vCISO services for MSPs
Add security leadership to your service line.
Your clients get a CISO. You keep the client and the environment.
What you get
vCISO without the hire
No full-time salary on your books.
A partner, not a competitor
I don't sell managed services or run infrastructure.
Say yes to compliance work
SOC 2, HITRUST and HIPAA, delivered together.
Client situations
When your clients need more, bring the right expertise to the table.
These requests usually land on the MSP first. The matrix shows which service handles each one.
SOC 2 readiness
A client pursuing larger contracts needs help assessing gaps, organizing evidence and preparing for a SOC 2 examination.
HITRUST readiness
A healthcare or health technology client needs help understanding assessment scope, evaluating readiness and preparing for the certification process.
AI governance
A client is adopting AI and needs policies, vendor review, data-handling rules and clear accountability.
Security program build
A growing organization needs a structured security program with policies, priorities, responsibilities and an actionable roadmap.
Security program maturity
A client has controls and processes in place but needs help evaluating effectiveness, prioritizing improvements and measuring progress.
vCISO or fractional CISO leadership
A client needs ongoing executive security guidance, budget planning and leadership reporting on a part-time basis.
Interim CISO leadership
A leadership departure, hiring gap or organizational transition creates a temporary need for security program continuity.
Cyber insurance readiness
An upcoming application or renewal requires documented answers and a plan to address identified gaps.
Healthcare risk assessment
A healthcare client needs a HIPAA security risk analysis and a practical remediation plan.
Partnership scope adapts to the services you already offer and to the expertise or capacity each situation calls for.
Matching services
Specialized expertise for each stage of your client's security program.
Security leadership
vCISO and fractional CISO engagements for ongoing guidance, executive reporting and budget planning. Interim CISO support for defined transitions, such as a departure or a hiring gap.
vCISO or fractional CISO leadership, Interim CISO leadership
Security program development and maturity
Build program foundations, assess existing capabilities and guide measurable improvement over time.
Security program build, Security program maturity
SOC 2 and HITRUST readiness
Assess gaps, develop policies, organize evidence and coordinate preparation with the client's selected auditor or assessor.
SOC 2 readiness, HITRUST readiness
AI governance and vendor risk
Establish practical AI policies, review vendors and use cases, and define who is responsible for oversight.
AI governance
Risk assessment and insurance readiness
Evaluate current controls, document findings and prioritize remediation, including the evidence an application or renewal asks for.
Cyber insurance readiness
Healthcare cybersecurity advisory
HIPAA security risk analysis, governance and security planning that accounts for clinical operations.
Healthcare risk assessment
Already offer some of this? A partnership fills in where you want it to.
Specialized expertise
Bring in depth on a framework or industry your team doesn't cover every day, such as HITRUST or HIPAA.
Additional capacity
Keep a readiness project or assessment moving when your team is already committed elsewhere.
A defined leadership role
Give the client a named security leader for executive reporting and planning, while your team keeps operations.
Why partner
More expertise for your clients. More opportunity for your business.
Expand your offering
Bring specialized advisory services into client engagements without building every capability in house.
A security voice owners act on
Recommendations reach owners and executives in business terms, tied to budget and risk, so decisions get made instead of stalling.
Findings that become approved projects
Assessments end in a prioritized roadmap the client has signed off on. The implementation work in your scope comes to you already defined.
Add capacity where you need it
Bring me in for one specific requirement or for an ongoing program.
Give clients one coordinated experience
Your operational knowledge of the environment, combined with risk and governance expertise.
How I work with partners
A clear role. A coordinated approach. Respect for your client relationships.
Your client relationship stays yours. Existing relationships and the responsibilities you've agreed with the client stay in place.
Roles are defined first. Advisory and implementation responsibilities are written down before any work begins.
Meetings and requests are coordinated. Client meetings and evidence requests follow an agreed plan, so the client isn't asked for the same thing twice.
Findings are reviewed together. We check findings for accuracy and context before the client sees a coordinated roadmap.
Decisions are documented. Recommendations and the client's decisions on them are recorded and dated.
Your tools stay in place. I work with your existing tools and documentation wherever they fit the engagement.
How we work together
Start with one client. Build from there.
Connect
We talk through your services, your client's needs and where added expertise would help.
Scope
We agree on deliverables, responsibilities, fees and how we communicate with the client.
Assess and plan
We establish the client's current state and build a prioritized roadmap.
Deliver together
Advisory work, approved implementation and progress reporting run on one coordinated plan.
Continue where useful
Extend the work to other clients or to ongoing advisory support.
What you walk away with: A clear scope, an actionable plan and named owners.
Have a client need in mind? Let's talk.
Bring the situation. We'll figure out whether a partnership fits.
Healthcare clients
Serving healthcare clients? Bring specialized experience into the partnership.
CEO first, CISO second. I've led security programs in more than one industry and worked alongside MSPs and internal IT teams in each of them. Healthcare is where most of my advisory work sits today, though not all of it, and most clients are under 500 employees.
You know the technical environment. I bring the risk and governance work healthcare clients are expected to have in place.
HIPAA security risk analysis and remediation planning
Policies with clearly assigned responsibilities
Vendor risk and business associate oversight
Incident response planning that accounts for patient care
Evaluation of AI tools and how they handle patient data
Reporting practice owners and healthcare leaders can act on
Partner FAQs
Questions MSPs ask before we start.
Can you work alongside our existing security or vCISO team?
Yes. We define roles during scoping so my work adds to what your team already does rather than duplicating it.
Who manages the client relationship?
You do. Your existing relationship and responsibilities stay in place, and we agree up front how client communication is handled.
How are responsibilities, contracts and fees handled?
They're set per client during scoping. We agree on deliverables, who does what, how the engagement is contracted and how fees work before any work begins.
Can we start with a single client engagement?
Yes. Most partnerships start with one client need. We build from there if it works for both of us.
Do you offer ongoing advisory support?
Yes. Beyond one-time projects, I provide ongoing vCISO and fractional CISO support for clients who need continuing security leadership.
Do you work with clients outside healthcare?
Yes. Healthcare is a specialty, but I also work with small and midsize businesses, private equity firms and their portfolio companies, and other organizations that need security leadership.
Can you assess our MSP's own security program?
Yes. I work directly with MSPs on their own security programs as well. Pricing depends on scope, so we'd start with a conversation.
Related reading
Security leadership
Next step
Let's explore what we can deliver together.
Bring a current client need or a service you want to add. In our conversation we'll decide whether it's a fit, talk through who does what, and pick a practical place to start.