CSO as a service
A security leader on call, without the full-time salary
Someone who owns your security plan, sits in the meetings that matter and turns the technical into decisions you can make. You choose how many hours a month.
Who it is for
Who this is for.
Businesses that need senior security judgement but not a full-time hire.
Owners with no security lead
Security sits with whoever has time, usually your IT provider. Nobody owns the plan or answers for it.
Businesses working towards certification
You have decided to pursue SMB1001 or another standard and need someone to steer the programme.
Boards and clients asking questions
You need a person who can explain where you stand in plain language and present it when asked.
What changes
From nobody in charge to a named leader.
First
Your security leader learns your business, reviews where you stand and agrees a plan with you.
Then
They run the plan: priorities, policies, supplier questions and your reporting to the board or owner.
Ongoing
They stay your point of contact, including when something goes wrong, and adjust the plan as the business changes.
How it works
How it works.
Choose how many hoursThree tiers, from light guidance to full ownership.How this works underneath
Advisor is 16 hours a month, Active is 32 hours a month and Embedded is 64 hours a month. Hours do not roll over. They are used for the current month's priorities.Your leader works from the platformRisks, policies and evidence all sit in one place you can see.How this works underneath
Your CSO manages the view, the risk register, your policies and your reports directly in the CyberGrape platform. Incident actions are logged in the incident response module.Move between tiers as things changeTiers are reviewed at each renewal.How this works underneath
Many clients start at Advisor or Active and move to Embedded as the programme grows or as they approach a higher SMB1001 tier.
A small example
What this can look like.
- Situation
- A client has asked for proof of security. The IT provider handles tools but nobody owns the plan.
- What changes
- The firm starts at Active. In the first month the leader reviews where the firm stands and agrees priorities.
- What happens next
- Policies are approved, supplier questions are answered and the board gets a plain-language update.
- What the owner can say
- "We have a named security leader, a plan and a record of what is done."
This is an invented example to show how the service works. The names and figures are not a real customer's.
What you get
What you get.
A security plan you can explain
A roadmap with priorities and a budget you can take to the board.
Board and owner reporting
Plain-language updates prepared and presented for you, in all three tiers.
Policy and supplier oversight
Your policies kept current and your supplier questions handled.
Incident leadership
Someone to act as incident commander when something goes wrong.
Independent advice
Advice on what to buy and, more often, what not to.
Work done in the platform
Your leader works from the CyberGrape platform, so you can see what they are doing at any time.
Price
How it is priced.
Advisor
16 hours a month. Light guidance and oversight.
Active
32 hours a month. Your leader runs the plan with you.
Embedded
64 hours a month. Your leader owns the programme.
The tier sets the hours each month. Talk to us for current pricing.
Questions
Common questions.
Most small and medium businesses do not. A fractional leader gives you senior security judgement for a set number of hours each month, without a full-time salary.
Your leader works a defined number of hours each month on the highest-value work: the plan, governance, board reporting and incident oversight. Hours do not roll over.
Yes. Board presentation and executive briefings are included in all three tiers.
Your leader acts as incident commander, coordinating your team and keeping leadership informed. Actions are logged in the platform's incident response module.
Yes. Tiers are reviewed at each contract renewal.
Other services
Also available.
Find out whether you need a security leader.
Start with the free readiness assessment. It shows you where you stand, and we will tell you which service, if any, makes sense.