A fractional CISO who runs your security program — not just advises on it
vCISO Complete gives your business a named security leader who owns the roadmap, keeps compliance moving, builds and tests your incident response plan, and delivers a board-ready report every quarter. Everything in vCISO Lite, plus the execution.
$1,500/moMonth-to-month after a 3-month initial term · Bridge to the full vCISO Retainer
Start vCISO Complete — $1,500/moBook a fit call firstWho this is for
Growing businesses (typically 25–250 staff) that have outgrown ad-hoc security, face customer or regulator questionnaires, and cannot justify a full-time CISO yet.
- Leaders being asked for SOC 2, HIPAA or vendor-security evidence
- Companies without a tested incident response plan
- Teams that need a security roadmap someone actually drives
- Boards that want a clear quarterly picture of risk
What's included
Advisory foundation
- Monthly strategy call with your named vCISO
- Living security roadmap
- Vendor and tooling questions answered
- Policy review and guidance
Program execution
- Compliance support: control mapping, evidence tracking and questionnaire responses for SOC 2 / HIPAA / vendor reviews
- Incident response planning: plan written, roles assigned, annual tabletop exercise facilitated
- Board-ready quarterly security report: posture, risks, progress and asks
- Bi-weekly working session in addition to the monthly call
- Priority response window for security questions
StonePath Cyber is an independent advisory firm. We prepare, implement and manage; we do not issue certifications, authorizations or accreditations, and no outcome is guaranteed. Pricing is fixed as shown; scope beyond it is quoted in writing before any work begins. Hands-on engineering, managed detection and audits are scoped separately when needed.
How it works
Intake questionnaire, access to existing policies, kickoff within the first week.
Posture review and 12-month roadmap in the first 30 days.
Bi-weekly sessions, compliance tracking, IR plan built and exercised.
Board-ready report every quarter, with clear decisions for leadership.
Book a fit call
Tell us about your business, the frameworks or customers pressing you, and your current security setup. We reply within one business day.
Questions
How is Complete different from vCISO Lite?
Lite is advisory: a monthly call, roadmap and vendor guidance. Complete adds execution — compliance support, incident response planning and exercising, a bi-weekly working session and a board-ready quarterly report.
When should we move to the full vCISO Retainer?
When you need a leader embedded weekly, running multiple audits or a security team. Complete is designed as the bridge; we tell you when it stops being enough.
Can we cancel?
3-month initial term, then month-to-month with 30 days notice.