Security advisory (vCISO)
A vCISO is a part-time head of security. You get a senior person who owns your security program, reports to your leadership, and answers for you when customers, auditors, or investors ask questions. It suits companies that have IT staff or engineers and need direction rather than more hands. It starts at $2,500 per month for about 8 hours.
What's included
- A twelve-month security roadmap, reviewed every quarter
- Security policies and procedures, written and kept current
- Risk reviews of the vendors and tools you buy
- Security questionnaires and customer due diligence calls
- Reporting to your leadership team, board, or investors
- SOC 2 or ISO 27001 upkeep after your first audit
- An incident response plan and a yearly tabletop exercise
Not included
- Hands-on IT administration. That is Managed IT.
- Audit reports. Only a licensed CPA firm can issue a SOC 2 report.
The first 30 days
- Week 1: interviews with leadership and a review of existing documents.
- Week 2: technical review of cloud accounts, identity, and devices.
- Week 3: a risk register, ranked by likelihood and impact.
- Week 4: the roadmap, presented to your leadership team.
How long it takes
The first month is an assessment and a written roadmap. After that, the work follows the roadmap.
What changes the price
- Number of people and devices
- Regulatory exposure: SEC or FINRA oversight, payments, banks as customers
- How many SaaS tools and cloud accounts you run
- How much cleanup your environment needs before we can run it
- Which frameworks and how much of the business are in scope
- Deadlines, such as a customer who needs a SOC 2 report this quarter
Recent work
A cybersecurity company
We took them through SOC 2. A security company has to prove its own security before customers will buy.
Questions
- How are hours counted?
- Monthly hours are an estimate, not a meter. If a month will run heavy, we tell you before it happens. If it keeps happening, we suggest the larger plan.
- Do you work with our existing IT provider?
- Yes. Many companies keep their IT provider and use us to set direction and check the work.
- Is there a contract?
- Twelve months at list price, or month to month at list price plus 10% with 60 days notice.
Talk to us
Tell us what's driving it: a customer deadline, a questionnaire, an exam, or IT that has outgrown whoever handles it now. A first call takes 30 minutes, and you'll leave knowing whether we're a fit and roughly what it costs.
Book a 30-minute callor send a message, or email contact@birchny.com.