Top Tips on Choosing a vCISO

1. And What You Need to Know Beforehand Top Tips on Choosing a vCISO @CISOSHARE

3. Why Use a Virtual CISO? • You need an interim security leader as you build an internal team. • You’re outsourcing security entirely. • You need support in improving your security program. There are no wrong reasons, only different business goals. Copyright © 2019

6. STEP 1 Understand the basics of your organization: Why do you want to improve cyber security? What problems will you face without the right program? What requirements does your organization have to meet? Copyright © 2019

7. Explore your implementation options: Outsource everything in your security program. Only outsource the CISO role and hire an internal security team. Hire an internal CISO and outsource roles to a service provider. Anything in between! STEP 1 Copyright © 2019

8. Evaluate available security service providers: Professional services consultants These teams offer project-based contracts, including vCISO services. Managed security service providers True service providers offer ongoing role and process performance to clients. One-person CISO consultancies These are individuals you can use to perform the CISO function. STEP 1 Copyright © 2019

9. Everything in security will have ongoing capital and operational costs. Don’t forget to factor in foundational costs, resource costs, and any necessary technology costs. Understand your budget and cost savings. STEP 1 Copyright © 2019

11. • Alignment to best practices and security regulations • Foundation and process maturity • Existing resource capability • Existing remediation items and security roadmap • Security architecture and data map • Susceptibility to attack Understand key areas of your security program: STEP 2 Copyright © 2019

12. Different ways to measure your current state: Internal assessment using your own team External assessment through a consultancy Potential security service providers Utilizing a previous customer assessment STEP 2 Copyright © 2019

14. STEP 3 1 What the option is, so people can quickly understand it. 2 The annual capital and ongoing costs of each program option. 3 The foundational elements that will be built. 4 The resource elements and whether they’ll be internal, outsourced, or a combination of the two. 5 Any security architecture technology that might change or be added. 6 How the option will maintain or improve your current state. 7 Any pros and cons for each. Copyright © 2019

22. @CISOSHARE Copyright © 2019 Based in Southern California and serving organizations globally, CISOSHARE is the leading provider of security program development, professional, and managed services for leading and rapidly-growing organizations. Learning and teaching lies at the core of CISOSHARE’s culture, focusing on educating employees and clients about information security through our services. CISOSHARE offers managed security program services, role-based services, security architecture, incident management and response, and more. About CISOSHARE www.cisoshare.com | info@cisoshare.com | +1-800-203-381