Service
Virtual CISO (vCISO) Advisory
Who it is for
Organisations in the United States adopting AI that need senior security leadership without appointing a full-time CISO.
When clients call
- The board needs a clear view of security risk and investment priorities
- Security responsibilities are split between IT, engineering and suppliers
- Customer requirements are growing faster than your security programme
Scope
- Security programme baseline and priorities aligned to AI adoption and business objectives
- Risk register, treatment ownership and escalation paths
- Board and executive reporting at an agreed cadence
- Policy direction, supplier oversight and compliance coordination
- Progress reviews with your internal teams and service providers
Method and standards
- NIST CSF 2.0
- ISO/IEC 27001:2022
- ISO/IEC 27005:2022
Deliverables
- Security programme charter and responsibility matrix
- Prioritised security roadmap
- Board risk and progress report
- Decision and action register
Engagement arrangements
Dates, responsibilities and any ongoing review cadence are agreed in the written scope. Retesting is included where stated in that scope.
What happens after the scoping call
Written scope and fixed-fee proposal within one business day of your scoping call. The scope names the standards applied, the deliverables, the dates and the people doing the work.
Questions
Who provides the security leadership?+
Shantanuu Roy provides the advisory leadership. Responsibilities, availability and reporting cadence are agreed in the written scope.
Does this include security planning and a roadmap?+
Yes. The agreed scope covers a security baseline, investment priorities and a roadmap, with continuing leadership support and progress reviews. AI risks are considered alongside your wider security responsibilities.
Does this replace our IT provider or internal team?+
No. We work with your team and providers on security priorities and oversight. Your organisation retains budget authority, risk acceptance and operational responsibility. This service does not include a staffed SOC, around-the-clock monitoring or emergency response.
How is the fee set?+
The written proposal defines the fixed fee, responsibilities and deliverables. Any change to scope is agreed in writing before additional work begins. Ongoing advisory includes an agreed review cadence and availability.
How is our evidence handled?+
Evidence is held under NDA, encrypted at rest and in transit, restricted to the named engagement team and destroyed on the schedule stated in the scope. It is never used to train any model.
Tell us what changed.
Thirty minutes, no obligation. Written scope and fixed-fee proposal within one business day of your scoping call.
Book a Strategic AI Readiness Assessment