A Virtual CISO (vCISO) is a service designed to provide a combination of security guidance, practiced hands-on experience and security leadership when and where you need it most.

Our vCISO Program is a subscription-based security management offering that helps small to medium-sized (SMB) companies gain access to the knowledge, tools and hands on experience needed to manage and maintain an effective security program.

.

Organizations are dealing with complexities that require the knowledge and hands-on experience of practiced Cybersecurity Professionals. Many businesses just don’t have the budget for hiring a full-time employee with the right level of experience.

Most organizations have staff who manage technology products but remain challenged when it comes to addressing their long-term or strategic security needs. Hiring full-time security executives to provide this strategy can be very expensive and unnecessary. SMB’s need a trusted advisor that can provide security leadership and guidance when and where it’s needed most.

Small to medium-sized organizations need to adhere to a wide range of legal, regulatory and contractual security requirements but most don’t have the budget to hire a full-time CISO or don’t have enough work to keep a full-time CISO busy.

Our virtual Chief Information Security Officer (vCISO) Program provides small to medium-sized (SMB) organizations priority access to our extensive experience, security guidance and leadership when and where you need it most. We’ve designed this service to assist organization’s through the process of establishing, improving and managing an effective security program that addresses the many risk and compliance demands organizations continue to struggle with.

We develop a unique blend of services based on your business objectives, security obligations and compliance requirements.

Our base plan includes 5 hours per month and provides you priority access to our extensive experience, guidance and leadership when and where you need it most. Additional monthly hours can purchased at a discounted rate. The base plan also includes the following services:

• Vulnerability Management as a Service | Continuous Security Testing, Monitoring and Validation
  • Daily website malware scans for publicly accessible websites.
  • Weekly web application vulnerability scans for publicly accessible websites.
  • Quarterly vulnerability scans of on-premise and cloud-hosted Infrastructure.
• Company Appointed Security Officer
  • Most organizations appoint “Security Officers” with very limited formal security training and their primary job function does not include security. When you subscribe to our Virtual CISO service, you get a highly qualified security officer with a wide range of specialized expertise to help augment internal capabilities.
• IT Contract Reviews
  • The base plan allows for up to 2 contract reviews per month.  Time allocated to any additional contract reviews will be deducted from the monthly allotted hours.
• Security assessment questionnaires
  • The base plan allows for up to 2 security assessment questionnaires per month. Time spent responding to any additional security questionnaires will be deducted from the monthly allotted hours.

The monthly hours included with your vCISO program can be used for a wide range of services. Below are some of the more common activities.

• Ongoing development and maintenance of IT policies, processes and controls.
• Compliance assessments including PCI, HIPAA, SOC 1, SOC 2, ISO 27001 and GDPR.
• Risk assessments
• IT audits – Validation of internal security practices and controls
• Cybersecurity leadership and guidance
• Incident response planning and testing (Tabletop Exercises)
• DRP planning and testing (Tabletop Exercises)
• Customer and vendor contract reviews
• Responding to security assessment questionnaires from customers and partners
• Security awareness and training
• Penetration testing
• Social engineering
• Cloud Security
• DevOps Maturity Assessments
• Mergers & Acquisitions – IT Due Diligence
• Cyber Insurance Risk Assessment
• Security Program Maturity Assessments
• Breach Response – Incident Response Services
• Customer and vendor contract reviews
• Vendor and partner security assessments
• Vendor Evaluations with TCO Analysis
• IT cost optimization
• Security configuration reviews
• Vulnerability lifecycle management
• Web application security testing
• Identity and Access Management reviews
• IT Project Management
• And much more.

Our base plan starts at $2,495 per month, includes 5 hours per month and provides you priority access to our extensive experience, guidance and leadership when and where you need it most. Additional monthly hours can be purchased at a discounted rate.

The number of monthly hours included in your subscription is dependent on your business objectives, security obligations and compliance requirements. Whether you need a lot of help, or just a little, you will have a qualified security professional available on a retainer basis as a member of your team, but without the overhead of full-time employees.

Our base plan includes 5 hours per month and provides you priority access to our extensive experience, guidance and leadership when and where you need it most. Subscribers can purchase additional monthly hours at a discounted rate.

The number of monthly hours included in your plan is dependent on your business objectives, security obligations and compliance requirements.  We provide highly targeted services at a fraction of the cost for a full-time CISO.

 Whether you need a lot of help, or just a little, you will have a qualified security professional available on a retainer basis as a member of your team, but without the overhead of full-time employees.

We can deliver our vCISO Program services remotely or in-person. Many clients opt for a hybrid approach.  We work with each client to find the right balance of on-site and remote activities to fit each organization’s budget and culture.

