dotSec provides vCISO services: The work of a chief information security officer, done part-time under contract rather than by a full-time employee. It suits organisations that need someone to run their security program but do not have enough of that work for a full-time role, or are between hires. In general, vCISO work takes one of two forms: Getting you ready for an assessment or certification, and running your security program as part of an ongoing maturity improvement or compliance program.
years providing security services in Australia and overseas
CREST ANZ approved company
Our client relationships commonly run ten to twenty years, and the longest has run for more than twenty.
Separation of duties is our standard baseline: We do not review a system that we built.
We can help you identify and prioritise the work that needs to be done in preparation for an upcoming assessment or certification deadline. We’re highly experienced in managing ISO 27001 certification, a PCI DSS assessment and IRAP assessment projects, and our work covers:
Readiness work can run under the vCISO arrangement. However, for longer running jobs we recommend a separate fixed-price agreement, so you know the cost before the work starts. Up to you however, just let us know what you prefer.
For IRAP, see IRAP assessment readiness and remediation. Note that if we’re helping with preparation or readiness for ISO 27001 and IRAP, the certification audit or the assessment will need to be carried out by a separate party, as set out under Independence below.
Between assessments, the same arrangement covers the rest of the CISO role:
We quote and agree pricing on the terms you need: A fixed number of hours a week or a month at an agreed rate, a draw-down account for ad-hoc work, or ad-hoc work invoiced fortnightly.
Most agreements run for a year and renew. Some run for two or three years. Others are tied to a program of work rather than a term, such as an IRAP readiness program, and include ad-hoc advisory work alongside it. For example, some of our fixed-price/project contracted clients also have a draw-down facility for ad-hoc work alongside their agreement.
We recommend commissioning long-running, goal-oriented jobs as a separate fixed-price project, so you know the cost before it starts with a defined scope. Examples of this kind of work include a maturity assessment or a gap analysis, or compliance certification projects. Of course, if you prefer we can run these kinds of projects as capped time and materials, where we do not exceed the agreed hours without your written approval.
These are just examples however. Remember, it’s up to you.
Penetration testing, incident response, managed SOC and compliance assessment are not part of the vCISO arrangement. We arrange them separately, at a fixed price, so their cost is known before they start.
Here are just a few examples of our past vCISO work, with readiness work listed first:
dotSec provides expert risk identification, prioritisation and treatment, and our advice is always given in your best interests. Importantly however, we do not own your business, so we cannot make strategic or budgetary decisions on your behalf.
Separation of duties is our standard baseline: We do not review a system that we built:
PCI DSS. We do not assess a cardholder data environment that we built.
IRAP. If we act as your vCISO on a system, we cannot also be its IRAP assessor. ASD’s IRAP Consumer Guide states that an assessor cannot have contributed to the design and implementation of a system they assess, including by drafting its documentation, conducting an initial gap assessment or providing design recommendations. When we prepare a system, another ASD-endorsed assessor assesses it.
ISO 27001. We provide ISO 27001 implementation consulting. We run audits only on an ISMS we did not help implement. If we provide implementation services, we do not perform ISO 27001 certification audits since certification must be done by a certification body that has not provided implementation services to you.
A vCISO, or virtual CISO, does the work of a chief information security officer part-time, under contract. A full-time CISO is an employee who leads security inside your organisation every day. The work is the same but the main difference is in the hours and the contractual arrangements.
A full-time hire makes sense when there is enough security work, risk and regulatory obligation to fill the role. Below that point, or while you are recruiting a full-time specialist, our vCISO services will cover the same responsibilities within the hours you need.
We do not publish a monthly price, not because it’s a commercial secret but because the cost will be based on the number of hours you need per week or month, and that will depend on how much of your program already exists, which frameworks and obligations apply, and how much ad-hoc work comes up. A figure quoted before we know those would be just a guess at best, and misleading at worst.
By way of example however, draw-down use across our clients has run from zero to about 12 hours a month. Above about 12 hours a month there is usually significant work to do, and a fixed-price project with defined goals gives better value for the client than can be achieved with ad-hoc hours.
We scope against your environment and obligations, then quote. If you need a figure for budgeting before that, ask us and we will give you an indicative range, with the assumptions it depends on stated.
Our client relationships frequently run ten to twenty years, and the longest has run for more than twenty. We have operated since 2000. Each of the following can be checked on a public register or document:
Virtual chief information security officer. A vCISO does the work of a CISO part-time, under contract, rather than as an employee.
The same work as a full-time CISO: Preparing for assessments and certifications, identifying and treating security risk, implementing a controls framework, running compliance programs, planning for and responding to incidents, and reporting to the board and executives.
Yes. We do gap analysis, implementation support, the Statement of Applicability and management reviews. We run internal audits only on an ISMS we did not help implement. We do not perform the certification audit.
Yes. Our IRAP page sets out what the work involves. A separate ASD-endorsed assessor assesses the system.
It depends on how much of your security program already exists, which obligations apply, and how much ad-hoc work comes up. Across our clients, draw-down use has run from none to about 12 hours a month. We do not publish a price. If you need one for budgeting, ask us and we will give you an indicative range with its assumptions stated.
A CISO is an employee. A vCISO does the same work part-time under contract. A vCISO from a firm can also bring in the firm’s other people, such as testers and incident responders, as separate fixed-price work.
Yes. “vCISO”, “virtual CISO”, “CISO as a service” and “fractional CISO” are used for the same arrangement.
Most run for a year and renew. Some run for two or three years. Some are tied to a program of work, such as an IRAP readiness program, rather than a term.
Yes. We recommend running work with a defined scope as a separate project at a fixed price. We can also run it as capped time and materials.
Not on the same system. ASD’s rules disqualify an assessor who has contributed to a system’s design or implementation. Another ASD-endorsed assessor can assess a system we helped prepare.
No. Separation of duties is our standard baseline. That applies to IRAP assessments, to PCI DSS assessments of a cardholder data environment, and to ISO 27001 internal audits. We do not perform ISO 27001 certification audits at all.
No. We provide implementation consulting, and internal audits of an ISMS we did not help implement. Certification comes from a certification body that has not consulted to you.
You do. We identify, prioritise and treat risk, and our advice is always given in your best interests, but we do not own your business.
Talk to our team about your environment, and about the assessments and certifications you have coming.
