How to Choose a vCISO: 10 Questions to Ask Before You Sign

The vCISO market has a low barrier to entry: anyone with a LinkedIn title and a folder of policy templates can sell "virtual CISO services," and the difference between a real security executive and a rebadged consultant usually doesn't show up until you're six months and many thousands of dollars in. The fastest way to protect yourself is to ask harder questions before you sign. These ten separate the professionals from the pretenders — along with the answers you should expect to hear.

Before the Questions: Know What You're Buying

vCISO engagements come in recognizable tiers — hourly advisory, fractional retainer, and full program ownership — and the right questions depend on which one you actually need. Match the conversation to your real driver: a compliance deadline, customer security demands, board pressure, or a regulatory obligation like CMMC. (For what each tier costs and delivers, see our vCISO pricing guide.)

The 10 Questions

1. Who, specifically, will be my vCISO — and what are their credentials? Expect a name and real certifications (CISSP, CISM, CISA), not a description of the bench. If the person on the sales call isn't the person doing the work, meet the one who is.

2. What deliverables will I have in hand after 90 days? Strong providers answer instantly — risk assessment, roadmap, policy plan — because they run a defined onboarding arc. Vague answers now become vague deliverables later.

3. How many hours am I buying, and who covers when you're unavailable? This is the solo-practitioner test. An individual gets sick and takes vacations; a team-backed service should name its continuity plan.

4. Have you run programs under my frameworks? Ask for specifics by framework — SOC 2, HIPAA, NIST 800-171/CMMC — and how many audits or assessments they have actually sat through on the client's side of the table.

5. What happens when we have an incident at 2 a.m.? On-call expectations, the escalation path, and what's inside versus outside the retainer — in writing. If incident response isn't priced in, it isn't promised.

6. Do you resell products or take referral fees? The independence test. Recommendations should stand without commissions behind them; disclosure is the minimum acceptable answer.

7. How will you report to my leadership and board? Ask to see a sample board deck and metrics pack. If they can't show one, they haven't been in front of many boards.

8. Can you serve as our named security officer? Some regulations and contracts require a designated individual. Will they put their name on it — and stand behind it with your regulators and customers?

9. What does it cost, and what changes the price? Clear scope triggers — headcount growth, a new framework, an acquisition — beat vague "we'll flex with you" answers that surface as surprise invoices.

10. What do we keep if we part ways? Policies, risk register, and documentation should be yours, with an offboarding handover in writing. Anything else is lock-in priced as leadership.

Red Flags That End the Conversation

• No named individual — only certifications "across the team"
• A price quoted before any discovery of your environment
• Templates presented as strategy, and no sanitized artifacts from past engagements

Scoring the Answers

Keep the rubric simple: separate dealbreakers from preferences. For most buyers, questions 1, 2, and 10 are dealbreakers — a named executive, concrete deliverables, and ownership of your own documentation. For regulated businesses, weight incident support (5) and framework experience (4) heaviest: those are the questions you cannot afford to have answered badly in a crisis or an audit.

How Essendis Helps

Essendis virtual CISO services are built to survive this questionnaire: named, credentialed executives — leadership credentials include CISA, CISM, CISSP, and CCSP — team-backed delivery, and audit-tested experience across SOC 2, HIPAA, ISO 27001, and CMMC. Bring these ten questions to the first call. Connect with an expert.