A Virtual Chief Information Security Officer (vCISO) is an outsourced security professional who provides strategic cybersecurity leadership, governance, and expertise to your organisation on a part-time or fractional basis, without the cost of a full-time executive hire.

How does a vCISO differ from a full-time CISO?

A vCISO provides the same strategic security leadership as a full-time CISO but at a fraction of the cost. You get access to senior expertise without the salary, benefits, and overhead of a permanent executive. The vCISO scales with your needs and can transition to a full-time hire when your organisation is ready.

Why price by organisation size?

A 10-person startup and a 1,000-person enterprise need the same kind of security leadership, but not the same amount. Pricing by size gives smaller organisations the full service at a price that suits them, and larger organisations pay for the extra scope.

What is the minimum term?

Month-to-month is available with no commitment. The 12-month plan gives a 20% discount.

What if our headcount changes?

We review your tier at each renewal. If you grow significantly during the term, we'll talk to you about the change before adjusting anything.

Is the internal audit really independent?

Yes. Your internal audit is done by a CyberNinja auditor who had no part in implementing your program. This supports the objectivity requirements in standards such as ISO 27001 and ISO 42001.

Does this guarantee we'll pass our audit or get certified?

No provider can guarantee that. Certification and attestation decisions are made by independent auditors and certification bodies. We prepare you thoroughly and support you through the process.

Can we add a framework later?

Yes. You can add frameworks at any time, and the add-on price is based on your tier.

What industries do you serve?

We serve a wide range of industries including technology, SaaS, fintech, healthcare, government, education, and professional services. Our consultants have deep experience across these sectors and understand the unique compliance and security challenges each faces.

Virtual CISO (vCISO) Service

Expert cybersecurity leadership without the overhead of a full-time CISO or a Head of Security. Get strategic security guidance tailored to your organisation's needs and budget.

What is a vCISO?

A vCISO (Virtual Chief Information Security Officer) provides expert cybersecurity leadership and strategic guidance to organisations on a flexible, part-time or contract basis, without the cost of a full-time CISO. CyberNinja's vCISO service covers frameworks such as ISO 27001, SOC 2, IRAP and Essential 8, with plans that scale as your organisation grows.

Two consultants reviewing a security roadmap together on a tablet

See pricing

How It Works

How an Engagement Works

A structured cadence from day one, so security leadership never slips off the agenda.

Onboarding & Baseline

We start with a structured discovery of your environment, existing controls, and business goals. You get a clear baseline assessment and a prioritised 12-month security roadmap.

Monthly Cadence

Regular security review meetings keep momentum: progress against the roadmap, emerging risks, vendor reviews, and policy suite upkeep, all tracked in the GRC platform.

Executive & Board Reporting

Plain-language reporting for executives and the board, translating security posture into business risk so leadership can make informed decisions.

Audit & Certification Support

When audit time comes, we prepare evidence, coordinate with auditors, and stand alongside you through ISO 27001, SOC 2, IRAP, and other assessments.

Client Results

Proven Outcomes for ANZ Businesses

Client details anonymised for confidentiality. Results from recent engagements across Australia and New Zealand.

Fintech

The Challenge

Enterprise customers were demanding ISO 27001 certification before signing, but the team had no in-house security leadership and a growing pile of ad-hoc policies.

What We Did

Ran a full gap analysis against ISO 27001:2022, built a prioritised remediation roadmap, and provided hands-on vCISO support through implementation and the certification audit.

40-person fintech · Sydney, NSW

Outcome

ISO 27001 certified in 5 months, unblocking two enterprise deals

SaaS

The Challenge

A US expansion hinged on SOC 2 Type II, with existing controls spread across spreadsheets and no consistent evidence collection.

What We Did

Consolidated controls into a managed GRC platform, mapped them to the SOC 2 Trust Services Criteria, and ran quarterly readiness reviews alongside the external auditor.

