A virtual CISO for the decisions a full-time hire would own.
F Creative Studio 360 provides fractional security leadership for organisations in any country. The board remains accountable.
Someone has to own the programme between audits.
The advice can be framed with the NIST Cybersecurity Framework and, where the organisation is being measured against them, ISO/IEC 27001, the AICPA Trust Services Criteria and PCI DSS.
Naming a standard is not a statement that you are certified to it.
- Leadership, not a one-off report
- A virtual CISO stays with the programme. A project consultant finishes a document and leaves. This engagement is the first of those two.
- The board stays accountable
- F Creative Studio 360 advises. The organisation’s directors still decide. The role is not a statutory appointment unless the organisation makes that appointment under its own rules.
- Sized to the organisation
- Time, topics and who attends are agreed in the engagement. There is no published package and no published monthly fee on this page.
- Not legal advice
- The work turns obligations into a programme a leadership team can run. Counsel interprets the statute. F Creative Studio 360 does not file reports for you.
What the role covers
The scope is the decisions in front of the leadership team. Hands-on testing, monitoring and incident work are separate services.
- A security strategy
- What the programme will do this year, tied to the services the business cannot lose.
- Risk the board can read
- A register in business language, and a note of what has been accepted, treated or left open.
- Policies and suppliers
- Direction for the policy set and for the suppliers that sit inside the programme. Drafting can be scoped with governance advisory.
- Compliance direction
- Which standard the organisation is actually being measured against, and what the next external audit will ask for. F Creative Studio 360 does not certify you.
- Incident leadership
- Who decides during an incident, and how the virtual CISO supports that decision. Hands-on response is a separate engagement.
- Board reporting
- A paper, and attendance, when the contract includes the meeting. Technical detail stays behind the decision the board has to make.
How an engagement runs
It can be delivered in person or online, including when directors are in more than one country.
- 1
Confirm the seat
Who the virtual CISO reports to, which entities are in scope, and which countries those entities operate in.
- 2
Read the programme
What already exists: policies, risks, suppliers and any audit that is underway.
- 3
Set the year
A short strategy and the decisions the leadership team still has to make.
- 4
Stay with it
A rhythm of reporting and decisions for the term in the contract. The term is agreed. It is not printed here as a fixed length.
Common questions
What does a virtual CISO do?+
Fractional security leadership: strategy, risk, supplier oversight, direction on the standards you are measured against, and board reporting when that is in scope. F Creative Studio 360 does not replace your counsel, and does not certify the programme.
Is this the same as a security consultant?+
No. A consultant delivers a defined piece of work. A virtual CISO remains accountable for the advice over the term of the engagement and sits with the leadership rhythm. The organisation still owns the decisions.
Can they present to the board?+
Yes, when the contract includes it. The paper is written for directors. Attendance at a board or audit committee is scheduled with the organisation. It is not assumed for every engagement.
Where do you do this?+
For organisations in any country, on site or online. Examples of rules the work can use, when the organisation is subject to them, include ISO/IEC 27001, SOC 2, PCI DSS, GDPR and the HIPAA Security Rule.
How much does it cost?+
It depends on the time, the number of entities, and whether board attendance is included. A scoping conversation with F Creative Studio 360 is the way to get a quote. There is no obligation to proceed.
Start with the decisions nobody currently owns.
F Creative Studio 360 will look at the programme and the leadership rhythm, then say what a sensible fractional role includes.