Virtual CISO services led by Temi, from $3,000 per month.
A customer needs assurance before signing. An audit deadline is approaching. Your team has security work to do, but no one owns the full program. We give you a named, senior security and compliance leader to establish the priorities, coordinate the work and keep leadership informed.
In the first four weeks, we review your current position, build the risk register and agree a 13-week priority plan. We then maintain the policies, control ownership, audit calendar, vendor oversight and reporting included in your engagement. The monthly commitment and fee are agreed before work begins.
01
A Virtual CISO provides continuing security leadership through a scoped engagement. Your company gains an owner for the security roadmap, risk reviews, control responsibilities and management reporting without first creating a permanent executive role.
The work continues between audits: following up on remediation, checking evidence, handling customer assurance requests and bringing decisions to the right people. Your leadership team retains authority over budgets, risk acceptance and business commitments. Your IT and engineering teams remain responsible for the systems they operate.
Every Virtual CISO engagement is led by Temi, with over two decades of experience across technology, financial services, healthcare and media, including consulting engagements with several Fortune 100 companies, including Amazon, Walgreens and Humana. Temi has led over 100 assessments.
02
Compare capacity, authority and delivery responsibilities alongside cost. A fractional engagement and a full-time executive position serve different workloads.
| Decision | Cyvelle Virtual CISO | Full-time CISO |
|---|---|---|
| Monthly cost | Starting at $3,000/month. | Approximately $20,833–$33,333+ per month in salary. |
| Time to start | Within days. | 3–6 months to hire. |
| Experience breadth | Over 2 decades across technology, financial services, healthcare and media; over 100 assessments led by Temi. | Experience reflects the executive’s career and industries served. |
| Team access | Temi leads your program and coordinates the technical expertise you need. | Access to the internal team and specialists your company provides. |
| Scalability | Move between Foundation, Program and Leadership as your security needs grow. | Expand the role, team and budget as your needs grow. |
| Additional costs | A service fee without employee benefits, bonuses or equity compensation. | Salary plus applicable benefits, bonuses and equity compensation. |
| Compliance expertise | Cross-framework audit and governance experience across SOC, ISO, PCI DSS, HITRUST, HIPAA, NIST and privacy. | Framework expertise depends on the executive selected. |
| Vendor independence | Vendor-independent recommendations, with no vendor commissions. | Recommendations reflect the executive’s experience and your company’s procurement policies. |
| Cancellation | No lock-in or annual commitment. Cancel with 30 days’ notice. First-month opt-out with all deliverables retained. | Notice and exit arrangements follow the employment agreement. |
| Delivery | Security gaps identified within 4 weeks; audit readiness within 13 weeks. | Delivery starts after hiring. |
Virtual, fractional, part-time and outsourced CISO commonly describe a security leadership engagement outside a permanent employment role. The useful questions are practical: who leads, how much time is available, what work is included and who can act when an issue escalates? Your proposal names Temi and defines those responsibilities. On-site work, travel, response expectations and any additional specialist support are agreed explicitly.
03
Build a prioritized roadmap around business exposure, customer requirements and available resources. Keep policy reviews, control owners and decision records current so work continues after an audit or assessment finishes.
Maintain a risk register with owners, treatment choices and review dates. Track remediation dependencies, escalate blocked actions and review closure evidence. Document accepted risks with the person authorized to accept them.
Coordinate applicable requirements through a shared control and evidence map. Retain each framework’s distinct scope, assessment and reporting requirements. At the relevant tier, manage auditor liaison, evidence review and follow-up actions across the audit calendar.
We provide ongoing compliance leadership within the Virtual CISO engagement. We maintain a requirements calendar for the frameworks and customer obligations in scope, assign control-owner accountability with your team, and track evidence reviews and outstanding actions. Remediation governance connects each finding to an owner, target date, dependency and closure evidence, with decisions escalated to the appropriate business leader.
Assessment coordination and executive reporting follow your tier: Foundation provides oversight for one framework or customer program and audit guidance; Program adds multi-framework coordination, policy lifecycle management and auditor liaison; Leadership extends program ownership across entities and adds board reporting. The written scope sets capacity, responsibilities and cadence. At transition, the agreed handoff covers the requirements calendar, control owners, evidence index, open remediation actions and decision records.
Framework-specific readiness projects remain separate, defined engagements. Ongoing compliance leadership does not establish a statutory Chief Compliance Officer appointment, legal authority or unlimited capacity. Any statutory appointment requires a separate review and agreement.
Help answer customer security questionnaires using current, approved evidence. At the Program and Leadership tiers, oversee supplier risk reviews, including vendor assurance reports, material findings and follow-up ownership. Keep commitments made to customers connected to the work your team can actually deliver.
Program includes security awareness guidance and incident response planning. Leadership adds tabletop exercises. Define escalation contacts, management decisions, technical responders and communication owners before an incident. Training delivery, phishing campaigns and emergency response coverage require their own confirmed scope.
Every tier includes monthly leadership reporting. Leadership adds a quarterly board pack and board session, security budget planning, regulatory exam support and fundraising or M&A due diligence. Reports show changing risk, overdue work, evidence gaps and the decisions needed to move forward.
