Virtual CISO solution:
MDP CLOUD vCISO is an experienced chief information security officer (CISO) on demand: risk management, policies, control implementation, training and reporting to management, tailored to NIS2, DORA and ISO 27001 requirements.
Built for ISO 27001NIS2 DORA
- Strategic security
- Compliance
- Practical controls
Who is this service for?
Strategic security
Compliance
Practical controls
What you get
Strategy and roadmap
Risk management
Policy set
Quick wins
Incident management
Compliance map
Employee training
Reporting to management
CISO pricing
| Plan | Who it suits | What is included | Indicative price |
|---|---|---|---|
vCISO Starter | up to ~50 employees, no strict regulation | 90-day roadmap, risk register, set of 8–10 policies, baseline M365/Entra/Intune hardening, monthly report | from €790 per month + onboarding from €1,200 |
vCISO Growth | 50–200 employees, multiple vendors, SaaS, GDPR risks | Everything in Starter + vendor management, phishing and training, quarterly board report, tabletop exercise once per quarter | from €1,490 per month + onboarding from €1,900 |
vCISO Regulated (DORA/NIS2) | Finance, critical infrastructure, high requirements | Everything in Growth + DORA/NIS2 map, ISMS structure (ISO 27001), exercises twice per quarter, audit evidence package | from €2,490 per month + onboarding from €3,500 |
Frequently asked questions about CISO
What is the difference between a CISO and a vCISO?
A vCISO is the CISO function delivered as a service. You get the same strategic value without the cost of a full-time hire.
Is a vCISO suitable for regulated companies?
Yes. We have DORA/NIS2 experience and provide an evidence package for audits.
Do you handle only documents, or the technology as well?
Both. From policies and contractual controls to hardening of M365, EDR and backup.
Is there a minimum commitment period?
We recommend 6–12 months so that you see the full cycle (risks → controls → KPIs).
Can we use our own tools?
Yes, we work with your EDR, SIEM, ITSM and so on, as long as the KPIs can be met.
How does reporting work?
A monthly summary plus a quarterly board report with risks, KPIs and decision recommendations.
Do you provide 24/7 response?
Yes, as an add-on (incident on-call and escalation under an SLA).
How much will it cost in our case?
We will give you a specific quote after a few short questions and an architecture review.
Related services
DORA implementation from A to Z
We will help you implement DORA, from policies to deploying security solutions.
NIS2 implementation from A to Z
We will help you implement NIS2, from policies to deploying security solutions.
Expertise confirmed by certifications
Your external security manager holds the CISM certification, the same one required of security managers in banks and large companies.
-
Certified Information Security Manager
Security governance, policies and incident processes following the ISACA methodology.
-
Certified in Risk and Information Systems Control
Risks are assessed and controlled using the international IT risk methodology.
-
ISO/IEC 27001 Lead Implementer
The service is delivered in line with the requirements of an ISO/IEC 27001 management system.
Get a personal vCISO quote
We reply within 1 business day