you need each week? | A few hours | Most of the working week |
| How many people will the security leader manage? | None or one | A team |
| How complex is your regulatory scope? | One or two frameworks | Many frameworks, several jurisdictions |
| How often do you face incidents or customer security reviews? | Occasionally | Weekly or more |
| Does the role need authority over a significant budget and staff? | No | Yes |
In practice: Revisit the answers every year. Growth, a new regulation or an acquisition can move you from one column to the other quickly.
What should you ask a vCISO provider?
Ask questions that test depth, continuity and accountability, not just credentials.
- Who exactly will be our vCISO, and who covers when they are unavailable?
- How many days per month are included, and how are extra hours handled?
- What is the escalation path and response time during a major incident?
- Which frameworks have you taken clients through, such as ISO 27001, SOC 2, NIS2 or DORA?
- What deliverables will we receive each quarter: risk register updates, board reports, policy reviews?
- Where will our risk, policy and evidence records live, and do we keep them if we end the contract?
- How do you handle conflicts of interest if you also sell security products or services?
The records question matters most. If the programme lives in the provider’s spreadsheets, you lose continuity when the contract ends. Keeping risks, policies and assessments in a platform you control protects you in either model.
What does the handover checklist look like?
Whether you move from a vCISO to a full-time CISO or the other way round, a clean handover should include:
- Current risk register with owners, ratings and treatment plans
- Approved policy set with review dates
- Control framework and mapping to each framework you follow
- Audit history, open findings and certification dates
- Vendor risk assessments and contract security clauses
- Incident log, playbooks and contact lists
- Last 12 months of board reports and decisions
A cross-framework control library helps here because the next security leader inherits one mapped set of controls instead of separate spreadsheets for each standard.
Key takeaways
- A vCISO delivers the same leadership functions as a CISO on a fractional, contracted basis.
- EU, UK and US rules focus on accountability, which always stays with the board or management body.
- New York DFS Part 500 and the FTC Safeguards Rule explicitly allow a third-party security lead.
- A full-time CISO is justified by team size, complexity and the need for daily decisions.
- Keep your security records in a system you own so any change of model is painless.
Frequently asked questions
Is a vCISO cheaper than a full-time CISO?
Usually, because you pay only for the leadership time you use and avoid recruitment, benefits and retention costs. The comparison changes as the hours increase. If you need a security leader almost every day, a fractional arrangement can approach or exceed the cost of an employee, and you may be better served by hiring.
Can a vCISO sign off NIS2 compliance?
No single person signs off NIS2 compliance. Under Article 20, the management body approves cybersecurity risk-management measures, oversees implementation and can be held liable for infringements. A vCISO can design the measures, prepare the evidence and brief the board, but approval and accountability stay with the management body.
Does NYDFS Part 500 allow a virtual CISO?
Yes. Part 500 allows the CISO to be employed by an affiliate or a third-party service provider. The covered entity keeps full responsibility for compliance and must make sure the CISO performs the duties set out in the regulation, including reporting in writing at least annually to the senior governing body.
How many hours does a vCISO usually work?
There is no standard. Engagements range from a few days a quarter for advisory support to several days a week during certification projects or incident recovery. Agree the hours, deliverables and escalation terms in the contract, and review them regularly against your risk profile and project workload.
When should we move from a vCISO to a full-time CISO?
Consider the move when you need security leadership most days, when the security team grows beyond one or two people, or when your regulatory scope spans several jurisdictions. A good vCISO should help you recognise that point, write the job description and hand over the programme cleanly.
Choosing the right security leadership model
The vCISO vs full-time CISO question is less about which model is better and more about which one matches your risk, complexity and budget today. Start with the five-question framework, check what your regulators expect, and remember that board accountability does not change with the model you choose.
Enactia’s AI-powered GRC platform gives internal CISOs and vCISOs one place to run risks, policies, assessments and board reporting across 50+ frameworks. To find out how it would support your model, contact us or book a demo or start your 14-day free trial.
This article is for general information and is not legal advice.
