Strategy & roadmap
Three-year security plan, investment prioritisation, linkage to business objectives — not "good practice" but decision.
Part-time senior security leadership · In place in 2 weeks, no onboarding
Book an intro call →
vCISO · Fractional CISO · Larissa
Senior security leadership, without hiring a CISO.
You don't need a full-time CISO five days a week. You need someone who speaks to the board, runs incident response, represents the organisation before supervisory authorities — and has real experience at those tables, not theoretical. From 2 to 8 days per month.
A vCISO (virtual Chief Information Security Officer) gives you senior security leadership part-time, 2 to 8 days a month, without hiring a full-time CISO. KodeX GRC covers board reporting, governance, incident command and representation before supervisory authorities, with a 6-month minimum term.
What it covers
Six areas of responsibility. Not a service catalogue — the six roles a vCISO takes on, depending on what you need each month.
Governance & committees
Formation of a security committee, roles, responsibilities, meeting cadence. The structure that keeps security alive beyond year one.
Board reporting
Quarterly report with KPIs, trends, risks and decisions required — in a language the board understands.
Incident command
Incident commander, team coordination, board updates, authority notification within deadlines (24h NIS2, 72h GDPR).
Supervisory authorities & compliance
Representation before the Hellenic DPA, National Cybersecurity Authority, DORA supervisory authorities. Questionnaire responses, audit participation.
Budget & vendors
Investment planning, tool evaluation, contract negotiation, build vs buy decisions.
Who it's for
For organisations that need security leadership but not a full-time role — or that have a technical lead without board-level experience.
The rule: if the next question at the board is "and who decides this?" — you're missing the role. A vCISO takes on decision responsibility, not advisory distance.
It isn't a consultant who delivers a project. It's a part-time member of the leadership team — joins committees, signs off reports, represents the organisation. It has an opinion that counts, and accountability it accepts.
Companies 50–500 employees without a CISO in structure, with real exposure
Before or after ISO 27001 certification — for continuity, not the project
In NIS2 or DORA where the board has personal liability under Article 20
In an incident needing a senior incident commander immediately
In an acquisition or investment requiring security due diligence from leadership
How we work
Three phases. There's no "project" — there's a relationship. Onboarding is fast, because we don't start from zero — we leverage what's already working.
Onboarding
In 2 weeks, not 2 months
Team introductions, document review, first state report. By end of week two, the board has a picture it didn't have before.
2 weeksOperations
Steady presence
Committee meetings, weekly sync with technical team, monthly board report. The vCISO becomes the reference point for every security matter.
OngoingReview
Quarterly
Strategy review, KPIs, tactics, budget. Renewal of commitment — or adjustment, if the organisation changed direction.
QuarterlyA month in the life of your vCISO
What a vCISO actually does across 4 weeks for a typical client at 4 days per month. Not a checklist — the real flow of work.
Week 01
Governance
1 day on-site- Security committeeTwo-hour session — backlog, decisions, new items
- Policy reviewTwo policies for approval, one for update
- KPI prepData for the quarterly board report
Week 02
Technical oversight
1 day on-site- Architecture reviewNew client infrastructure — review before build
- Tool evaluationSIEM — two candidates, build vs buy decision
- Technical team mentoringTwo-hour session — questions, career, real problems
Week 03
Incidents & board
1 day on-site- Tabletop exerciseRansomware scenario — testing the 24h escalation flow
- Board report draftTwo pages for next month's meeting
- Escalation reviewThree incidents from the last 60 days — what went wrong, what changes
Week 04
Compliance
1 day on-site- Regulatory updateWhat changed in NIS2 / DORA / GDPR this month
- Evidence reviewSample of evidence from 3 controls — sufficiency before audit
- Monthly reportTwo pages: what happened, what's pending, what decisions are needed
Engagement models
Three levels, depending on maturity and phase. All with a minimum term of 6 months — because the first weeks are onboarding, not value delivery.
Advisory
For organisations with a strong technical lead who need strategy and governance.
- Commitment
- 2 daysper month
- Strategy & roadmap
- Quarterly board report
- Ad-hoc advice (email, phone)
- Security committee
- Incident command
- Supervisory representation
Operational
For organisations needing governance, oversight and a reference point for every security matter.
- Commitment
- 4 daysper month
- All of Advisory
- Security committee (monthly)
- Technical project oversight
- Technical team mentoring
- Vendor negotiation
- Incident command (24/7)
Embedded
For organisations in active transition, under supervision, or in an incident requiring immediate senior involvement.
- Commitment
- 6–8 daysper month
- All of Operational
- Incident commander on-call
- Representation before supervisory authorities
- Weekly sync with CEO / CTO
- Due diligence for acquisitions
- Presence at critical board meetings
What you get
Six deliverables — not "reports" but management instruments. Each has a specific use in decision-making.
Security state reportFirst picture within 2 weeks — for board and technical team.
Three-year roadmapStrategy with milestones, resources, estimated cost — board-approved.
Quarterly board reportKPIs, trends, risks, decisions required — two pages.
Security committee charterCharter, members, meeting cadence, responsibilities, minutes.
Incident response planIncident commander, escalation flow, communications, tabletop exercise.
Supervisory representationQuestionnaire responses, audit participation, hearing representation.
Frequently asked
The questions we hear before taking on a vCISO engagement.
How many days per month do we need a vCISO?
It depends on maturity and phase. For an organisation with a strong technical lead needing strategy, 2 days is enough. For one in active transition, under supervision, or in an incident, 6–8 days. We usually start at level B (4 days) and adjust after the first quarter based on what's actually occupying attention.
What's the difference between a vCISO and a consultant?
A consultant delivers a project and leaves. A vCISO takes on responsibility — sits on committees, signs off on reports, represents the organisation before supervisory authorities, decides in an incident. Their opinion counts, and their decision binds until the board decides otherwise. That's the difference between "I advise" and "I lead".
Can the vCISO represent us before a supervisory authority?
Yes, on the organisation's mandate. We have experience with the Hellenic DPA, the National Cybersecurity Authority, and DORA supervisory authorities. This includes responding to questionnaires, participating in audits, and — if needed — representing in a hearing. In these cases the vCISO appears as the organisation's representative, not as an external consultant.
What happens if we need something urgent?
The base contract includes incident on-call depending on commitment level. Level B (Operational) includes business-hours on-call. Level C (Embedded) extends to 24/7. For out-of-scope work (due diligence, ad-hoc review, urgent supervisory communication) we agree pricing in advance.
How much does a vCISO cost?
It depends on commitment level and organisation size. As an indication, a level B engagement (4 days/month) costs roughly 15–20% of a full CISO compensation package — without recruitment cost, training, or long-term commitment. After the introductory call you get a specific proposal.
Related services
A vCISO usually comes after — or alongside — one of the following services. In every case, it provides the continuity the others don't.
01 · ISO 27001
Continuity after certification
The certificate is the beginning. A vCISO maintains it, evolves it, and defends it through annual surveillance audits.
03 · NIS 2Board liability under Article 20
Ongoing compliance isn't a project — it's a function. The vCISO is the person who takes on the responsibility.
04 · GDPRDPO or coordination
If you don't need a full-time DPO, the vCISO coordinates privacy — with a clear role definition and independence.
Get started
Intro call — 10 minutes, no commitment.
Not a sales call. A discussion about your organisation's state, which decisions are pending, which responsibility is uncovered. At the end you know whether a commitment makes sense — and at what level. If not, we'll tell you that too.
No commitment
Confidential
NDA before the call