Service · Retained, monthly
Senior security judgement without the hire
Most UK organisations under a few hundred people cannot justify a full-time chief information security officer and do not need one. What they need is someone accountable: a named person who owns the risk register, keeps the controls and policies honest, answers the security questionnaires customers send, and writes the quarterly report the board actually reads. The virtual CISO does that. Where the law requires a data protection officer, or you want one anyway, the same person can hold that role too.
From £3,000
plus VAT per month, with a six-month minimum termRetained
1 person
named, who learns your business and stays with it — not a rota and not a ticket queueWho you get
Quarterly
a one-page report to the board: position, the three decisions it needs to take, what changedCadence
£95k+
is what a permanent CISO costs in the UK before employer's costs, and they will not be full-time occupiedFor comparison
Who this is for
Organisations of roughly thirty to three hundred people with something to protect and nobody whose job it is: a growing professional-services firm, a software company whose enterprise customers now send a forty-page questionnaire, a charity holding sensitive data, a healthcare supplier facing the DSPT, a regulated firm that needs a named accountable individual. You have an IT provider. You do not have anyone who decides what the IT provider should be doing, or who can tell the board whether it is enough.
The virtual DPO is for organisations that must appoint one under UK GDPR Article 37 — public authorities and those whose core activity involves large-scale monitoring or special-category data — and for those that choose to because customers and regulators expect it. The DPO role is independent by law; we explain what that means for how we work with you before you sign.
What we own
The register, the control set and the decisions about what to fix first.
- A risk register that is maintained, reviewed and reported — not written once for an auditor
- Controls mapped to a defined control set, with evidence of each one held and dated
- Policies kept current with the law: UK GDPR, the Data (Use and Access) Act 2025, Cyber Essentials, your sector rules
- Supplier and AI vendor reviews as they arise, and a register of what is deployed
What happens before, during and after a bad day.
- An incident-response plan that names real people, exercised at least annually
- First call in an incident, and the judgement on whether the 72-hour clock has started
- The security questionnaires, due-diligence packs and insurer applications your customers and brokers send
- Direction to your IT provider on what to do and in what order, and a check that it was done
The part that is usually missing.
- A one-page quarterly report: position against the controls, the three decisions only the board can take, what changed
- Attendance at the board or audit committee quarterly, in person or online
- Minute-ready wording so the board's oversight is recorded
- An annual statement of where you stand, for insurers, customers and regulators
The independence rule, and what it means here
A retained CISO advises you and helps you fix things. That is the job. It also means we cannot then assess your organisation and tell the world it passed, because we would be marking our own work. If you need an independent assessment, a Cyber Essentials Plus audit or an ISO 27001 certificate while we hold the CISO role, we get you ready for it and introduce a firm that has never advised you to do the assessing. We say this before you sign because it matters more than anything else on this page.
What it costs
A named senior person, a defined number of days each month agreed in the scoping letter, the quarterly board report and first call in an incident.
From £3,000 + VATPer month, six-month minimum
The fee depends on the days per month and the state you start in. It is fixed for the term and reviewed at renewal. Adding the DPO role is priced with it.
Cyber on call gives you the same named person on a block of hours with no monthly commitment — for the questionnaire, the investor's diligence pack, or the contract clause you do not like the look of.
From £1,350 + VATTen hours, valid six months
What actually happens, and when
First conversation
No charge. What you hold, who is asking you for evidence, what your IT provider does and does not do, and whether a retainer is the right shape — sometimes a bounded piece of work is.
Within a week
A scoping letter with the monthly fee, the days per month, the named person, what is in scope and the independence rule in writing.
Month one
A baseline: where you stand against the control set, the risk register started, the incident plan checked for real names. Your effort is around a day of your leadership's time across the month.
Months two to six
The priority fixes directed and checked, the policies brought current, the questionnaires answered as they come, and the first quarterly report to the board.
Quarterly
The one-page report and attendance at the board. What changed, what is next, and the decisions only the board can take.
Renewal
At six months we review the scope together. Many organisations reduce the days once the baseline is done. Everything we produced stays yours whether or not you continue.
Questions we are usually asked
Do we still need our IT provider?
Yes. We do not run your systems; they do. We decide what they should be doing about security, check that it happened, and tell the board. Good IT providers welcome this, because it turns vague requests into a clear list.
Is the DPO role really independent if you are also our CISO?
The law requires a DPO to act independently and report to the highest level of management, and forbids a conflict of interest with other roles. For most organisations under three hundred people the two roles are held together without conflict, and we set out in the scoping letter how we manage it. Where there would be a conflict — for example in a data-heavy business where the CISO decides how data is processed — we tell you and recommend a separate DPO.
What happens in an incident?
You call the named person. We make the first judgement on severity, whether the ICO clock has started, who needs telling and in what order, and direct the response with your IT provider. Incident hours beyond the monthly allocation are charged at the rate in the scoping letter, which you have seen before you sign.
Can you get us to ISO 27001 or Cyber Essentials Plus?
We can get you ready. We cannot certify you and we will not assess you, because we will have advised you. We introduce a certification body or an assessor that has never worked with you, and we do not take a referral fee.
Why a six-month minimum?
Because the first three months are baseline and fixing, and the value shows in the second three when the board gets its first proper report and the questionnaires start answering themselves. Shorter than that and you have paid for the hard part and left before the useful part.
There is no charge for the first conversation and no obligation at the end of it. If a retainer is the wrong shape for you, we will say so.