120-person SaaS company · Melbourne, VIC

Outcome

Passed SOC 2 Type II audit with zero exceptions

Healthcare

The Challenge

Handling sensitive patient data with no formal incident response plan and minimal visibility of Essential 8 maturity.

What We Did

Delivered a cybersecurity gap analysis, uplifted Essential 8 controls, and built a tailored incident response playbook with staff awareness training.

25-person allied health provider · Brisbane, QLD

Outcome

Essential 8 maturity lifted from level 0 to level 2 in 4 months

E-commerce

The Challenge

Rapid growth had outpaced governance. The board had no security reporting and vendors were onboarded without any security review.

What We Did

Embedded a vCISO on a monthly retainer covering board-level reporting, a vendor security assessment program, and a rolling 12-month security roadmap.

80-person online retailer · Sydney, NSW

Outcome

100% of critical vendors security-reviewed within 6 months

Plans & Pricing

One Plan, Scaled to You

Every plan is the full vCISO service with one compliance framework included. Slide to your organisation size and framework count and the price adjusts.

Every plan includes the full vCISO service and one compliance framework.

Organisation size11–25 staff

Frameworks1 framework (included)

Your choice of ISO 27001, ISO 42001, SOC 2, Essential 8, IRAP, PCI DSS, HIPAA or NIST CSF. Mix and match any of them, and add more later at your tier's add-on rate.

11–25 staff · 1 framework

$2,950/month

month-to-month, no commitment, excl. GST

Base plan (1 framework included)$2,950

Discuss this plan

All prices in AUD, excluding GST. Month-to-month is available with no commitment; 12-month plans receive a 20% discount and include complimentary dark-web monitoring for your organisation's exposed credentials and data.

If a retained arrangement is more than you need right now, compare it against our other GRC consulting services.

What's Included

The Full vCISO Service

The service is the same at every size. We adjust how often we meet and how deep we go to suit your organisation.

Governance & Strategy

A named vCISO, with direct access to our senior consultants
Security roadmap and strategy, reviewed every year
Security policy suite, tailored to your organisation
Executive and board-level security reporting
Enterprise risk management program, with a risk register and treatment plans

Compliance (1 framework included)

Full implementation support for your chosen framework
Readiness assessment and gap analysis
Annual independent internal audit
Management review support
Preparation and support during your certification or attestation audit
Ongoing compliance maintenance and surveillance audit support

Platform & Tooling

GRC platform with risk, vendor and compliance management
Compliance dashboard and reporting
Dark-web monitoring on annual plans

Operational Security

Incident response plan and playbooks
Annual tabletop exercise, with an after-action report and improvement actions
Priority incident response guidance
Vendor security assessment program
Security awareness training program
Threat monitoring guidance and advisory updates

Support

Email, Slack and phone support during business hours

What's Not Included

So there are no surprises, the following sit outside the vCISO service:

Fees charged by external auditors, certification bodies or IRAP assessors
Hands-on incident response, digital forensics or breach recovery
24/7 security monitoring, SOC or MDR services
Penetration testing
Implementing technical controls (such as configuring systems or deploying tools)

We work with trusted partners for any of these.

Scales With You

Same Service, Right-Sized Cadence

The service is the same at every size. The cadence and depth grow with your organisation.

	1–25 staff	26–100 staff	101–500 staff	501–1,000 staff
Security review meetings	Monthly	Fortnightly	Weekly	Weekly
Executive / board reporting	Quarterly	Quarterly	Quarterly + ad hoc	Monthly executive + quarterly board
Support response target	1 business day	1 business day	4 business hours	4 business hours
Tabletop exercise	Executive scenario (2 hours)	Executive scenario (half day)	Executive and technical scenarios	Executive and technical, multiple teams
Internal audit	Scaled to your size and scope	Scaled to your size and scope	Scaled to your size and scope	Scaled to your size and scope
Compliance dashboard	Standard	Standard	Customised	Customised

FAQ

Frequently Asked Questions

Prefer to read up first? Browse our Knowledge Base for compliance guides and articles.