Role clarity
Leadership and operation are connected—not interchangeable.
A virtual CISO is normally expected to advise management on security risk, investments, policies, incident preparedness and supplier accountability. An ISMS manager focuses on maintaining the processes that keep a defined management system functioning.
Neither title alone proves competence. Ask about the person delivering the work, their experience with comparable business complexity and the time they can genuinely allocate.
| Need | Virtual CISO | ISMS manager |
|---|---|---|
| Security strategy | Primary remit | Feeds operational evidence |
| Risk acceptance | Advises board; leaders decide | Records actions and decisions |
| Monthly policy/evidence work | Oversight | Primary coordination |
| Board risk reporting | Leads interpretation | Prepares factual status |
| Surveillance readiness | Provides governance context | Coordinates records and actions |
| Independent internal audit | Commissions impartial audit | Must not audit own work |
Buying signals
Choose based on what is failing today.
If your executive team cannot prioritise cybersecurity investment or coordinate security responsibilities, fractional leadership may be the missing role. If the certificate exists but risk actions, reviews and evidence have no consistent operator, managed ISMS may be a better fit. If enterprise deals repeatedly stall due to assurance requests, the Security Assurance Desk may be the highest-payoff immediate service.
- “Nobody briefs the board on cyber risk” → Virtual CISO
- “The annual audit is becoming a scramble” → Managed ISMS
- “Sales spends days answering security forms” → Assurance Desk
- “Our systems have unresolved vulnerabilities” → scoped technical implementation or specialist security provider
Questions to ask
A good proposal should answer these before you sign.
Who is named, which tasks are included each month, who makes material risk decisions, what happens if the lead is unavailable and what activities are excluded? The service should also explain how internal audits remain impartial and how evidence can be handed back to the business.
Do not judge two proposals from their monthly price alone if one is advisory hours and the other includes sustained evidence coordination.
Capacity illustration
One month of senior leadership is not the same as a month of evidence administration.
Take a hypothetical 80-person B2B company with ten overdue reviews and a quarterly board presentation. It may need a small allocation of CISO expertise to set priorities and interpret risk alongside more frequent administrative coordination to gather evidence. Buying only a senior adviser leaves the records unfinished; buying only an ISMS coordinator leaves the board without suitable decision support.
The right proposal separates those workstreams, names the people responsible and reserves independent internal audit work for impartial personnel. The relative amounts of each service depend on the true backlog and capability of the client's internal staff.
Primary references and further reading
These public references inform the topic; they do not constitute an endorsement or review of our services.
Editorial content reviewed: 12 October 2026. Specialist technical review is required before applying this guidance to a real environment.Put this into practice