Los Angeles · Chicagoland · Phoenix
vCISO Services and Fractional CISO Consulting
Know your top security risks, have a written plan to fix them, and give your board, insurer and customers straight answers, without hiring a full-time CISO.
- Four defined packages, from a one-time risk assessment to a monthly fractional CISO
- Named deliverables: risk register, policy set, roadmap, board summary
- Fixed-fee or monthly, quoted after a free scoping call
Call the IT team: Los Angeles 323-510-8003 · Chicagoland 312-492-2613 · Phoenix 480-272-8728
Free consultation
No cost. Business inquiries only. Already a BTI client? Use the dedicated support number assigned to your organization.
- ✓Over 40 years in business
- ✓ISO 27001 compliant
- ✓24/7 NOC/SOC
- ✓ISNetworld member
- ✓GSA contract holder (47QTCA21D00BA) · CMAS and TESMA contract awardee (California)
What is a vCISO?
A vCISO (virtual chief information security officer), also called a fractional CISO, is a senior security leader who runs your cybersecurity program part time, under contract. The vCISO decides which risks matter most, writes them down with an owner and a plan, sets policy, prepares you for insurers, auditors and customer reviews, and reports progress to leadership.
A vCISO is not the person who fixes laptops or watches alerts. IT teams keep systems running; a vCISO is accountable for security risk and for the decisions leadership makes about it. Most organizations with 20 to 500 people need that judgment a few days a month, not 40 hours a week.
A good vCISO engagement produces documents you keep: a risk register, a written policy set, a roadmap with budget ranges, an incident response plan and a short summary your board can read in five minutes. Pair vCISO oversight with BTI managed patching and vulnerability management so the risks you prioritize actually get fixed.
When executives call us
BTI vCISO services are built for CEOs, CFOs, COOs, owners and IT directors of organizations with roughly 20 to 500 people. These are the situations that usually start the conversation.
- Cyber insurance renewal asks about MFA, backups, logging and incident response, and nobody is sure how to answer.
- A customer, lender or partner sent a security questionnaire that is holding up a deal.
- The board or owners asked, "How exposed are we?" and want an answer in business terms.
- An audit or regulator is coming: PCI DSS, the FTC Safeguards Rule or contract security terms.
- An incident or near miss such as a business email compromise attempt or ransomware scare.
- Growth, a new site, or M&A is changing what you have to protect.
- Your IT manager or outside provider is "the security person" by default, on top of a full workload.
- Staff are using AI tools with no written rule for what data can go into them.
Consulting engagement packages
Pick one package or combine them. Most clients start with the Security Risk Assessment, then move to the roadmap or a retainer. Every package has a written scope, named deliverables and a fixed timeline before work starts.
Security Risk Assessment
Best for: A first, honest picture of where you stand
A fixed-scope review of your systems, data, users, vendors, physical security and existing controls, scored by likelihood and business impact.
Deliverables
- Scored risk register (each risk with likelihood, impact, owner and due date)
- Findings report with evidence and screenshots
- Control gap summary against NIST CSF or CIS Controls
- Top 10 priority actions, sequenced
- Board-ready summary (2 pages) and a leadership readout
Typical timeline: 3 to 6 weeks
Delivered by: BTI vCISO with a BTI security engineer
Pricing: fixed-fee or monthly, quoted after a free scoping call.
Policy & Compliance Roadmap
Best for: Insurance, customer or regulatory pressure to "show your program"
A written security program and a step-by-step plan to meet the framework or requirements you answer to, mapped to NIST CSF or CIS Controls.
Deliverables
- Written information security program (WISP) and policy set: acceptable use, access control, data handling, AI use, vendor management, incident response and more
- Framework gap map (NIST CSF or CIS Controls)
- 12 to 24 month security roadmap with owners, sequence and budget ranges
- Risk acceptance log for decisions leadership makes not to fix something
Typical timeline: 4 to 8 weeks
Delivered by: BTI vCISO with a BTI compliance specialist
Pricing: fixed-fee or monthly, quoted after a free scoping call.
Fractional CISO Retainer
Best for: Ongoing security leadership without a full-time hire
A named BTI vCISO who owns your security program month to month and sits with leadership when security decisions are made.
Deliverables
- Risk register kept current
- Monthly security scorecard
- Quarterly leadership or board security review
- Policy upkeep and annual review
- Vendor security reviews and questionnaire answers
- Decision support on new tools, projects and incidents
Typical timeline: Ongoing, starts after an assessment or onboarding review
Delivered by: Named BTI vCISO, backed by BTI engineering and the 24/7 NOC/SOC
Cadence: Monthly working session, quarterly leadership review, annual program review
Pricing: fixed-fee or monthly, quoted after a free scoping call.
Incident, Audit & Cyber Insurance Support
Best for: A deadline you have to meet
Focused help when a specific event is driving the need: an insurance renewal, an audit, a customer review or the aftermath of an incident.
