Last reviewed: 20 October 2026
A vCISO in Nepal is usually considered for one of three reasons: a regulator has asked who owns information security, a key person has left, or the board wants senior security judgement it cannot yet hire full time. A virtual CISO (vCISO) can help in each case, but only if it fits what your regulator expects of the role. This guide sets out what Nepal Rastra Bank's documents say about the information security officer and CISO, when a vCISO makes sense, and when it does not.
What NRB expects of the role
The IT Guidelines: a designated Information Security Officer
NRB's Information Technology Guidelines state: "Bank should designate a senior official of the bank as Information Security Officer (ISO) who will be responsible for enforcing information security policy of the bank." They add that the ISO "will also be responsible for coordinating and communicating security related issues within the organization or with relevant external organization."
The guidelines also put capability on the bank's agenda: the bank "should assess the requirement of expertise to successfully complete required IT functions," and "the board should be adequately aware of the IT resources of the bank and ensure that it is sufficient to meet the business requirement."
The Cyber Resilience Guidelines: an independent senior executive
For institutions licensed by NRB's Payment Systems Department, the Cyber Resilience Guidelines (2023) are more specific: "A senior executive, such as a Chief Information Security Officer, responsible for carrying out the organization's cyber resilience architecture should be appointed by the board and senior management."
They then say what that executive needs. The institution should ensure the senior executive has:
- "sufficient authority and access to required resources (people and technology);"
- "access to directly report to the board;"
- "operational independence from other IT operations;" and
- "the necessary skills and knowledge to successfully plan and execute the LI's cyber resilience initiatives."
The CRG also makes the board's role explicit. "The board of the LI is ultimately responsible for making sure that cyber risk is properly managed," and the board "should establish the LI's cyber risk tolerance and cyber resilience strategy, specify roles and duties for dealing with cyber risk, and endorse the cyber resilience framework." It asks institutions to "appoint at least one board member with cyber security expertise."
What a vCISO is, and what it is not
A vCISO is a senior security practitioner engaged part time, usually on a retainer, to provide the strategy, governance and oversight a CISO provides: setting the security programme, reporting risk to the board, preparing for audits and regulators, and guiding the internal team.
Read against NRB's text, one point matters more than any other: the guidelines describe a senior official or senior executive of the institution, appointed by the board, with board access and operational independence. Whether an external person can hold that designation is a question for your board and your regulator, not for a vendor. The safe reading is that a vCISO supports and strengthens the designated officer. It does not let the institution leave the role empty.
When a vCISO makes sense
- Your designated officer is capable but stretched. A vCISO adds senior experience for strategy, board reporting and regulator interaction, while the internal officer runs day-to-day security.
- You are building the function. The CRG asks for a cyber resilience strategy, a board-approved framework, risk metrics for the board, and an internal steering committee. A vCISO can set these up and coach the people who will own them.
- Board reporting is weak. The CRG says "the board and senior management should ensure that the LI's cyber risks and management of those risks are regularly evaluated during board meetings," and asks for "relevant risk metrics" to support risk-informed decisions. A vCISO can design that reporting.
- You face a transition. When a security leader leaves, a vCISO can hold the programme steady while you recruit. The CRG asks boards and senior management to create succession plans for high-risk roles and "recruitment criteria for critical cyber roles."
- You need certification or audit readiness. A vCISO can lead preparation for an ISO 27001 project or an NRB IS audit, working with your teams.
When it does not
- As a substitute for an accountable internal appointment. If no one inside holds the designated role, a vCISO will not fix that.
- When the "CISO" would also run IT operations. The CRG expects "operational independence from other IT operations." A vCISO from your IT outsourcing provider has a conflict.
- When you need daily hands-on operations. A vCISO is a leadership role. Monitoring, patching and incident handling need operational staff or a managed service.
- When the same firm will audit you. An adviser that shaped your controls should not then audit them.
That last point is a rule we apply to ourselves: we do not perform NRB or NIA regulatory IS audits for any organisation where we provide vCISO or implementation services, during that engagement or for 12 months after it ends.
Decision table
| Situation | Recommendation |
|---|---|
| No designated security officer at all | Appoint one internally first; a vCISO can mentor them |
| Designated officer in place, no strategy or board reporting | vCISO to build strategy, framework and metrics |
| Strong internal CISO, specific gap (e.g. certification) | Project-based consulting rather than a retainer |
| Security leader leaving | Interim vCISO during recruitment and handover |
| CISO role sits inside IT operations | Fix the reporting line before adding a vCISO |
| You want the same firm as adviser and auditor | Separate them |
What drives the cost and length of an engagement
We don't publish prices. These are the factors that set the scope of a vCISO retainer:
- the size and complexity of the institution and its systems
- how mature the existing security programme is
- how much board, committee and regulator interaction is expected
- whether the vCISO is also leading a certification or audit-readiness project
- how much hands-on mentoring the internal team needs
Frequently asked questions
Does NRB require a CISO?
NRB's IT Guidelines require banks to designate "a senior official of the bank as Information Security Officer (ISO)." For institutions under the Cyber Resilience Guidelines, NRB expects "a senior executive, such as a Chief Information Security Officer" to be appointed by the board and senior management.
Can a vCISO be our designated information security officer?
The guidelines describe a senior official or executive appointed by the board, with board access and operational independence. Whether an external person can hold the designation is a question to settle with your board and regulator. Most institutions use a vCISO to support the designated officer.
Should the CISO report to the head of IT?
The CRG expects the senior executive to have "access to directly report to the board" and "operational independence from other IT operations."
Is a vCISO only for small institutions?
No. Larger institutions use vCISOs for transitions, board advisory work or specific programmes. The deciding factor is the gap you need filled, not the size of the institution.
Can the vCISO firm also do our IS audit?
It should not. An adviser that shaped your controls is not independent of them. We decline NRB and NIA regulatory IS audits for vCISO and implementation clients during the engagement and for 12 months after.
Next step
Trinity Technology provides fractional CISO and ISO leadership on a monthly retainer for regulated institutions in Nepal. See our vCISO / vISO service, or tell us about your security function and we will reply within 24 hours.