Oct2025
ISO 27001:2013 certificates have expired
The transition to ISO/IEC 27001:2022 ended on 31 October 2025. Certificates against the 2013 version are no longer valid.
Source: IAF
- Home
- Cyber Security
- Virtual CISO and managed compliance
A security leader without the full time salary.
Someone has to own security: set priorities, report to the board, manage suppliers and face the auditor. A virtual CISO does that part time, and managed compliance keeps the evidence current all year.
What it covers
Virtual CISO and managed compliance
Security strategy
A security programme with priorities, budget and a roadmap, aligned to your risks and obligations.
Board and management reporting
Regular reporting on risk, incidents and progress, in plain language.
Audit and certification readiness
Preparation for ISO 27001, SOC 2, PCI DSS and CIMA inspections, including mock assessments.
Policies and training
Security policies maintained, staff awareness training delivered and phishing simulations run.
Control testing and evidence
Controls tested on a schedule and evidence collected as you go, not in the week before the audit.
Supplier security
Security requirements set for suppliers and their performance reviewed.
- ISO/IEC 27001:2022
- SOC 2
- PCI DSS v4.0
- NIST CSF 2.0
- CISSP
How we do it
Baseline
Current security posture and obligations assessed.
Plan
Programme, priorities and calendar agreed.
Run
Controls, training and testing run all year.
Report
Progress and risk reported to the board.
Field notes
Worth knowing
99.2%
The cheapest control works best
Microsoft found multi factor authentication blocks over 99.2% of account compromise attacks. Most security programmes start there.
Source: Microsoft
What you receive
- Security programme and roadmap
- Information security policy set
- Board security reports
- Compliance calendar and evidence records
- Training and phishing simulation results
Questions
What is the difference between a virtual CISO and a virtual CIO?
A virtual CIO owns technology strategy, budgets and vendors. A virtual CISO owns security risk, controls and compliance. Smaller firms often combine them; larger ones keep them separate.
Can a virtual CISO get us ISO 27001 certified?
We prepare you for certification: scope, risk assessment, controls, documentation and a mock audit. The certificate itself is issued by an accredited certification body.
How much time does a virtual CISO spend with us?
An agreed number of days each month, plus cover for audits and incidents, sized after the initial assessment.
More on Cyber Security
Talk to us about virtual CISO and managed compliance
Tell us what you're working on. We'll listen, ask the right questions and recommend a practical next step. No obligation.
info@gabcoenterprises.com+1 345 769 4222