What Does a vCISO Own, and What Does Your MSP Own?

By Vin DiPippo, CTO, Vertikal6

Published October 15, 2026

A vCISO is accountable for the program that manages security risk: strategy, written policies, compliance, and risk reporting to leadership. Your MSP owns the daily work that carries that program out, such as monitoring, patching, endpoint protection, backup, and the help desk.

The simplest way to see the difference is through finance. Your MSP is to cybersecurity what your finance team is to your books, and a vCISO is to cybersecurity what internal audit is to finance.

Vertikal6 recommends putting that division in writing, with one named owner for every responsibility, because security gaps tend to sit between two teams that each assume the other has the task covered.

A cyber insurance renewal shows the split clearly. The underwriter asks whether multifactor authentication is enforced, and your MSP can confirm it in minutes. The same questionnaire asks for a written information security plan and signed security policies, and those belong to whoever owns security governance. When nobody holds that role, the renewal stalls while someone scrambles to write documents the insurer expected to exist already.

How is a vCISO different from your MSP’s security services?

Think of internal audit. A finance team is skilled and follows good process, and internal audit still works a thorough plan to dig into each area, identify gaps and risks, and address them. A managed services team and a vCISO work the same way.

The two functions work together. The daily team runs the operation under those policies, and the oversight function keeps the policies current as the business and the threats change.

What a vCISO owns

A vCISO owns the security program as a whole: the plan, the priorities, and the accountability for risk decisions. The National Institute of Standards and Technology gave this work its own place in version 2.0 of its Cybersecurity Framework. The new Govern function, according to NIST (2024), “encompasses how organizations make and carry out informed decisions on cybersecurity strategy.”

elevate™ ADVANTAGE is Vertikal6’s vCISO service that delivers ongoing, proactive governance, risk management, and alignment of security strategy with organizational objectives through a Virtual Chief Information Security Officer model.

In practice, the vCISO services cover risk assessment and mitigation, a written information security plan (WISP), the policies that regulators and cyber insurance underwriters want to see, and help asking the right questions of vendors, suppliers, and partners. They also include guidance on security budgeting and planning, employee security awareness, and a security leader who can answer questions on your behalf.

A vCISO engagement should feel like having a CISO you hired. At Vertikal6, the vCISO answers to the client’s leadership, the same way a CISO would. When the program calls for an investment beyond the monthly engagement, the vCISO presents it the way a CISO would: the business case, the threats it addresses, the risks it reduces (how likely a threat is to be exploited and the impact if it is), and the investment required, all within the client’s budget.

What your MSP owns

Your MSP owns the operation of your technology, and most day-to-day security controls run inside that operation.

elevate™ Foundations is Vertikal6’s managed IT service that provides 24/7 proactive monitoring, around-the-clock IT support, a service desk, and virtual CIO-level strategic guidance.

Security controls extend through the elevate™ optional support enhancements. Protect adds around-the-clock endpoint security powered by Managed Detection and Response (MDR). Verify manages multifactor authentication, Aware delivers ongoing security awareness training, and Recover provides automated backups with fast recovery.

Patching shows how the two roles fit together. According to Verizon’s 2026 Data Breach Investigations Report, 31 percent of all breaches start with vulnerability exploitation, and Verizon advises organizations to prepare for an influx of patches as AI finds software flaws faster. The MSP applies those patches and confirms they installed. The vCISO decides which exposures get fixed first, sets the deadline for each, and reports the result to leadership.

vCISO, MSP, and internal team responsibilities compared

The table assigns each security responsibility to its primary owner and shows the supporting role for the other two parties.

If you have an internal IT team, it may share the MSP column with your MSP, handling some operations while the MSP covers the rest. The vCISO column stays the same either way.

What does a vCISO engagement look like over time?

We dig in immediately. The first step is assessing where the client stands, from the highest-priority controls to the lowest. Each month the picture gets sharper: where the client is, where it needs to go, what it will take to get there, and what it will take to stay there.

The roadmap below gives the program its structure, and the program changes with the business. As the business grows, adds sites, takes on new partners, or faces new threats, the vCISO reviews the risks on the cadence the engagement allows and adjusts the program and the roadmap to match, while staying true to the CIS IG2 baseline. That ongoing review is a defining feature of a vCISO program.

• First 12 months: Vertikal6 aims to bring the client into conformity with Implementation Group 2 (IG2) of the CIS Controls, plus the PCI elements any business that processes credit cards needs. CIS describes IG1 as “essential cyber hygiene.” IG2 builds on it and is a reasonable level for most businesses, and IG3 includes every Control and Safeguard.
• Months 13 to 24: The policies, procedures, and technology take hold and become part of everyone’s day-to-day. We call this cybersecurity you can live with. This year also gives slower controls room to take hold, with progress reported throughout.
• Year three and beyond: The program hits its stride. Ongoing management reviews and updates policies, adds or improves technology, and keeps the client protected from emerging threats.

How do we know if we need a vCISO or if our MSP’s security package is enough?

