vCISO
A senior security leader, without the full-time hire.
A vCISO runs your security program, answers the hard questions for you, and stays on as your business grows.
What it is
What a vCISO is.
It stands for virtual Chief Information Security Officer. A part-time security leader who owns your security, start to finish.
-
Senior
Years of security leadership, not a junior technician.
-
Part time
You get the leader without a full-time executive salary.
-
On your side
Working for you, with your team and your IT company.
Sound familiar?
Signs you need one.
Most businesses call us when one of these happens. Often it's several at once.
-
A customer
"Fill out our security questionnaire."
You gethonest answers, written once and kept current.
-
Your insurer
"Answer these security questions to renew."
You getanswers backed by a real program.
-
An audit
"Here are the findings."
You geteach finding owned and closed, not just filed.
-
Your board
"Are we secure?"
You geta short, plain report every quarter.
-
A contract
"You must meet CMMC, HIPAA or SOC 2."
You getthe work and the paperwork it requires.
-
Your team
"Who's actually in charge of security?"
You getone person who owns it.
What you get
The Heights vCISO Program.
Four things, all included.
-
Security checkup
A report card on where your security is strong and where it's weak.
-
AI assessment
Where AI can save your business time and money, and the rules to use it safely.
-
Security program
Written rules, a hack plan, staff training, and a folder of proof for customers and inspectors.
-
Your security leader
A senior expert on your side, month to month, who answers those questions for you.
How it works
We build it. Then we run it.
Part 1 has a set scope and a set end. Part 2 is month to month, and you can stop anytime.
-
We get started
One safe place to keep all your security files.
-
We check everything
A report card on your security, plus an AI report on where AI can save you time and money.
-
We give you a plan
What to fix first, which AI ideas are worth doing, and what each will cost.
-
We fix it
Security and AI rules, a hack plan and practice run, staff training, a folder of proof, and the paperwork your rules require.
-
You choose what's next
Everything we built is yours to keep.
-
We keep you safe
An expert you can call, reviews of new AI tools, monthly check-ins, and a yearly checkup.
vCISO or full-time hire?
Which one fits you.
-
A vCISO fits when
Security needs a leader, but not a full-time one.
-
A full-time CISO fits when
Security work fills a senior executive's whole week.
-
If you outgrow us
Everything we built is yours, ready to hand to your new hire.
Your IT company
We work with them, not against them.
Your IT team or IT company keeps your systems running. We decide what keeps the business safe and make sure it gets done.
-
Your IT team
Gets clear priorities and leadership backing for hard calls.
-
Your IT company
Gets clear expectations and someone who reviews the work.
Rules we help with
The security rules you have to meet.
CMMC, NIST 800-171, HIPAA, SOC 2, ISO 27001, PCI DSS, NIST Cybersecurity Framework, SOX and HITRUST.
Questions
More vCISO questions.
What does a vCISO do?
Leads your security. Sets the plan, owns the risks, writes the rules, oversees your providers, and reports to your leaders.
Does a vCISO replace our IT team?
No. Your IT team keeps running your systems. We give them clear priorities and back their hard calls.
Does a vCISO replace our IT provider?
No. They keep doing the work. We set what's expected and check what's delivered.
How involved is a vCISO?
As involved as you need. We agree a regular schedule up front, and we're available between meetings for anything urgent.
Can a vCISO communicate with executives and the board?
Yes. That's a core part of the job. Reports are short, plain and the same format every time.
Can a vCISO help with security questionnaires?
Yes. We build one honest set of answers you can reuse for every customer.
Can a vCISO help prepare for audits and assessments?
Yes. We get you ready and handle the findings. An independent auditor does the audit itself.
How does an engagement begin?
With a free, confidential call. If we're a fit, we agree on the scope in writing before any work starts.
What information do we need to get started?
Nothing prepared. Just tell us what prompted the call and what you have to meet.
Is this appropriate for an organization without a formal security program?
Yes. It's one of the most common places to start.
Let's talk.
Got a security form, a contract, an inspection, or questions about AI? Book a call. We'll tell you where you stand and what it takes to fix it.