Deliverables
- Incident response plan with roles, call lists and decision points
- Tabletop exercise for leadership, with an after-action report
- Cyber insurance application answers and a gap closure plan before renewal
- Evidence package for audits and customer security questionnaires
- Post-incident review and lessons-learned report
Typical timeline: 2 to 6 weeks per event
Delivered by: BTI vCISO, with BTI incident responders when needed
Pricing: fixed-fee or monthly, quoted after a free scoping call.
Packages at a glance
| Package | Format | Typical timeline | Main deliverable |
|---|---|---|---|
| Security Risk Assessment | Fixed-fee project | 3 to 6 weeks | Scored risk register and board summary |
| Policy & Compliance Roadmap | Fixed-fee project | 4 to 8 weeks | Policy set and 12 to 24 month roadmap |
| Fractional CISO Retainer | Monthly retainer | Ongoing | Monthly scorecard and quarterly review |
| Incident, Audit & Cyber Insurance Support | Fixed-fee per event | 2 to 6 weeks | IR plan, tabletop report, insurer and audit evidence |
Not sure which package fits? The scoping call sorts that out in 30 minutes.
Free, no obligation. You get a written proposal with fixed scope and deliverables.
vCISO vs full-time CISO vs your IT provider
All three can work. The question is who is accountable for security risk, and whether that person has the time and authority to act.
| Question | BTI vCISO | Full-time CISO | IT provider or IT manager alone |
|---|---|---|---|
| Who owns security risk decisions? | A named vCISO, documented in a risk register | The CISO | Often nobody formally |
| Cost structure | Fixed-fee projects or a monthly retainer sized to your needs | Executive salary, benefits and recruiting | Bundled in IT support, rarely scoped for security leadership |
| Board and insurer reporting | Monthly scorecard and quarterly review | Yes | Usually ad hoc |
| Written policies and roadmap | Delivered as named documents | Yes, over time | Rarely |
| Continuity | Team backed, so coverage continues through absences | Stalls if the person leaves | Depends on the person |
| Best fit | 20 to 500 people with real security obligations | Large or heavily regulated organizations | Very small, low-risk environments |
What a good vCISO engagement includes
Whoever you hire, hold them to these basics. If a proposal is missing several of them, ask why.
- A written scope with named deliverables and dates, not open-ended hours.
- A risk register you own, scored by business impact, with an owner for every risk.
- A recognized framework (NIST CSF or CIS Controls) so progress is measurable and comparable year to year.
- Plain-language reporting for leadership, separate from the technical detail.
- Documented risk acceptance when leadership decides not to fix something.
- Independent testing of what has been fixed. BTI uses Cyber Watch, its penetration testing plan, delivered with an independent testing partner.
- A path to execution, whether by your team, your current provider or BTI.
Frameworks and terms in plain English
- NIST CSF
- The NIST Cybersecurity Framework: six functions (Govern, Identify, Protect, Detect, Respond, Recover) used to measure and improve a security program.
- CIS Controls
- A prioritized list of 18 security safeguards. A practical starting point for smaller organizations.
- Risk register
- A living list of security risks, each with a likelihood, a business impact, an owner and a plan.
- WISP
- Written information security program: the documented policies and procedures that describe how you protect data. Required under the FTC Safeguards Rule for covered financial businesses.
- Tabletop exercise
- A guided session where leaders walk through a realistic attack scenario to test the incident response plan.
- CMMC
- The Department of Defense cybersecurity requirement for contractors. CMMC and other compliance work is completed and contracted by BTI and its partners, including top industry professionals in each category.
- App security
- If your team builds internal apps with AI coding assistants, BTI helps bring them into Azure with company sign-in, secrets management, logging and backups. Every app security engagement includes BTI's vCISO service. See Vibe Coding Security: Bring AI Apps Into Azure.
How we deliver
Every engagement follows the same six steps, so you know what happens next and what lands on your desk at each one.
Free scoping call
30 to 45 minutes with a BTI vCISO about your goals, deadlines (renewal, audit, board meeting) and current setup.
You get: A straight recommendation on which package fits, or whether you need one at all.
Proposal with fixed scope
A written proposal listing deliverables, timeline, the roles assigned and a fixed fee or monthly retainer.
You get: A document you can take to your CFO or board before committing.
Kickoff and discovery
Leadership interviews, a document request list, and a technical review of identity, devices, email, backups, network and vendors, remote or on site.
You get: A kickoff agenda, a schedule and a single point of contact.
Findings readout to leadership
A 60 to 90 minute session that walks through the risk register and top priorities in business terms.
You get: The written report, risk register and board-ready summary.
Roadmap and implementation options
Priorities sequenced with budget ranges. You choose who does the work: your team, your current IT provider or BTI.
You get: A 12 to 24 month roadmap and a clear owner for each item.
Ongoing reviews
For retainer clients, monthly working sessions and quarterly leadership reviews keep the plan moving.
You get: A monthly scorecard, an updated risk register and a quarterly summary.