We provide customized, comprehensive security assessments based on organizational requirements, client-facing obligations, best practices & industry standards. We incorporate your organization’s policy requirements for corporate governance.
We offer the following types of Security Assessments:

• -Security Program Maturity/Gap Assessments.
• -Internal Risk Assessments.
• -Partner Risk Assessments.
• -Vendor Risk Assessments.

We assign subject matter experts to monitor Security Assessment response activity in real-time using dashboards and reports.

• -We help you automate risk and compliance data gathering through campaigns.   We track overall campaign progress & response activity in real time.
• -Easily reassign and delegate questions and campaigns based on business process adjustments and updates.

• We’re able to provide executive-level reporting as well as detailed drill-down views for auditors and compliance officers.

• Visually map every web application on the network.
• Details each device by OS, ports, services and certificates.
• Helps to continuously monitor your client-facing web applications keeping you in control of security.
• Application discovery and cataloging – We find new and unknown web applications across your network.

We efficiently scan for web application vulnerabilities
everywhere.  Monitor your perimeter for unexpected changes.

• -Web application Vulnerability scanning. Detect OWASP Top 10 risks such as SQL injection, cross-site scripting (XSS), cross-site request forgery (CSRF) and URL redirection. Then we prioritize them and focus on the issues that will have the most impact.
• -Includes web  applications on the perimeter and internal networks, and elastic cloud networks (Amazon, Azure, Google).
• -Incorporated penetration testing data keeps web application testing data in one place for integrated analysis.
• -Results provide accurate, prioritized actionable results.
• -Provides continuous insight into your organization’s ongoing attack-surface and associated risk/liability.
• -Website Malware Monitoring. Includes continuous Malware detection that finds hidden malware before it attacks users visiting your websites/web applications.  Protect your organization’s reputation and your users security by rooting out malicious code and content that’s been hidden in your website or applications. Advanced behavioral analysis helps identify even zero-day malware that eludes anti-virus and anti-spyware packages.

Running regularly scheduled web application scans helps to identify the highest risks to the business using trend analysis, zero-day and patch impact predictions.

• -Our experience and knowledge helps put critical issues into context.
• -We help you spot trends, see what’s changed since the last scan and accurately predict which hosts are at risk…even for zero-day attacks.

We monitor the life-cycle of your web application vulnerabilities and help manage the
remediation process.

• -Our service helps keep your team focused on core-competency & revenue generating activities.
• -We assign remediation tickets and manage exceptions.
• -Provide lists of patches by priority for each host and we help manage exception process.

We provide comprehensive
role-based progress reports that document progress for IT, business executives and auditors.

• -Our service provides context & insight, not just a data dump.
• -Continuous monitoring and insight into on-going progress with your organization’s risk management program.

We help manage & reduce risk by finding the official and “unofficial” devices that may be hiding in your environment. We provide quick and accurate visibility into vulnerabilities across your organization.  As the number of devices in your organization continues to rise, keeping them organized is crucial to proper security hygiene. 

• -Visually map every device and application on the network.
• -Identify which OS, ports, services and certificates are on each device.
• -Details each device by OS, ports, services and certificates.
• -Device discovery and cataloging – we find new and unknown devices across your network.
  
• -Continuously monitor your perimeter for unexpected changes.
• -Assign a business impact to each asset.
• -Dynamically tag assets to automatically categorize hosts.

We scan for vulnerabilities everywhere, accurately and efficiently.  We automatically update vulnerability statuses to provide you with key information about what issues are new, ongoing and fixed. And with Progressive Scanning, we provide even better coverage over multiple scans, enabling continuous testing of your web applications.

• -Includes devices and applications on  perimeter and internal
  networks, and elastic cloud networks (Amazon, Azure, and Google).
• -Includes scalable, high-accuracy progressive
  scanning that saves time and keeps focus
  on what matters most.
• -Authenticated scanning available to automatically log in to test like a real user.
• -Scanning tools support Selenium to enable
  complex authentication or workflow sequences for better scan coverage.
• -Access to scheduled and on demand scanning services. 

Identify the highest business risks & manage those risks using trend analysis, Zero-Day and patch impact predictions.   We scan and analyze OS and application configurations on each target host.

• -Track vulnerabilities as they appear, are fixed, or reappear.
  
• -Put critical issues into context with our expert advisory services.
• -Monitor certificates deployed throughout your network.
• -Spot trends, see what’s changed.
• -Predict which hosts are at risk for Zero-Day Attacks.
• -See which hosts need updates after Patch Tuesday.

We monitor the life-cycle of vulnerabilities and validate the remediation process.

• -Monitor vulnerabilities over time, assign tickets, and manage exceptions.
• -We keep track of everything so your team can stay focused on revenue generating activities.
• -Provide lists of patches by priority for each host and manage exceptions.
• -Keep track of vulnerabilities and actions taken.
• -Create per-host patch lists.

We provide comprehensive
reports that document progress for IT, business executives, customers and auditors.

