Intermediate Service

Tier 2: Core vCISO Partnership

$8,000–$12,000/month

Best for: Multi-location healthcare organizations (3–5 sites), regional credit unions, mid-size professional services firms, and organizations with elevated compliance or regulatory complexity.

What You Get (Everything in Tier 1, plus):

•        Bi-Weekly Strategic Leadership (2 hours each meeting) — Deep partnership on roadmap execution, emerging threats, regulatory changes, and executive-level risk communication.

•        Enhanced Advisory Hours — Up to 16 hours/month of proactive advisory, incident support, compliance work, and technology guidance.

•        Comprehensive Compliance Program:

–        Quarterly compliance assessments and audit-readiness drills.

–        Full policy suite development and annual maintenance (HIPAA Privacy/Security, GLBA Safeguards, Incident Response, Access Control, Vendor Risk, Data Classification, etc.).

–        Regulatory change monitoring and policy updates.

•        Security Program Maturity:

–        Quarterly security posture reviews using NIST CSF 2.0 or CIS Controls v8.1.

–        Incident response plan development and semi-annual tabletop exercises.

–        Security architecture guidance on major infrastructure decisions.

•        Advanced Risk Management — Semi-annual deep-dive risk assessments with executive summary and remediation roadmap; third-party risk management program (vendor vetting, ongoing monitoring, contract review).

•        Board & Executive Reporting:

–        Quarterly cyber risk dashboard and executive summary.

–        Board-ready incident and compliance reporting.

–        Annual security posture briefing for leadership/board.

Monthly Deliverables: Meeting minutes, compliance roadmaps, policy suite, risk register, incident response plan, vendor risk register, board dashboards, and audit support documentation.