What a vCISO is responsible for

A virtual Chief Information Security Officer is responsible for owning your organisation’s security strategy, risk decisions and the reporting that gives the board and your customers confidence. The work is the same as that of a permanent CISO: the difference is that a vCISO does it part time, on a defined scope, for organisations that do not need or cannot justify a full-time executive. If you want the plain definition first, read what is a vCISO, then come back here for the responsibilities in detail. The role sits above day-to-day technical operations: a vCISO sets direction and accountability, while your existing team or managed providers handle the hands-on configuration and monitoring.

The core responsibilities, broken down

In practice the role clusters into a handful of areas. The first is risk: identifying what could actually hurt the business, deciding what to fix, accept or transfer, and recording those decisions so they hold up to scrutiny later. The second is strategy: a written, prioritised security roadmap that matches your risk appetite and budget rather than a generic best-practice wish list. The third is governance and reporting: turning technical detail into board-level language so directors can discharge their oversight duties, which is exactly the gap our board cyber governance work addresses.

Beyond those, a vCISO owns four recurring responsibilities. They are summarised here, then expanded in the sections below.

• Policy and control framework: building and maintaining policies that people follow, not shelfware.
• Compliance and assurance: mapping obligations such as NIS2 compliance and answering customer and insurer security questionnaires.
• Incident readiness: making sure there is a tested plan before something goes wrong.
• Vendor and supply chain risk: assessing the third parties who can compromise you through their access.

Risk management and security strategy

The first thing a competent vCISO does is build a clear picture of where your real exposure sits, not where a generic checklist says it should. That means understanding your business model, your most sensitive data, your regulatory obligations and the realistic threats to your sector. From there the responsibility is to set a roadmap that sequences work by impact, so spend goes where it reduces the most risk first. This is where security and commercial thinking meet, and where pairing the role with broader IT strategy consulting pays off. The IBM Cost of a Data Breach Report 2025 puts the global average breach at USD 4.44 million, which is the figure that makes prioritised, evidence-based risk decisions worth paying for.

Governance, board reporting and compliance

A large part of the role is translation. Directors are personally accountable for cyber oversight but rarely have the technical background to interrogate it, so a vCISO produces reporting that lets the board ask the right questions and evidence that it did. The ICO fined British Airways £20 million in 2020 and Interserve £4.4 million in 2022, and in both cases the failures were governance and control failures, not exotic attacks. Compliance responsibilities run alongside this: maintaining the policy set, mapping obligations, and handling the security due diligence that customers and acquirers now demand, which overlaps with technology due diligence during transactions. For regulated sectors, a vCISO carries the specific weight of regimes such as those covered in our cyber security for financial services work.

Incident readiness and emerging risks

Owning incident preparedness is non-negotiable. A vCISO makes sure there is a current, tested incident response plan, that roles and escalation paths are clear, and that the organisation can answer the practical questions of ransomware readiness before an attacker forces the issue. The responsibility list also now includes new categories of risk. Generative tools have created governance questions that did not exist a few years ago, which is why AI governance and the control of shadow AI increasingly fall to whoever owns security. A vCISO who ignores these is doing half the job.

Signs you need this role now

There are reliable triggers. You are losing deals or spending weeks on customer security questionnaires you cannot answer confidently. Your insurer or a major client is asking who owns security and you do not have a name. You are approaching a funding round, acquisition or new regulatory threshold. You have good engineers but no one accountable for security at a strategic level. Or you have inherited a leadership gap and need cover quickly, which is closer to an interim leadership brief. Any one of these is a sign the responsibilities above are currently unowned, and unowned security responsibilities are how organisations end up on the wrong side of a breach or a regulator.

How a fractional or interim arrangement delivers it

You do not need to carry a permanent executive to get these responsibilities covered. A UK CISO salary runs roughly £95,000 to £600,000 or more once you include the package, and most mid-market organisations do not generate enough full-time strategic security work to justify it. A fractional model gives you the same accountability for a fraction of the cost and time, scaled to what you actually need. This is the heart of our fractional CIO and CISO and CISO as a service offerings, and it sits alongside the equivalent virtual CISO and vCIO arrangements on the technology side. You can compare the commitment honestly using our CIO and CISO cost calculator and see the engagement options on the pricing page. Where you need broader technical change rather than a standing leader, cyber security consulting covers the project work.

Why Starkhorn

Starkhorn is led by Daniel J. Jacobs, who has spent over 20 years in technology and security, 15 of them in leadership roles, including Interim Group Technology Director at VetPartners, the BC Partners-backed veterinary group, and CIO and CISO at Jardine Motors Group. He is the author of The Strategy Bridge and holds PRINCE2, ITIL Foundation and full membership of the Institute of Interim Management.

Having held the CIO and CISO seat at group level and stepped into an interim technology leadership role at a private-equity-backed group, Daniel has carried the exact responsibilities described on this page, from board reporting to risk decisions, in organisations where they had to hold up to real scrutiny.

Frequently asked questions