Outsourced security lead (vCISO)
A person responsible for your company's security, without hiring them full-time.
- No minimum term
- Meeting every month
- Review every quarter
- Remote, anywhere in Spain
If you are looking for a vCISO in Móstoles, this is what we do: a person responsible for your company's security, without hiring them full-time.
They set priorities, run the security plan, coordinate providers, answer clients and auditors, and report to management.
It is designed for SMEs that need someone in charge of security but cannot justify a full-time role.
Read more Read less
In the first month there is an assessment and a plan. After that there is a meeting every month, a review every quarter and a report for management in plain language.
Request a quote
To talk about outsourced security lead (vCISO), call or write to us and we'll tell you the next steps.
How we help
- No one in the company has security as their main responsibility.
- Clients, insurers or auditors ask questions that no one knows how to answer.
- You have several IT and security providers and no one coordinates them.
- You receive security questionnaires from clients or insurers.
- You need an annual security plan with priorities and a budget.
- Management wants reports in plain language.
What an outsourced security lead is
It is a person responsible for the company's security, without hiring them full-time. They set priorities, run the security plan, coordinate providers, answer clients and auditors, and report to management.
In other words, security gets an owner. Someone decides what comes first, keeps track of what is pending and answers when a client or an auditor asks.
Read more Read less
The work is closer to that of a department head than that of a technician. They organise decisions, share out the work among the people who already look after the systems and report to management.
Which companies it makes sense for
This service is for SMEs that need someone in charge of security but cannot justify a full-time role.
Read more Read less
There is a simple way to look at it. Think about who would answer today if management asked how the company's security stands. If the answer is ‘it depends’ or ‘no one in particular’, it is worth talking about.
Tell us how your company is organised and we will work out together whether this service fits or whether another would suit you better.
Why companies usually call us
These are the usual reasons for asking for an outsourced security lead. They have one thing in common: there is no one who has the matter on their desk.
- No one in the company has security as their main responsibility.
- Clients, insurers or auditors ask questions that no one knows how to answer.
- You have several IT and security providers and no one coordinates them.
Read more Read less
It is not usually a case of poor management. In a small company everyone already has their own job, and security ends up spread across several people or with no one answering for it.
How we work
We start with a baseline assessment. From it we draw up a prioritised security plan, which management approves. The assessment and the plan are done in the first month.
Then comes the follow-up. The vCISO meets every month with the member of management you designate, and every quarter we review the plan and the risks.
Read more Read less
Between meetings we answer questions from management and the team, so they are not left waiting for the next appointment.
How we start
- Baseline assessment in the first month.
- Prioritised security plan, approved by management.
- Follow-up meetings every month.
- Quarterly review of the plan and the risks.
- Answers to questions from management and the team between meetings.
What the service includes
The service focuses on leading security: deciding, coordinating, answering and reporting. This is the list of what is included.
Read more Read less
If you compare this type of service across several providers, it is worth checking three things: how often there are meetings, who writes and updates the policies, and who answers the questionnaires your clients send you.
- Annual security plan with priorities and a budget.
- Follow-up meeting every month with the member of management you designate.
- Quarterly review of the plan and the risks.
- Coordination of IT and security providers.
- Answers to security questionnaires from clients and insurers.
- The company's security policies and keeping them up to date.
- Report for management in plain language.
Price and timescales
It is a monthly fee. The price depends on the size of the company and the time commitment, which is why we do not give a figure here.
Call us and we will tell you how to proceed.
The work starts in the first month and the review is quarterly. Our monthly fee services have no minimum term, and this is one of them.
The prices we quote do not include VAT (21%).
Bear that in mind when comparing them with other offers, and also look at what time commitment each one includes and what it leaves out.
What this service does not include
- Carrying out the technical changes.
- Managed services, such as 24/7 monitoring.
Read more Read less
The vCISO leads; they do not carry out the work. They set out what needs to change and in what order, but the technical changes are carried out by your team or contracted separately.
Managed services are not included either. If you need 24/7 monitoring, it is contracted separately.
We tell you this from the start so you know what the fee covers and what would need to be added.
Plan review every quarter
Every quarter we review the plan and the risks. It is the moment to see what has been done, what is still pending and what has changed.
Read more Read less
A security plan is not written once and then filed away in a drawer. A company changes provider, takes on new people or starts working with a client who asks for new things. When that happens, priorities can shift.
Who looks after you
Aitor handles management and client relations. You can talk to him about what your company needs and how this service fits.
Before taking on a vCISO, with us or with any other provider, it is reasonable to ask who will fill the role, what experience they have and how their time commitment is organised.
Ask in the first conversation.
Where we work
We work remotely anywhere in Spain and in person in the Comunidad de Madrid.
If your company is in Móstoles or elsewhere in the Comunidad de Madrid, we can work with you remotely and also in person.
If it is in another region, we work remotely.
Common questions about the vCISO
A vCISO is an outsourced information security lead. They do the security management work that an in-house CISO would do, with the time commitment the company needs.
They do not replace your IT team, which continues to maintain the systems. The vCISO sets the security priorities, coordinates them and answers to management.
Read more Read less
They work remotely and, in the Comunidad de Madrid, also in person when needed. You will find the other questions, about price, results and services contracted separately, in the questions on this page.
Questions about outsourced security lead (vCISO)
What is a vCISO?
It is an outsourced information security lead. They do the security management work that an in-house CISO would do, with the time commitment your company needs.
How much does it cost?
It is a monthly fee. The price depends on the size of the company and the time commitment, and there is no minimum term. Call us and we will tell you how to proceed.
Does it replace my IT team?
No. The IT team maintains the systems. The vCISO sets the security priorities, coordinates them and answers to management.
Do they come to the company?
They work remotely and, in the Comunidad de Madrid, also in person when needed.
When do you see the first results?
In the first month there is an assessment and a plan. Every quarter, progress is reviewed with management.
Does it include 24/7 monitoring?
No. Managed services, such as 24/7 monitoring, are contracted separately.
Does the vCISO make the technical changes?
No. The technical changes are carried out by your team or contracted separately. The vCISO sets the priorities and tracks the plan.
Is there a minimum term?
No. Our monthly fee services have no minimum term.
NIS2, ENS and ISO 27001 compliance
We prepare your company for NIS2, ENS or ISO/IEC 27001 and support you through the audit.
24/7 monitoring and response
Managed SOC for SMEs: we monitor computers and servers around the clock, analyse the alerts and, if an attack is real, we contain it and let you know.
Exposure assessment
We review from the outside what an attacker can see of your company and give you a report for management and a prioritised plan.
Incident response
We contain the attack, find out what has happened and help you get your business running again.
Let's talk about your company
Call us on +34699240879 or email us at hola@oteosecurity.com.
Tell us the size of your company, who handles security today and what clients, insurers or auditors are asking of you. With that, we will tell you how to proceed.