vCISO / vISO: Strategic Security Leadership
Ongoing fractional CISO and ISO leadership — security governance, risk management, and board-level reporting without full-time headcount. Practitioner-led GRC that holds up with regulators and audit committees.
vCISO is an ongoing leadership function. If you need expert input on a single defined project, see Information Security & Cybersecurity Consultation.
Who this is for
Methodology
Baseline & Risk Assessment
Establish current security posture, regulatory obligations, and top risks with leadership alignment on priorities.
Programme Design
Define the security roadmap, policy framework, metrics, and governance structure for the retainer period.
Operating Rhythm Embedding
Establish steering committee cadence, incident escalation paths, and remediation tracking integrated with your teams.
Ongoing Governance & Reporting
Monthly or quarterly reporting to leadership, audit committee, and regulators as required — with honest risk status, not green-washing.
Annual Programme Review
Reassess roadmap, budget, and control maturity; adjust priorities for the coming cycle.
What you get
- Maintained risk register and treatment tracking
- Security programme roadmap with milestones
- Policy and standards suite — drafted or reviewed on an ongoing basis
- Board, audit committee, and regulator-ready security reports
- Steering committee packs and meeting minutes support
- Incident escalation and crisis advisory during the retainer (as scoped)
Engagement FAQ
A monthly retainer, quoted after a scoping call.
Typically 1–3 years.
Five working days each calendar month, dedicated to your information security function and scheduled in advance against the agreed workplan. Outside those days, the vCISO is reachable through a defined escalation channel and responds within the agreed response time. Each month you also receive a Monthly Management Report, and we review your Information Security Risk Register.
Yes. We sign a mutual NDA before scoping. We can sign yours or provide ours.
We store client data and evidence in Microsoft 365, encrypted at rest (AES-256), with access limited to the engagement team. We delete them 90 days after the engagement closes and confirm the deletion in writing.
Every engagement is led by one of our three co-founders, from scoping through remediation. vCISO is led by our Head of Infrastructure & Operations.
The full list of deliverables is under What you get above.
Or email contact@trinitytech.com.np