NIS2
Lead programmeGap assessment against Articles 20-23, then the programme that closes them. Management is personally accountable under NIS2; we make sure they can show the work.
Gap assessment · programme · 24h/72h reporting readiness
CISO as a Service
Security leadership that gets executed.
Most vCISOs hand you a roadmap and leave. Ours is backed by the team that runs your security operations, so the strategy lands in your tenant, not in a slide deck.
Backed by the team that runs your SOC
NIS2 and EU-regulation native
A fraction of a full-time hire
Fixed retainer, quarterly review, no lock-in
NIS2 gap assessment
Conditional Access baseline
Incident response plan + tabletop
Vendor risk reviews, top 10
ISO 27001 audit preparation
Reviewed with your leadership · quarterly
Why now
You are probably here because…
Nobody wakes up wanting a vCISO. One of these usually forces the question.
Regulation
A NIS2 or DORA deadline is real now
Management is personally accountable and nobody owns the programme.
Insurance
Your cyber-insurance renewal got harder
The insurer wants a named security leader and documented controls.
Sales
A big customer sent a security questionnaire
Two hundred questions, and no one who can answer them with authority.
Certification
ISO 27001 would win you enterprise deals
You need someone to run the programme, not another PDF checklist.
The board
The board asked for a security update
And there is no one whose job it is to stand up and give one.
Aftermath
An incident rattled leadership
The response worked, but it exposed that nobody sets direction.
What you get
Artifacts, not advice
The fear with any retainer is paying for vague guidance. These are the documents that land on your desk, on a cadence.
Prioritised security roadmap
Where you are, what matters most, and the order of work, costed and sequenced against your real risk.
First 30 days · then livingLive risk register
Risks named, owned, scored, and reviewed. The document auditors and insurers ask for first.
Maintained · monthlyBoard reporting pack
Posture, incidents, spend, and the decisions that need making, in language a board acts on.
Quarterly · presented liveFramework gap assessments
NIS2, ISO 27001, GDPR: where you stand against the requirement, gap by gap, with owners.
Per framework · refreshed yearlyPolicy set that fits you
Policies written for how you actually work, not a 40-document template dump nobody reads.
Core set · then maintainedInsurance readiness report
Your controls mapped against insurer requirements before renewal, with the gaps closed or explained.
Before · each renewal
The first deliverable
This is what a gap assessment looks like here.
Redacted from a real NIS2 engagement: requirement by requirement, status backed by evidence, every gap already turned into a roadmap item.
- Every requirement scored against evidence, not self-assessment
- Gaps become roadmap items with owners and dates
- Written for your auditor and your board at the same time
Art. 20
Governance. Management approval and oversight of cybersecurity risk measures
Partial
Art. 21(2)(a)
Risk analysis. Policies on risk analysis and information system security
Gap
Art. 21(2)(b)
Incident handling. Detection, response, and recovery - operated by xxxxxxxx
Met
Art. 21(2)(d)
Supply chain. Security of supplier and service-provider relationships
Gap
Art. 23
Reporting. 24h early warning and 72h notification readiness
Partial
Gaps prioritised into the Q1 roadmap · owners assigned
The difference
Most vCISO advice dies in a slide deck. Ours has a SOC behind it.
Pure-advisory vCISOs hand over a roadmap and hope someone implements it. Here, the people who wrote the strategy run the operations that deliver it.
Direction
The vCISO decides
Roadmap, risk decisions, policy, and priorities, set by your named security leader against your business context.
Detection
The Sentinel team builds it
Decisions become detection rules, hardening changes, and automation in your workspace, engineered by the same firm. That is Managed Sentinel. Explore Managed Sentinel.
Response
The SOC carries it out
When something fires, the analysts who respond work from the same playbooks the vCISO wrote. That is MDR. Explore MDR.
vCISO works standalone too: if your own team executes, the roadmap is written to be executed by them.
Compliance, EU-first
Native to the regulation you actually face
The vCISO market leads with SOC 2 and HIPAA because it is written for America. Your pressure is NIS2, DORA, and GDPR, and that is where we lead.
DORA
Financial sectorICT risk management, resilience testing coordination, and register-of-information obligations for financial entities and their critical providers.
Gap assessment · programme guidanceISO 27001
Audit prepISMS build-out, Statement of Applicability, internal audit, and evidence discipline, up to the door of the certification audit.
We prepare you · your accredited auditor auditsGDPR
GovernanceSecurity-of-processing obligations, breach-notification readiness, and the technical-measures story your DPO needs from security.
Security measures · Art. 32-34 readinessCyber Essentials
BaselineThe five-control baseline for UK-facing business, mapped onto your Microsoft estate where most controls already exist unconfigured.
