What is a vCISO and when does an external head of information security make sense for a mid-sized company?

CISO stands for Chief Information Security Officer. The letter “v” stands for the external, or “virtual”, version – the same role, but performed by a specialist from outside the company, on a part-time basis. In practice, this is an adviser who knows the regulations and standards and also understands how the business works.

A vCISO does not configure servers or set up accounts. That is done by the IT department or an external IT company. The vCISO says what needs to be secured and why, and the IT people decide how to do it.

Their work usually covers the four areas listed below. Without someone who looks after all of them, security in a mid-sized company usually comes down to reacting to one problem after another.

No. The Polish National Cybersecurity System Act, amended to implement the NIS2 Directive, does not require a position called CISO. It does, however, require specific actions that someone in the company has to plan and oversee.

The Act applies to essential and important entities, which are mainly medium-sized and large companies in the sectors listed in its annexes. Put simply, a company stops being small when it employs at least 50 people or when its turnover and balance sheet total exceed EUR 10 million. The deadline for self-registration in the list passed on 3 October 2026, and the remaining obligations must be implemented by 3 April 2027.

We have listed below the main obligations a vCISO usually helps with. The Act allows a company to set up its own structures for this or to sign a contract with a managed cybersecurity service provider – an external firm that takes over these tasks. A vCISO can be part of such a service, or the person who oversees the external provider on behalf of the management board.

The simplest test is this: who does the management board ask when it wants to know how well the company is protected? If the answer is “the IT administrator, who has no time anyway” or “nobody”, it is worth considering a vCISO.

Take a hypothetical packaging manufacturer with 140 employees. A large food-industry customer sends a security questionnaire with 80 questions, and the IT manager spends two weeks answering it after hours. By the third such questionnaire in a year, an external specialist may turn out to be cheaper than your own people’s time and the risk of losing the contract. The typical situations in which a vCISO works well are listed below.

A small company without special legal requirements usually does not need a vCISO. A good IT provider will do more by putting the basics in place: backups that are tested by restoring them, two-factor sign-in, updates and training staff to recognise scams.

At the other end, a large company in a regulated sector, with its own security team and decisions to make every day, usually needs a full-time person. A few days a month is not enough when people have to be managed daily and every project needs input.

Nor will a vCISO replace the people who do the technical work. If nobody in the company will implement their recommendations, all you will get is documentation. In that case, besides a vCISO, you need an IT or security service provider to do the implementation.

Companies use a vCISO in three basic forms, compared in the table below. A project, such as a security assessment, is often chosen first, followed by an ongoing engagement.

The cost depends mainly on the number of days of work per month, the amount of documentation to prepare and the number of sites and systems. It also depends on whether the vCISO must be available for incidents outside working hours. The starting point matters too: a company with up-to-date procedures needs less work than one starting from scratch.

When comparing a vCISO with a full-time hire, calculate the full cost of an employee: salary, social security contributions, recruitment, training and the time it takes them to get to know the company. Also bear in mind that one employee rarely knows regulations, standards, technology and how to talk to the management board equally well.

A well-organised start takes a few weeks and ends with a plan that the management board understands and approves. By then, the board should be able to answer three questions: what are our biggest risks, what are we doing in the next quarter and who is responsible for it?

If, after a month, all you have is a pile of documents with no priorities, that is a warning sign. A typical sequence of work that leads to a good plan looks like the one below.

The vCISO role requires trust, because this person will learn the company’s weak points. So it is worth basing your choice on a few specific questions rather than a sales presentation.

Watch out for conflicts of interest. If a vCISO also sells software or services, their recommendations may be less objective. This need not rule them out, but you should know about it and address it in the contract.