What is a vCISO? The virtual chief information security officer, defined

A virtual CISO (vCISO) is an outside security executive who performs the chief information security officer function for an organization on a contract or part-time basis, engaged as a third party rather than hired as a full-time employee. Organizations use the model when they need executive security direction but cannot justify or recruit a full-time CISO.

What regulators allow

New York's financial regulator wrote the arrangement into its rules. Under 23 NYCRR Part 500, a covered firm's CISO may be employed by a third-party service provider. If it is, the firm keeps responsibility for compliance, names a senior member of its own staff to direct and oversee the provider, and requires the provider to run a cybersecurity program that protects the firm to the regulation's standard.

The point for a board is that the contract moves the work, not the accountability. The outside CISO still owes the firm the annual written report to its senior governing body that Part 500 requires of every CISO.

How it shows up in SEC filings

Public companies describe outside CISOs in Item 1C of Form 10-K. The two filings below both use the word fractional. SpartanNash's annual report for fiscal 2024, filed on 26 February 2025, says its director of cybersecurity and architecture manages the program, assisted by a third-party fractional CISO the company retained in August 2024. IonQ's report for 2024, filed the same day, describes the reverse move: it had used an outside fractional CISO and, during the year, moved to an in-house security leadership team.

Regulation S-K Item 106 explains why such details appear. It asks whether a company engages assessors, consultants, auditors or other third parties in its cybersecurity risk processes, and which management positions are responsible for that risk.

What it is not

A vCISO is not an interim CISO, who covers a vacant seat until a permanent hire. A vCISO is not a field CISO, a vendor's advisor to its customers. And it is not a transfer of accountability: under Part 500 the firm stays responsible for compliance whoever employs its CISO.

Where it appears on CISO Tribune

• What is a vCISO?: when the model works and its failure modes.
• Item 1C disclosures: companies' own descriptions of who runs security, including outside arrangements.
• How to hire a CISO: the full-time search a vCISO engagement can precede or replace.

Related terms

• Chief information security officer (CISO)
• Regulation S-K Item 106