What your virtual CISO does
A security program is more than tools. Someone has to decide what matters most, write it down, check that it’s working and explain it to the people who sign the contracts. That’s the job of a CISO — and for most small and mid-sized businesses, a fractional one is the right size.
- 01 · Program
Security program and roadmap
A written security program built on the NIST Cybersecurity Framework, with a prioritized roadmap and budget for the next 12 to 24 months.
NIST CSF - 02 · Policies
Policies people actually follow
Acceptable use, access control, passwords and MFA, remote work, incident response and vendor management — written for how your company works, not copied from a template.
Policy set - 03 · Risk
Risk register and reviews
Your top risks ranked by impact and likelihood, reviewed with you every quarter, with an owner and a due date for every fix.
Quarterly review - 04 · Compliance
Compliance mapped and evidenced
Controls mapped to the frameworks you answer to — CMMC and NIST 800-171, SOC 2 or PCI DSS — with the evidence kept on file.
Control map - 05 · Questionnaires
Customer and insurance questions
We answer security questionnaires from your customers and the security sections of your cyber insurance application, with proof behind every answer.
Evidence on file - 06 · Incidents
Incident response plan and drill
A short, practical plan with names, numbers and first steps, and a tabletop exercise with your leadership once a year.
Tabletop exercise - 07 · Vendors
Third-party risk
A review of the vendors and apps that hold your data or reach into your network, and what you should ask them for.
Vendor review - 08 · Report
A plain-English report for leadership
Where you stand, what changed, what’s next and what it costs — on one page, at every quarterly business review.
One-page report
Included in Managed Care, not billed by the hour
Every Managed Care plan includes vCIO and vCISO services, along with the security your vCISO reports on: SentinelOne MxDR and EDR, a 24×7 NOC & SOC, managed SIEM, vulnerability management, email security, DNS filtering, security awareness training and MFA. Your vCISO isn’t an outside consultant guessing at your environment — they work with the same engineers who support you every day. See what’s included on our pricing page.
Who needs a vCISO
You’re answering security questionnaires
Customers, especially larger ones, now send long security questionnaires before they sign or renew. We answer them accurately and fix what they uncover.
You’re working toward CMMC
Defense suppliers need a System Security Plan, a POA&M and someone to own them. See our CMMC compliance services and the free CMMC score estimator.
Your cyber insurance renewal is coming
Insurers ask detailed questions about MFA, backups, EDR and training. Try the cyber insurance readiness check before your broker sends the application.
Customers are asking for SOC 2
A vCISO keeps the program running between audits. See SOC 2 readiness.
Why CAL IT Group
- We hold SOC 2 Type II across all five Trust Services Criteria — we run our own security program to the standard we help you meet
- Highly technical leadership — co-founders Kevin Nichols and Joe Kemp, a CISSP — with 55+ years of combined IT experience
- A local team in Huntington Beach, with on-site support included in Managed Care
- One team for leadership and hands-on work: the people who write your plan are the people who carry it out