vCISO services
in Toronto.

When companies call us

The call usually comes after something has already gone slightly wrong.

1. →A deal has stalled. An enterprise customer’s security review has been open for three weeks.
2. →The insurer has questions. The cyber-insurance renewal arrived with forty of them, and nobody can answer.
3. →New obligations landed. A customer now requires SOC 2, or PIPEDA and Law 25 are suddenly on your desk.
4. →There was a near-miss. And it became obvious that nobody owns security.

A full-time security executive costs a serious salary plus bonus, equity and benefits. For a company of twenty to a hundred and fifty people, that is a lot to spend on a role you are not yet sure how to keep busy. A vCISO gives you that judgement part-time, for a monthly fee.

What the engagement covers

1. →Risk register and board reporting. A plain-language register of what could hurt you and a small set of metrics, so each board update shows what changed and which decisions are waiting on you.
2. →Audits and customer security reviews. Security questionnaires, SOC 2 and ISO 27001 readiness, and the auditor conversations, handled by the person who owns your security program.
3. →Vendor and contract review. The security obligations buried in your contracts, and the vendors who can reach your data.
4. →A roadmap you can afford. A risk-based plan tied to your budget, measured against NIST CSF 2.0, ISO 27001 or CIS Controls, whichever your customers and auditors ask for.
5. →Team mentorship. Your IT team usually knows where the soft spots are. We help them fix the ones that matter and make the case for what they need.

The first 90 days

1. 1.Days 1 to 30: listen, then map. Interviews across the business, not only IT, and a gap analysis against a real framework. Anything actively on fire gets put out.
2. 2.Days 30 to 60: build a roadmap you can afford. A ranked plan tied to your priorities and budget. Most of the value is in the sequencing: what to fix first, what to accept, and what to stop doing.
3. 3.Days 60 to 90: start, and prove it. The changes that close the most risk for the least disruption, often MFA everywhere, tighter admin access and endpoint detection where it is missing. Then the first board update.

We wrote up what a vCISO’s first 90 days look like in more detail.

What we need from you

Two things decide whether it works, and both sit on your side of the table. Lock the scope before we start, so nobody is surprised in month two. And name a counterpart inside the company who is allowed to make decisions. Without one, even a strong roadmap stalls.

Common questions

How much does a vCISO cost?

Engagements start at $4,500 a month. The final price depends on scope, which we agree before the engagement starts.

How is a vCISO different from a full-time CISO?

You get the same executive judgement, the strategy, the prioritization calls and the board-level translation, part-time and without the cost of a full-time executive.

Do we need one yet?

Maybe not. If you are a handful of people with no sensitive customer data and no contracts demanding security governance, your money is better spent elsewhere for now. That changes when you handle data that would hurt if it leaked, when SOC 2 lands on the roadmap, or when deals stall on security questionnaires.

Which frameworks do you work with?

Usually NIST CSF 2.0, plus ISO 27001 or CIS Controls when your customers or auditors ask for them. We also cover PIPEDA and Quebec’s Law 25.

Can you help with SOC 2?

Yes. SOC 2 readiness is one of the most common reasons companies bring in a vCISO. Our SOC 2 timeline guide explains how long it takes.