• -Service provides context & insight, not just a data dump.
• -Continuous monitoring  and insight into ongoing progress with your organizaion’s vulnerability management goals.

We integrate with your IT staff to help define & refine policies, processes, controls based on IT standards best practices for hardening configurations and complying with relevant regulations and audit standards.

• -Policy, process, control development & maintenance
• -Define configuration policies required for different environments and classified assets.
• -Draw from a library of extensively used policies certified by CIS, including COBIT, ISO, NIST, ITIL, HIPAA, FFIEC, NERC-CIP and
  User Defined Regulatory Cross Reference.

We select host and application settings to automatically check for each policy.

• -We selectively choose which configuration settings to monitor from a rich library of controls for OSes, network devices, databases and applications.
• -We’re able to create custom controls based on your organization’s requirements.
• -We’re able to test controls immediately without re-scanning or reporting.
• -Translate how controls relate to critical  frameworks and regulations.

We Scan and analyze OS and application configurations on each target host against your defined requirements.

• -Monitor & scan security configuration files anywhere on premise, or in private or public clouds from a single console.
• -See how controls relate to critical frameworks and regulations
• -Test new controls immediately without rescanning or reporting.
• -Monitor arbitrary files on Windows and Unix/Linux hosts for changes so that unexpected modifications can be caught quickly.

We help you fix violations and configuration “drift” early – before audits – while also documenting and managing exceptions centrally.

• -Catch configuration “drift” while it’s easy to fix and before it results in a compliance issue or breach.
• -We help you manage exceptions via a
  documented approvals process.
• -Be confident that 3rd party audits will show compliance, not uncover violations.

We provide comprehensive
role-based reports that document progress for IT, business executives and auditors.

• -Report any time, any place –
  without re-scanning.
• -Document that policies are
  followed and lapses get fixed.
• -Enables data-driven risk and compliance management for your organization.

Preparing to handle a CritSit/DR Event.

• -Includes participating in DR Testing.
• -Participate in the planning and preparation for responding to DR events.

We help you to respond more readily & effectively  to DR Events.

• -Includes assessment activities related to preventing further damage during a DR event.

We help your organization speed up the recovery process. 

• -Includes recovery activities that take place after a DR event has taken place.

Prevent future DR Events or minimize their impact.

• -Mitigation activities take place both before and after DR events.
• -Includes activities that prevent a critical situation/DR Event from occurring, reduces the chance of an event happening, or reduce the damaging effects of unavoidable DR events.

We help to develop customer-facing notifications & communications during security incidents.  

• -Help to optimize communication methods & communication channels used during a security incident. 
• -Assist with crafting appropriate customer-facing communications during a security incidents.
• -Play a supporting role during customer incident discussions.

Triggered by a security  event. This includes reports of compromised  hosts, wide-spreading malicious code, software vulnerabilities, or something that was identified by an intrusion detection or logging system.   

• -Aide in incident analysis.
• -Assess scope of incident damage.
• -Collect, document and preserve incident evidence.
• -Maintain chain of custody of all incident evidence.
• -Assist preparation of recommendations to resolve incident and/or reduce impact of incident. 
• -Assist investigation to identify incident root cause or source, extent of damage, and recommended counter action.
• -Incident Response Support.
• -Assist control and containment of incident.

Incident response coordination & collaboration. 

• -Coordinate the incident response effort across the relevant departments within an organization.  Includes coordinating efforts with internal & 3rd party vendors when applicable.
• -Provide assistance in the analysis of the attack.
• -Capture & collect contact information and other relevant details related to the security incident (scribe function).
• -Facilitate information exchanges and analysis.

We help you track & maintain the incident details and associated records.  

• -Assist preparation of reports describing incident investigations.
• -Document incident details and help you ensure you retain proper records.

We provide on-demand, interactive browser-based employee security awareness training. 

• -Quarterly Employee Security Awareness Training.
• -Pass/Fail Evaluation at end of each session.
• -Employee sign-off/confirmation required at end of quarterly curriculum.

Phishing Simulations to help employees practice what they learn during employee security  awareness.

• -Performing ongoing phishing simulations helps to keep employees practiced & reinforces good security habits.  

Ongoing feedback, quizzes and surveys help us to evaluate the content and approach on an ongoing basis.

We identify security controls that must be in place post cloud migration to meet your security obligations and follow best practices.

Security and Compliance is a shared responsibility between cloud service providers and those consuming their cloud-based services.

• -We help ensure that the cloud provider has and can supply the necessary paperwork to prove security and compliance certifications such as ISO, SOC II, SSAE18, PCI, GDPR, etc.
• -We also help ensure that our clients are aware of their security and compliance responsibilities when it comes to security in the cloud.  The shared responsibility model is often misunderstood by consumers of cloud service.

• -Services contracts review
• -Data destruction/reclamation clauses
• -Cloud Maintenance clauses
• -Service Level Agreements, and more