What you walk away with
- A ranked list of your real security risks, each with an owner and a due date
- Written policies your staff, insurers and auditors can read
- A roadmap leadership can fund in stages
- Clear answers for cyber insurance and customer questionnaires
- A tested incident response plan
- A board-ready summary you can reuse each quarter
Policy, risk register and evidence work continues through our GRC services.
Sample deliverable outline: Security Risk Assessment report
- Executive summary: overall risk rating and top five risks in business terms
- Scope, method and framework used (NIST CSF or CIS Controls)
- Environment overview: users, sites, systems, data and key vendors
- Scored risk register: risk, likelihood, impact, owner, due date
- Findings by area: identity and access, email, devices, backups and recovery, network, vendors, physical security, policies, people
- Control gap map against the chosen framework
- Prioritized actions: next 30 days, next 90 days, next 12 months, with budget ranges
- Risk acceptance items for leadership decision
- Appendix: evidence, screenshots and interview list
How to choose a vCISO provider
- Ask for a sample deliverable (redacted risk register or roadmap). If they cannot show one, expect a slide deck.
- Confirm who you will actually work with and how often, in writing.
- Check that recommendations map to a named framework, not a vendor product list.
- Ask how findings get fixed: advisory only, or can they also do the work if you want them to?
- Ask how they handle confidentiality of your findings and evidence.
- Make sure the proposal has a fixed scope and price before work starts.
Why BTI
- Over 40 years in business, with security, IT, network and physical security expertise under one roof.
- Leadership plus execution if you want it: a 24/7 NOC/SOC and BTI engineers can carry out the roadmap, and Cyber Watch testing runs with an independent testing partner.
- Governance you can check: BTI's own policies and controls are ISO 27001 compliant and independently reviewed through the Technology Assurance Group (TAG) ISO 27001 Compliance Program. Penetration testing and vulnerability tracking are independently reviewed by an independent testing partner. Monitoring runs through a 24/7 NOC/SOC.
- Local teams in Los Angeles, Chicagoland and Phoenix, with on-site work in Tucson through BTI's contractor partners. Most consulting work runs remotely, with on-site visits where they add value.
You do not need BTI managed IT to buy a vCISO package. If you want help carrying out the roadmap, BTI's cybersecurity team can quote that work separately.
Your cybersecurity roadmap
Six Steps From First Test to a Program You Can Prove
Most clients start at step 1 with the free assessment and pen test. The findings tell you which of the next steps deserve your budget first, so you are not buying tools on a hunch.
Assess
Know where you stand with a tested baseline.
Prevent
Close the common ways in.
Detect and respond
Someone watching, day and night.
Govern and prove
Policies, evidence and leadership reporting.
Recover
Get back to work after an incident.
Run it with your team
Pick the support model that fits.
See the full program on the BTI cybersecurity services page.
Frequently asked questions
How is vCISO pricing set?
BTI does not publish a vCISO price list. Assessments, roadmaps and event support are fixed-fee projects; the Fractional CISO Retainer is a monthly fee. Both are quoted after a free scoping call, based on your number of users and sites, the frameworks and requirements you answer to, the documentation you already have and the reporting cadence you want.
How long does a vCISO engagement take?
A Security Risk Assessment typically takes 3 to 6 weeks, a Policy and Compliance Roadmap 4 to 8 weeks, and event support such as an insurance renewal 2 to 6 weeks. The retainer is ongoing. The exact timeline is written into your proposal.
What do we need to provide?
A leadership sponsor, an hour or two from key people for interviews, admin or read-only access for the technical review, and copies of existing policies, insurance applications and vendor contracts. BTI sends a document request list at kickoff.
Do we have to use BTI for managed IT?
No. vCISO packages stand on their own. Many clients keep their internal IT team or current provider and use BTI only for security leadership.
Can a vCISO work with our internal IT team or current MSP?
Yes. The vCISO sets priorities and policy; your team or provider carries out the work they already own. BTI coordinates with them and tracks progress in the risk register.
Is the work remote or on site?
Most of it is remote. Kickoff, leadership readouts, tabletop exercises and physical walk-throughs can be on site in Los Angeles, Chicagoland and Phoenix.
How do you keep our findings confidential?
Engagements run under a confidentiality agreement, findings are shared only with the people you name, and evidence is stored in access-controlled systems. BTI's own controls are ISO 27001 compliant and independently reviewed through the TAG ISO 27001 Compliance Program.
What happens after the assessment or roadmap?
You own the documents. You can carry out the roadmap yourselves, hand it to your current provider, ask BTI to quote the work, or move to the Fractional CISO Retainer so someone keeps the program on track.
What is the difference between a vCISO and a fractional CISO?
In practice, nothing. Both describe an experienced security executive who works for you part time under contract instead of as a full-time employee.
Book a free vCISO scoping call
In 30 minutes you will know which package fits, what it delivers and how long it takes. Then you get a written proposal with a fixed scope.
Prefer to call? Reach the BTI IT team during business hours: Los Angeles / Southern California 323-510-8003 · Chicagoland 312-492-2613 · Phoenix 480-272-8728.
Already a BTI client? Use the dedicated support number assigned to your organization.