04
Security leadership gives findings an owner and a path to resolution. Implementation still needs qualified people with the right access and time. Agree those responsibilities at kickoff and revisit them as the program changes.
| Workstream | What the program coordinates | Delivery owner to confirm |
|---|---|---|
| Cloud and corporate systems | Requirements, review priorities and remediation decisions for identity, email, endpoints and cloud services. | Configuration review, hardening, monitoring and technical validation. |
| SaaS products and releases | Data flows, tenant boundaries, access requirements, change reviews and customer evidence. | Application and API testing, isolation validation, pipeline tooling and production changes. |
| Vulnerabilities and resilience | Treatment priorities, deadlines, recovery objectives and follow-up evidence. | Scanning, penetration testing, patching, retesting and recovery engineering. |
| Incident handling | Response plan, escalation roles, decision record and exercise follow-up. | Live containment, forensics, investigation and recovery coverage. |
| Independent assurance | Readiness coordination, evidence and findings. | Independent examination, certification and specialist assurance. |
05
SaaS businesses fielding enterprise security reviews while engineers are shipping the product.
Healthcare organizations and business associates coordinating HIPAA obligations and customer or HITRUST requirements.
Payments and financial services businesses managing overlapping partner, audit and regulatory expectations.
Startups preparing for investor due diligence and needing a clear answer about security ownership.
Professional services businesses handling sensitive client information and recurring assurance requests.
Growing companies that have completed readiness work and need someone to maintain the program.
Organizations asked by a customer, auditor or insurer to identify a senior security leader.
For government contracting, industrial environments or jurisdiction-specific duties, bring the actual requirement to scoping. NIST 800-53 experience does not establish CMMC delivery, and governance support does not by itself include specialist OT or ICS testing.
06
Direct senior leadership: Temi leads the engagement and the agreed program responsibilities are documented.
Experience on both sides of an assessment: practical understanding of building controls and evaluating their evidence.
A four-week starting point: a current-state review, risk register and a 13-week priority plan.
Connected framework work: reusable evidence where appropriate, with distinct requirements preserved.
Business-language reporting: the risks, owners and decisions your leadership team needs to see.
A clear commercial scope: fixed monthly pricing agreed before work starts, with changes documented.
At the Leadership tier, connect proposed spending to the risks it addresses, the owner and the decision date. Review existing tools, their use and renewal dates before proposing another purchase. Record the rationale for recommendations and any relevant commercial relationship. Where hiring support is needed, agree the role-design or transition work separately; hiring decisions remain with your company.
07
Our scope covers SOC 1 and SOC 2, ISO 27001, ISO 42001, PCI DSS, HITRUST, HIPAA, NIST 800-53 and NIST CSF, plus GDPR and CCPA work as agreed. We identify the requirements that actually apply to your organization before setting the plan.
SOC examinations, ISO certification, regulatory obligations and framework alignment have different outputs. A shared control may support several requirements, but it does not automatically satisfy all of them. Independent assessors and certification bodies make their own assurance decisions; legal applicability and statutory duties require appropriate legal or specialist review.
A named program leader is not automatically a statutory officer. If you need a privacy officer or similar role, we first review the jurisdiction, duties, authority, competence, conflicts and terms. That appointment must be separately confirmed before it is offered.
08
A baseline and prioritized risk roadmap showing what needs attention and why.
An oversight plan with named control owners, policy reviews and an evidence calendar.
A decision log recording risk acceptance, exceptions and agreed scope changes.
Monthly leadership reporting with progress, outstanding actions and decisions required.
The audit, vendor and customer assurance records included in your tier.
At Leadership, a quarterly board pack with prior-period comparisons and a board discussion.
Keep these records in an agreed company-accessible location, with company owners. The engagement agreement defines any transition assistance and handover if the arrangement changes or ends.
09
Choose a tier around the work and capacity required. Company sizes below are a guide; complexity, frameworks and operating needs determine the final scope. Fixed monthly pricing is agreed before work starts.
| Foundation | Most Popular Program |
Leadership |
|---|---|---|
| From $3,000/month | From $5,000/month | From $9,000/month |
| Initial priorities and roadmap; oversight for one framework or customer program; core policies; questionnaire support; audit guidance; monthly reporting; decision log | All deliverables in Foundation, plus: multi-framework program; full policy lifecycle; audit management and auditor liaison; vendor risk oversight; incident planning; awareness guidance; risk-register reporting | All deliverables in Program, plus: multi-entity program; quarterly board pack and session; budget planning; regulatory exam support; M&A and investor due diligence; tabletop exercises; ownership across business units |
| 20–75 people; a first program | 75–250 people; multiple frameworks | 250–500 people; regulated or multi-entity operations |
| Monthly leadership call; email and chat access | Bi-weekly calls; monthly leadership review | Weekly calls; monthly leadership review; quarterly board session |
| Fixed monthly pricing, with no lock-in or annual commitment. Cancel with 30 days’ notice. A first-month opt-out lets you keep all deliverables. | Fixed monthly pricing, with no lock-in or annual commitment. Cancel with 30 days’ notice. A first-month opt-out lets you keep all deliverables. | Fixed monthly pricing, with no lock-in or annual commitment. Cancel with 30 days’ notice. A first-month opt-out lets you keep all deliverables. |
| Discuss Virtual CISO Support → | Discuss Virtual CISO Support → | Discuss Virtual CISO Support → |
Fixed monthly pricing, with no lock-in or annual commitment. Cancel with 30 days’ notice. A first-month opt-out lets you keep all deliverables. The proposal confirms monthly capacity, included work, response expectations, exclusions and how additional work is approved. Third-party services and any separate readiness assessment are scoped independently.
