Clearly and evidently, the role of the Chief Information Security Officer (‘CISO’) is expanding rapidly and becoming much more impactful. So far so good, but sceptics will raise the big question - Why would you need a virtual CISO (‘vCISO’) when you could just engage a real one on a long-term contract? The response varies and is not necessarily the same for everyone.

To begin with, highly regarded, full-time CISOs can be difficult to find and are in high demand. It could be difficult for you to keep them on board and inspire them to stick around. So what options do you have?

In terms of deployment, the verdict is out with nearly 66% of the respondents to our survey seeing the merit of a vCISO due to limited IT security budgets. These respondents were largely from small and medium-sized businesses who either face budgetary constraints for a full time vCISO or come from relatively larger organizations where vCISOs have served as an effective stop gap arrangement between CISO hires in the event of a vacancy.

While analyzing the responses, we have seen that several organizations who are entering unfamiliar territory, look to a vCISO to bring diversified experience in developing and facilitating the attainment of the security mission and objectives with a framework that mitigates organization specific cyber security risks. A vCISO is increasingly being viewed by organizations as a smart and prudent way of realizing their information security objectives without a full-fledged information security team on their payroll.

26% of the respondents believe that a vCISO can facilitate the identification of best practices and provide unbiased insights on their cybersecurity requirements, such as the following:

• Evaluating the cyber security program’s current state and in identifying and prioritizing their requirements.
• Evaluating the organization’s maturity level and posture to combat cyber security risks.
• Aligning the cybersecurity program to the organization’s mission and appropriate security framework.
• Development of realistic strategic plans and in effectively monitoring their execution.
• Mentoring junior team members.
• Bringing in best practices to attend to vulnerabilities.
• Implementing sustainable security controls to minimize cybersecurity risks across the entire organization.
• Monitoring the cybersecurity effectiveness and health of the system.

6% of the respondents believe that a vCISO is best suited to address specific information security requirements, for which the organization may not have the internal means. These include assessment and alignment of the IT security architecture & policies, maintaining compliance & security control standards within industry regulations (including PCI, DSS & HIPAA), facilitating ISO 27001 compliances, undertaking vendor risk assessments, developing and testing disaster recovery & business continuity plans, assessing risks and providing ongoing risk metrics for review and decision making.

The remaining respondents believe that a vCISO provides continuity in the role and stability of the function.

The net take away is that organizations can secure their businesses without excessive expenditures. Securing your organization does not necessarily require hiring large IT teams or major financial investments. A sound and secure IT risk and security framework can display success by having IT manage risks rather than risks managing IT.

Please do not hesitate to get in touch with us at contactus@mgcglobal.co.in for any queries and our IT Risk Advisory team would be delighted to be of assistance.

Best regards

Markets Team

MGC Global Risk Advisory

About Allinial Global

Allinial Global (formerly PKF North America) is currently the world's second-largest member-based association (with collective revenues of approximately USD 5 billion) that has dedicated itself to the success of independent accounting and consulting firms since its founding in 1969. It currently has member firms in over 100 countries, who have over 28,000 professional staff and over 6,000 partners operating from nearly 700 offices across the globe.

Allinial Global provides its member firms with a broad array of resources and support that benefit both its member firms and their clients in the key impact areas of learning and development, human resources, international outreach, technical support, knowledge-sharing platforms through its specialized communities of practice, marketing resources, information technology and best practices in practice management.