How MSPs and MSSPs offer vCISO services with skilled CISOs in short supply

August 7, 2024

A new eBook by Cynomi, “What does it take to be a full-fledged Virtual CISO?” lays out exactly how service providers can easily, rapidly, and economically expand their vCISO service offerings to cover the entire range of duties.

The Chief Information Security Officer (CISO) position has risen to prominence in recent years due to the risk posed by rampant ransomware and other forms of cyberattack. It is the CISO that coordinates security technology procurement.

The CISO sets the cybersecurity tactics, strategies, policies and processes that protect the organization now and into the future – in alignment with business objectives.

Top CISOs live and breathe risk management. They provide the necessary prevention, detection and mitigation measures against cyberattacks, oversee cyber governance and compliance, report to top management and anything else that keeps the organization secure.

They can be likened to the captain of the cybersecurity ship. It is up to them to navigate the best course across the stormy waters of modern IT environments.

To be able to do the job, they need extensive skill and experience in management, IT and cybersecurity. They must have a solid knowledge of all standards and cybersecurity frameworks such as the National Institute of Standards and Technology (NIST) and ISO, as well as a firm grip on regulations such as HIPAA and GDPR.

Many have advanced degrees in IT and cybersecurity as well as certifications such as the Certified Information Systems Security Professional (CISSP), Certified in Risk and Information Systems Control (CRISC), or Certified Information Security Manager (CISM). To operate successfully at a C-level and under – and stand the interplay between IT and business, a knowledge of business is essential – some CISOs even possess an MBA.

CISO shortage fuels SMB demand for vCISO services

Unfortunately, skilled CISOs are in very short supply. Those who can afford it pay top dollar – CISOs typically command in excess of $150,000. Few SMBs can afford that amount.

Yet states such as New York and others mandate that the CISO position must be filled in certain regulated markets such as financial services. No wonder virtual CISO (vCISO) services have surged in popularity.

Almost half of MSP clients fell victim to a cyberattack within the last 12 months. In the SMB world, the danger is especially acute. Never mind a CISO – only 50% of SMBs have a dedicated internal IT person who manages cybersecurity.

That’s why SMBs are increasingly willing to pay a subscription or retainer to gain access to expert C-level cyber-assistance in devising and implementing strategies to prevent breaches, reduce risk, and mitigate the consequences of attacks.

No wonder that more than 80% of service providers are planning to offer vCISO services in the near future. These services are especially attractive to MSPs and MSSPs as they address a growing need from their SMB clients for proactive cyber resilience while offering the potential to grow recurring revenues. Moreover, offering vCISO services makes service providers’ work more effective, as they not only say what needs to be done to close security gaps, but also control those actions.

Many vendors offering vCISO services also claim that providing these services enhances their customer intimacy allowing them direct contact with customers’ top management. The problem is that many providers are only able to provide a small portion of overall CISO duties.

How to expand into vCISO services

Some vCISO service providers help organizations with compliance preparedness while others perform risk assessments or assist in areas such as reporting and communication with management, cybersecurity audit preparation, continuity planning, cybersecurity strategy, the setting of policy, financial management of cybersecurity, and the supervision of security technology evaluation and implementation.

Each of these services adds clear value to the client. But they don’t encompass the breadth of functions provided by a full-time CISO.

The minimum requirements for full vCISO services are:

Risk assessment & management
Setting strategy
Actual protection of the organization
Training & security awareness
Compliance & governance
Incident response
Continuity planning
Thiry-party management
Communication to management

Spanning the entire range of vCISO responsibilities, MSPs and MSSPs can achieve much higher margins by adding even more value to their customers and making their work more effective. But how can this be done without killing profitability?

After all, where will the MSP/MSSP find qualified, experienced and affordable personnel that can fulfill the role? Alternatively, how can they scale their vCISO services without having to add yet more resources?

How to deliver comprehensive vCISO services?

In this eBook we explain:

The essential functions of the vCISO
What it takes to move from partial delivery of vCISO duties to comprehensive delivery
The upsell potential of delivering comprehensive vCISO services
How vCISOs already providing security risk assessments or compliance services can expand those offerings effortlessly
The platforms that can help vCISO providers add sufficient automation to be able to broaden their offerings and scale without adding more personnel resources.

vCISO platforms can help you deliver the full range of services

vCISO platforms enable service providers to deliver a complete range of vCISO services. This means they can charge a lot more while delivering highly valued services that earn word of mouth at the highest ranks of management.

Effectively, they have elevated their sphere of influence from the systems administrator/IT manager level up to being able to interface directly with C-level executives and the board of directors. With their duties well fulfilled, the MSP/MSSP moves into a trusted position of strength.

Smart service providers, therefore, seek to extend their existing offerings to be able to provide the entire vCISO service range and become true partners of their clients.

This eBook is based on input from our community of experienced vCISOs. It lays out the essential steps needed to be able to embrace the full scope of vCISO services.