Every company has someone who is responsible for IT. They fix computers, look after servers, answer employees’ questions and usually know their job well. But when a customer sends a security questionnaire with a hundred questions, when the board asks “are we secure?”, when someone has to decide whether NIS2 applies to us, it turns out that this person does not exist. IT support and security management are different jobs, and one person rarely has time to do both.
Large companies solve this by hiring a chief information security officer (CISO). For a mid-sized company this is rarely realistic: such specialists are scarce on the market, their pay is comparable to that of executives, and there is often not enough work for a full-time position.
In this article we explain what a security lead actually does, why a service makes more sense than a hire for a mid-sized company, what the service includes and how it fits with your existing IT.
What a security lead actually does
A security lead is not a better IT administrator. They do not install antivirus software and do not configure firewalls. Their job is to make sure the company knows its risks, makes decisions about them and can prove it.
In practice this means four functions. First, risks: understanding what matters most to the company, what threatens it and how much risk management is willing to accept. Second, rules: preparing policies and procedures that are actually followed, and making sure they do not go stale. Third, control: checking that IT does what it promised and that it works. Fourth, accountability: explaining to management, customers and auditors where things stand, without technical jargon.
An IT administrator answers the question “how do we do this”. A security lead answers the question “what needs to be done and why”. These are different perspectives, and it is healthy when they are represented by different people, because the security lead, among other things, checks the work of IT.
Why a full-time hire is too expensive for a company of 50 to 300 employees
In a company of this size, the security lead’s work amounts to a few days a month. Policies have to be written once and reviewed every year. The risk register is updated every quarter. An audit is coordinated once a year. Customer questionnaires are filled in a few times a year. A report goes to the board every quarter.
A full-time position for that workload means an expensive specialist will spend most of their time on work that is not theirs, or will get bored and leave. A common scenario in our experience: a company hires a security specialist, and a year later that person becomes the head of IT because there is more of that work, and security management is left without an owner again.
The second problem is experience. One person sees a handful of companies in a career. A service team works with many customers in different sectors at the same time, so it recognises problems faster and knows what auditors will ask, because it deals with them all the time.
The third is continuity. A salaried specialist goes on holiday, falls ill or changes jobs, and all the knowledge leaves with them. A service is delivered by a team, so knowledge is documented and stays in the company.
What CISO as a Service includes
CISO as a Service (also called vCISO, virtual CISO) is the security lead function, delivered by an external team within an agreed scope. In our case it covers the following work.
Policies and procedures
A set of policies is prepared and maintained, tailored to the size and requirements of the company: information security, access control, backups, incidents, suppliers, acceptable use. Policies are written briefly and so that they are really followed, not just to impress an auditor.
Risk register
An initial risk assessment is carried out and a risk register is maintained: each risk with an owner, measures and deadlines. The register is reviewed every quarter together with management, so that decisions about risks are made consciously, not by default.
Incident plan
An incident management procedure is prepared, with clear roles, contacts, notification templates and deadlines, including notifications to authorities under NIS2 or DORA. The plan is tested at least once a year in an exercise, so that during a real incident nobody reads the document for the first time.
Board reporting
Every quarter management receives a short report: what the security posture is, what has changed, which risks are the biggest and what decisions are needed. The security lead attends the meeting and answers questions. This also satisfies the NIS2 requirement for management involvement.
Audit and questionnaire coordination
The security lead coordinates external audits, customer security questionnaires, and preparation for certification or a regulator’s inspection. They know where all the documents are and answer the auditor on behalf of the company, rather than passing questions to the IT administrator.
Supplier oversight
A list of IT and cloud suppliers is maintained, their risks are assessed and contracts are reviewed to make sure they contain security, incident reporting and audit rights terms.
How to measure the benefit
The benefit of security is hard to measure, because success means that nothing happened. Still, there are concrete indicators that we suggest tracking from the first quarter.
- Risk register status: how many high risks are open, how many were closed during the quarter, whether any risks are without an owner.
- Closing audit findings: how many critical and high findings were fixed within the set deadline.
- Customer questionnaire time: how many days it takes to answer a supplier assessment questionnaire. In our experience this drops from weeks to days, because the answers are already prepared.
- Incident indicators: how many incidents were logged, how quickly they were recognised, whether the reporting deadlines were met.
- Restore tests: how many were performed and whether the set recovery time was reached.
- Training: what share of employees completed training and how the response to simulated phishing e-mails is changing.
These indicators make up the quarterly report to the board. After a year you can say clearly what has changed.
How the service works with your existing IT
The most common question from executives: will the security lead conflict with our IT person or IT provider? The answer is no, as long as the roles are clearly separated.
The security lead decides what must be done and checks whether it was done. The IT administrator or provider does it. If IT is looked after by an external company, the security lead becomes the customer-side representative who formulates security requirements for the provider and checks that they are met. Many IT providers find this convenient: they get clear tasks instead of a vague “make it secure”.
When MDP CLOUD provides IT support, we deliberately keep the security lead function separate from the support team, so that control is not just a formality. When another company looks after IT, we work with them as partners: joint meetings, a shared action plan and a clear division of responsibilities.
Where to start
- Answer the question of who in the company is responsible today for security decisions, not for carrying them out. If the answer is “everyone a little” or “IT”, the security lead function is vacant.
- List the external requirements: customer questionnaires, NIS2 or DORA, planned tenders, certificates. These will determine the scope of the service.
- Start with a risk assessment or an IT security audit: they give you a starting point against which you will measure progress.
- Agree the roles with your existing IT: who decides, who does, who checks.
- Choose the scope of the service: from a few days a month to continuous involvement. You can read more about how this looks in practice on the CISO as a Service page.
Our security leads hold valid ISACA certificates (CISM, CISA, CRISC, CGEIT) and work in line with ISO 27001 requirements. In the first conversation we will tell you honestly whether you need a continuous service or a few one-off projects will do.
