vCISO or In-House? The CISO Operating Model

Own the decisions. Buy the execution. That is the short version of a CISO operating model that holds up when something goes wrong.

Most operating-model debates start with cost or headcount. “What can we outsource?” is the wrong first question. The better one is: “What must we be able to decide, explain and defend ourselves?” Everything else is a question of capacity, skill and economics.

Accountability sets the boundary

Regulators already draw this line. Under the EU NIS2 Directive, the management body of an in-scope entity approves the cybersecurity risk-management measures, oversees their implementation and can be held liable for failures. Under DORA, a financial entity stays fully responsible for meeting its obligations even when it uses third parties for ICT services. The regimes differ. The principle is the same.

A partner can run your monitoring. A partner cannot be accountable for the outcome. Your own regulator, customers and contracts may add rules on outsourcing or on named senior roles. Check those before you finalize any model.

Four tests for any capability

Apply these to each capability in turn. They are quick to answer and hard to argue around.

Test	Question	If the answer is yes
Accountability	If this fails, must an executive or the board answer for the decision?	Keep it internal
Context	Does doing it well depend on business knowledge a partner would need months to learn?	Keep it internal, or share it with an internal owner
Scale	Is the work round-the-clock, spiky, scarce-skilled or occasional?	Partner-led becomes practical and often cheaper
Exit	Could you replace the partner within roughly 90 days and keep the capability?	If not, you own too little. Rebuild the internal core

One rule beats the others. If a capability fails the accountability test, it stays internal, whatever the cost argument says.

Where capabilities usually land

These are defaults, not rules. Your size, sector, regulator and talent market will move some of them.

Capability	Default	Why
Risk appetite and risk acceptance	Internal	Accountability sits with the business and the board
Security strategy and investment priorities	Internal; partner may advise	Needs business context. This is the core of the CISO role
Board and executive reporting	Internal	Credibility and accountability cannot be delegated
Policy exceptions and risk sign-off	Internal	Trade-offs against business need
Crisis decision authority (isolate, notify, pay or not)	Internal; partner advises	Executive decisions with legal and commercial exposure
Decisions on critical suppliers	Internal	Accountability stays with you whoever does the assessment
Security architecture	Hybrid	Internal owner sets principles; partner adds design capacity
GRC and compliance operations	Hybrid	Internal owns the obligations; partner can run assessments and evidence collection
Identity and access program	Hybrid	Business processes stay internal; engineering capacity can be shared
Vulnerability management	Hybrid	Partner can find and rank; asset owners must fix
24/7 monitoring and triage	Often partner-led	Round-the-clock cover is costly to staff alone
Penetration testing and red teaming	Partner-led	Independence and specialist skill
Forensics and surge incident response	Partner-led, on retainer	Rare, urgent and specialist
Independent assurance and audit	Partner-led	Must be independent of the people who operate the controls

Where the model breaks

The partner holds the context

Tuning decisions, runbooks and exception history live in the partner’s tools and in their analysts’ heads. When the contract ends, so does the knowledge. Insist that runbooks, detection logic and configuration sit in your environment and belong to you.

Judgment leaves with the work

A partner reports that everything is green. Nobody inside can tell whether that means “safe” or “not looking”. If no one can challenge the reporting, you have outsourced oversight along with operations.

One person is the whole program

The opposite failure is common too. A single internal expert owns detection, cloud security or identity, and the program goes where they go. Partner capacity is often the right fix here, as a way to remove single points of failure.

Nobody owns the seams

At 3 a.m., who decides to isolate a production system? If the answer depends on whom you reach first, the model has a gap. Write down decision rights for incidents, including who can act without waiting for approval.

The interim leader becomes permanent

A virtual or fractional CISO fits well in several situations: no CISO yet, a transition, an early-stage company, or a specific leadership gap. It fits poorly as a permanent substitute when the organization needs someone to build culture, hold daily executive relationships and be present through a long crisis. That is a judgment, and it depends on scope. Whatever the arrangement, write down the scope, decision rights, time commitment and handover plan.

The minimum internal core

Even a heavily partner-led model needs a small internal core. Without it, the organization cannot govern what it buys.

A named security leader who is accountable and has direct access to executives
An owner for the risk register and for exceptions
Someone who manages partners against outcomes, not hours worked
At least one person who can read partner output critically and challenge it
Documented decision rights for incidents and for risk acceptance

How to run the exercise

List your security capabilities. Group them by what the business would feel if they failed.
Run the four tests on each one. Record the answers, not just the conclusion.
Assign a default: internal, hybrid or partner-led. For hybrid, name the internal owner.
For anything partner-led, write the exit plan, the data and runbook ownership terms and the escalation times.
Review it every year, and sooner after an acquisition, a major regulatory change or a significant incident.

When you negotiate with partners, ask for outcome-based service levels, access to underlying data and logic, reporting detailed enough to challenge, and help with transition if you leave. Those four terms do more for your control than any price discount.

Next Step

Sources

European Union, Directive on measures for a high common level of cybersecurity across the Union (NIS2), Articles 20 and 21. Official Journal of the European Union (EUR-Lex). eur-lex.europa.eu
European Union, Regulation on digital operational resilience for the financial sector (DORA), Article 28 on general principles for managing ICT third-party risk. Official Journal of the European Union (EUR-Lex). eur-lex.europa.eu
NIST, Cybersecurity Framework 2.0, including the Govern function and its cybersecurity supply chain risk management outcomes. https://www.nist.gov/cyberframework

The CISO Operating Model: What Should Be Internal and What Can Be Partner-Led?