The Governance Blueprint can establish your governance gaps and roadmap before ongoing leadership begins. A focused readiness or questionnaire engagement may be the better starting point when you have one immediate requirement. Each has its own deliverables, timeline and fee. A defined readiness report includes 30 days of follow-up access for clarification and complimentary refinements to the agreed deliverables; this does not establish a retainer cancellation or trial period.
10
Share your company context, required frameworks, customer requests and deadlines. We confirm availability, the right tier, monthly capacity and responsibilities. Your scope identifies who approves budgets, accepts risks, implements changes and provides independent assurance.
Review current controls, policies, obligations and available evidence with the people responsible for them. Build the risk register, identify urgent dependencies and agree a 13-week priority plan. Establish the reporting cadence and practical access needed to run the program.
Put the agreed policies, control ownership and evidence calendar into operation. Coordinate remediation with delivery teams, track blockers and review evidence supporting closure. Prepare for the audit and customer milestones identified in your plan. The work sequence follows your risk and readiness needs.
Run the agreed reviews and reporting while responding to audits, vendors, customer questionnaires and business changes. Keep policies and evidence current, revisit material risks and bring unresolved decisions to leadership.
Refresh the roadmap and agree changes to scope or tier in writing. At Leadership, use the quarterly board pack and session to compare progress, explain deferred risks and decide the next investments. The four-week baseline and 13-week priority plan are planning milestones; audit readiness depends on starting conditions, remediation and the applicable assessment requirements.
11
At a global payment platform, Temi joined as the first dedicated compliance hire reporting to the CISO. Temi built the function, hired and led a four-person team, managed the budget and brought multiple frameworks into one operating program.
The work included policy lifecycle management, vulnerability management, compliance dashboards, acquired-platform integration and maintaining controls through a migration to AWS. It combined PCI DSS, HITRUST, SOX, HIPAA, NIST 800-53 and ISO 27001 responsibilities.
The program achieved its first HITRUST certification and supported clean PCI Reports and Attestations of Compliance for three consecutive years. Temi later led regulatory compliance and executive governance work at a global media and entertainment company, taking a high-severity audit to closure. These examples describe Temi’s professional experience; the scope and timeline for your engagement are agreed separately.
12
Engagements start from $3,000 per month. The tier table shows the options; your proposal confirms the actual scope, capacity and monthly fee.
We confirm kickoff after reviewing availability and scope. The first four weeks establish your baseline and a 13-week priority plan. An audit-readiness date depends on the framework, existing controls, evidence and remediation required. Where a readiness assessment is needed first, it is a separate engagement.
A defined project has an agreed output and endpoint. The Virtual CISO engagement provides continuing program leadership, recurring reviews and follow-through within the monthly scope.
Yes. We coordinate security priorities and responsibilities with the team you already have. Engineering and IT retain their delivery responsibilities; specialist implementation and testing need confirmed owners.
The tier table describes meeting and reporting frequency. The agreement also sets monthly capacity, working hours, time zones, response expectations and escalation contacts. Email and chat access do not imply unlimited or continuous availability.
Yes. Share the questions, evidence request and deadline during scoping. We identify answer owners and current evidence, then agree the support needed. Answers must distinguish operating controls from planned work; the customer makes its own approval decision.
Every tier includes monthly leadership reporting. Leadership includes a quarterly board pack and session, plus investor and M&A due diligence support. Financial, transaction and investment decisions remain with the relevant parties.
Program includes incident response planning; Leadership adds tabletop exercises. Technical responders are identified in the plan. Live containment, forensics, recovery and emergency coverage must be separately agreed with the responsible providers.
Yes, where included in scope. We coordinate common controls and evidence while retaining framework-specific obligations. A shared evidence map is not an assurance opinion or automatic compliance determination.
Recommendations should identify the requirement, options, rationale and any relevant commercial relationship. We agree specialist delivery and independent assurance responsibilities so conflicts can be identified and addressed.
Fixed monthly pricing, with no lock-in or annual commitment. Cancel with 30 days’ notice. A first-month opt-out lets you keep all deliverables. The agreement records scope changes and transition assistance.
Yes. A separately scoped Governance Blueprint, readiness or questionnaire engagement can address a defined starting need. Ongoing program management is agreed through the Virtual CISO service.
13
Bring your next audit deadline, customer requirement or leadership question. In a 30-minute scoping call, we discuss your starting point and the work that needs an owner, then confirm the appropriate next step and written scope.