Engagement three · Monthly retainer
A security executive in the seat, on your cadence.
Assessments and implementation have an end date. A security program doesn’t. The vCISO retainer covers everything in the first two engagements and adds the part that only works if somebody owns it continuously.
What the retainer covers
- Everything in assessment and implementation, as the program needs it.
- Ongoing oversight of control activity: owners doing the work, evidence landing where auditors will look for it.
- Governance that keeps the program defensible between audits.
- Leadership and board reporting on risk and program health.
Who this fits
Organizations of roughly 25 to 500 people with a compliance obligation, a security-conscious customer base, or a board that has started asking.
If you have a full security team and just need hands, we’re probably not the right fit, and we’ll say so.
Pricing
Scoped after an initial conversation, based on your frameworks and program maturity.
Need someone to own the program?
Tell us where things stand and what is driving the need.