You need a vCISO when your organization needs a clear owner for security decisions. That need can come from inside, when leadership wants confidence in its own security program, or from outside, when a regulator, an auditor, an insurer, a large customer, or your board asks for evidence. These six signals are the clearest:

1. You operate under a named compliance framework. Frameworks such as HIPAA, PCI-DSS, CMMC, and DFARS come with documentation and audit obligations, and regulatory compliance work starts with a clear owner for them.
2. Your cyber insurance application asks for written policies or a WISP. Writing the policies underwriters want to see is core vCISO work.
3. Customers send you security questionnaires. Verizon’s 2026 DBIR found that breaches involving a third party now account for 48 percent of all breaches, with third-party involvement up 60 percent. Every customer that vets its vendors treats you as its third party.
4. Your board or owners ask for a risk report. A risk report needs someone who can rank risks in business terms and stand behind the ranking.
5. Nobody can name the owner of your security plan. When the answer is “the MSP, probably,” the governance role is open.
6. Leadership wants confidence in its own security program. Owners and executives who want to know where the company’s real risks sit, and want a plan to reduce them, need someone accountable for that program.

When none of these apply, a well-run MSP security stack with MDR, multifactor authentication, training, and backup covers a smaller organization’s core needs. A vCISO also fits an organization that wants that confidence before any outside request arrives, with a program built around its own risks and goals.

How much does a vCISO cost compared with a full-time security leader?

Vertikal6’s vCISO program starts at $3,000 per month, the level at which we can dedicate enough hours to own a client’s cybersecurity program and its maturity. The program runs a minimum of 24 months, we recommend 36, and it carries a 90-day satisfaction guarantee. A useful benchmark is what a full-time hire would cost. According to the U.S. Bureau of Labor Statistics’ Occupational Employment and Wage Statistics (released May 2026, covering May 2025), computer and information systems managers earned a mean annual wage of $192,160, and information security analysts earned $132,510. Those figures cover wages alone, before benefits, recruiting costs, and the months a new leader spends learning your environment.

Four factors shape the monthly investment and the timeline:

1. Maturity. Clients with existing controls, especially in high-priority areas like multifactor authentication and remote access, typically fit the $3,000-per-month, 12-month baseline and may get there sooner. Clients of a reasonable size with no controls in place can fit it too, if they are willing to adopt new technology and take on the projects to implement it.
2. Scope. Requirements beyond CIS IG2 and PCI call for more vCISO time each month or a longer timeline. Examples include HIPAA, CMMC, a higher PCI level, many sites, secure enclaves, subsidiaries, or a large user base.
3. Time. A compliance deadline sooner than 12 months calls for more monthly vCISO time or supplemental projects.
4. Project budget. New technology carries its own cost, so it is scoped as separate projects. Projects also give clients a lever to keep the monthly cost down or the timeline short, whichever fits their business goals.

How should we compare vCISO providers?

Compare vCISO providers on five things: the risk assessment, compliance experience, board reporting, incident response support, and cost. Ask each provider for evidence on every one.

1. Risk assessment quality. Ask which framework the assessment uses and request a sample deliverable. A strong assessment ranks risks and ties each one to a fix, an owner, and a date.
2. Compliance expertise. Ask which frameworks the vCISO has carried clients through, and which audits or certifications followed.
3. Board reporting. Ask to see a sample board report. It should state current maturity, the top risks, and what the budget request buys, in language a director outside IT can act on.
4. Incident response support. Ask who writes the plan, who runs the exercises, and who joins the call when an incident starts.
5. Cost and accountability. Ask what the monthly fee covers, what sits outside it as separate projects, and how the vCISO will report to your leadership team.

Also ask how the vCISO works with your MSP. When one firm provides both roles, findings move straight into the service queue. When they come from separate firms, write the handoffs into both contracts.

Security budget, strategy, and board reporting

A vCISO connects budget, strategy, and board reporting by turning the risk assessment into a ranked list of security investments, each with a cost and the risk it reduces. That list becomes the security budget, and progress on it becomes the board report.

IBM’s Cost of a Data Breach Report 2026, conducted by the Ponemon Institute and released in July 2026, puts the global average cost of a breach at $4.99 million. A board can weigh a security budget request more clearly when it sits next to that figure.

Security priorities then feed the wider technology plan. A virtual CIO builds the three-year technology roadmap, and the vCISO makes sure that roadmap funds the controls the risk assessment called for.

A client example

One of our clients routinely needed sensitive information from its trading partners. When those partners asked about the client’s security posture, each request was handled individually. This took time and resulted in a patchwork of overlapping statements and documents tailored to specific requests.

We worked with the client to build a cohesive security program, using a risk register to identify risks and a coordinated set of policies and procedures to address them. Over time, the client could respond to partner requests using the program’s existing documentation. When a request called for an adjustment, the change was thoughtfully incorporated into the program for future use.

The result was a more consistent, efficient process that strengthened the client’s confidence in its own security program and helped build trust with its partners.

Where to start

Start with a baseline. Vertikal6 begins its vCISO engagements by assessing the client against CIS Controls IG2 with elements of PCI, which shows where your program stands today and which gaps to close first. From there, the responsibility table above becomes a working document, with a named owner for every row at your organization, at your MSP, and on the vCISO side.