vCISO or an in-house CISO? How to choose a model for information security oversight

CISO stands for Chief Information Security Officer. This is the person who sets security rules, assesses risk, ensures compliance with the law and reports to the management board. A vCISO (“v” for virtual) performs the same role from outside the company, for an agreed number of days a month.

So the scope of duties is similar; the differences lie in availability, continuity and cost. An in-house head of security attends every project meeting and knows people by name. An external one comes in on agreed days, but usually knows more companies, more regulations and more typical mistakes.

In both models, someone else does the technical work: the IT department, the IT service provider or an external security operations centre. The head of security says what needs to be protected and why; they do not configure servers.

The KSC Act, amended to implement the NIS2 Directive, does not require a post called CISO. Nor does it say whether the person responsible for security must be an employee. It allows the tasks to be carried out by the company’s own staff or under a contract with a managed cybersecurity service provider (Article 14).

What it does require are specific outcomes. A company that is an essential or important entity must implement an information security management system: written rules that are actually applied, risk assessments and safeguards. It must also report serious incidents: an early warning within 24 hours, a notification within 72 hours and a final report within a month.

A common mistake in guides is to claim that an important entity has “lighter obligations” and so needs less. The risk management obligations are the same for both categories. An essential entity is also inspected preventively, whereas an important entity is inspected only when the authority has signs of problems – and it faces lower fines.

What matters most for choosing a model is that responsibility stays with the head of the entity, usually the management board. Neither a vCISO nor an in-house head of security takes it over. What they can do is make sure the board knows what it is responsible for and has evidence to show for it.

The table below compares the two models on the issues management boards usually ask about. There is no winner – each row may tip the balance in a different company.

A vCISO works well when security work takes the form of a programme: rules have to be built, risk assessed, changes planned and their implementation monitored. There are then few day-to-day decisions, and a lot depends on experience. We describe typical situations below.

Take a hypothetical logistics company with 180 employees that has established that it is an important entity. It has a three-person IT department that looks after hardware and systems. In the first year it must build an information security management system and prepare to report incidents. A vCISO can lead this work, with the IT department implementing their recommendations.

A full-time post makes sense when there are so many security decisions that a few days a month are not enough. This happens when the company runs many IT projects at once, changes suppliers often or itself provides services on which its customers’ security depends.

The second reason is the team. If several security specialists work in the company, someone has to manage them day to day: setting priorities, assessing their work and recruiting. That cannot be done well from outside a few days a month.

In many mid-sized companies, a combination of the two approaches works best. The vCISO is responsible for the rules, risk assessment and reports to the management board. Someone in the company oversees implementation day to day: the IT manager, a security specialist or the officer responsible for the security management system.

This is sometimes supplemented by an external security operations centre (SOC). Its team monitors alerts from the company’s systems around the clock and responds to suspicious events. It is important that the contracts state clearly who reports an incident to the relevant incident response team and within what time.

The mixed model can also be a transitional stage. The vCISO builds the rules, helps recruit an in-house head of security and hands over the documentation. That way, the new person does not start from scratch.

A comparison of “vCISO rate versus salary” is almost always misleading, because it leaves out some of the costs of an in-house post. Calculate the full annual cost of both models using the components below. We do not give market rates, because we have not found a reliable, up-to-date salary survey for this role in Poland.

For the in-house option, take the gross salary times 12 and add the employer’s social security contributions, usually around 20%. Then add bonuses, recruitment costs, training and certifications, and tools. Also allow for the few months it takes a new person to get to know the company, and the cost of cover during leave.

For the vCISO option, take the number of days a month times the daily rate times 12. Add the fee for out-of-hours incident availability, if it is charged separately. Also include the time of the person in the company who works with the vCISO, because without them the recommendations will not be implemented.

Remember that the first year usually involves more work than later years, because the rules have to be built from scratch. So compare costs over two or three years, not just the first.

Answer the questions below at a single management board meeting. If most answers point to day-to-day work and your own team, consider an in-house hire. If they point to building rules and oversight, start with a vCISO.

With a vCISO, the biggest risk is having nobody in the company who implements what has been agreed between meetings. Documentation then gets written, but nothing changes. The second risk is dependence on one person at the provider, so write cover arrangements and an incident response time into the contract.

With an in-house hire, the risk is that the only specialist leaves, and the gap they leave behind. The second risk is isolation: one person, with no contact with other companies, may miss new threats. Documenting work as you go and holding periodic reviews involving someone from outside both help.

In both models, avoid a situation in which the head of security checks their own work. If the same person implements safeguards and assesses whether they work, the management board will not get an objective picture.