Assessment prep · control implementationSOC 2
Selling to the USFor EU firms whose American customers ask for it: scoping, control mapping, and evidence collection alongside your audit partner.
Readiness · auditor liaison
Cyber insurance
The renewal argument your CFO already understands
Insurers now want a named security leader and evidence of a run programme before they issue or renew, and they price the absence. We have taken clients through exactly this: a vCISO often pays for itself at the renewal table.
- A named security leader, which policies increasingly require
- The documented programme underwriters ask to see
- Controls mapped to the insurer’s questionnaire before renewal
- Incident-response readiness that stands up to a claims review
Engagement
Two tiers, honestly scoped
Fixed monthly retainer, so nobody rations questions by the hour. Quarterly review, month to month after a 90-day initial term.
Strategic
Advisory and oversight. Direction, governance, and a steady hand for organisations whose own team carries the day-to-day.
CadenceMonthly working rhythm
BoardQuarterly reporting
What you get
- Prioritised roadmap, built in the first 30 days
- Live risk register, reviewed monthly
- Policy set, written and maintained
- Compliance guidance across your frameworks
- Quarterly board pack, presented live
- Direct line to your named CISO
Fractional
A hands-on security leader with real hours in your business: programme build, audits, questionnaires, and incident leadership.
CadenceWeekly working rhythm
BoardQuarterly, plus ad hoc
What you get
Everything in Strategic, plus:
- Hands-on programme build with your team
- Framework programmes run end to end (NIS2, ISO 27001)
- Customer security questionnaires, answered for you
- Cyber-insurance renewal, prepared and defended
- Incident leadership when something serious happens
- Vendor risk reviews on your critical suppliers
Pairs with MDR: vCISO plus MDR is a complete outsourced security function: leadership, operations, and response from one accountable partner.
Talk it through
Deliberately not included
- ×Penetration testing. Scoped and referred to trusted partners; the vCISO owns the findings and the fixes.
- ×The certification audit itself. We prepare you; an accredited auditor audits. Anything else is a conflict of interest.
- ×Large-scale incident response. Deep forensics and response live with MDR and its DFIR retainer, not the advisory retainer.
- ×Awareness-training delivery. We set the programme and pick the tooling; delivery platforms do the repetition.
The alternative
Compare it with hiring a CISO
For most mid-sized organisations the choice is not vCISO versus full-time. It is vCISO versus nobody owning security at all.
Hire full-time
- A full-time CISO runs €150-250k a year, plus equity and turnover risk
- Three to six months to recruit, if you can attract one at all
- One person’s experience, however good
- Overkill for most 50-500 person organisations
Falconer vCISO
- A fraction of the cost, on a fixed retainer
- A prioritised roadmap inside the first 30 days
- One leader, backed by a SOC, detection engineers, and a platform team
- Scales down or off as you grow into a full-time hire
30days
To a prioritised roadmap
90days
Then month to month
Quarterly
Review, never auto-renew
Proof
The advisory is only as good as the operators behind it. Ours run SOCs for a living.
OSCP
OSWE
CISSP
5.0 on GoodFirms
FAQ
The questions vCISO buyers ask
Who will actually be our CISO, and what is their experience?
A senior security leader with an operator background: offensive security, MSSP operations, and the Microsoft estate. You meet the specific person during scoping, before you sign, and they stay your CISO; there is no bait-and-switch to a junior consultant.
How is this different from a security consultant?
A consultant delivers a report and leaves. A vCISO owns the programme over time: the roadmap, the risk register, board reporting, and the decisions in between. And because Falconer also runs security operations, the recommendations get executed rather than filed.
Do you just advise, or do you implement?
Both, by design. The vCISO sets direction; the Falconer SOC, detection engineers, and platform team implement it through MDR and Managed Sentinel. If your own team executes instead, the roadmap is written for them, with the vCISO reviewing progress.
Can you get us NIS2 or ISO 27001 ready?
Yes. NIS2 starts with a gap assessment against Articles 20-23 and becomes a prioritised programme. For ISO 27001 we build the ISMS and prepare you up to the certification audit, which an accredited external auditor performs. We prepare; we never audit our own work.
Will this satisfy our cyber-insurance requirements?
That is one of the most common reasons clients engage us. We map your controls against the insurer’s questionnaire before renewal, close or document the gaps, and give them the named security leader most policies now expect. We have taken clients through renewals on exactly this basis.
How many hours a month do we get?
The retainer is fixed by tier, Strategic on a monthly working rhythm and Fractional on a weekly one, so you are never rationing questions by the hour. Exact time commitment is agreed at scoping, and reviewed quarterly.
Can the vCISO present to our board?
Yes, and they should. Quarterly board reporting is part of both tiers, presented live by your CISO, not emailed as a PDF.
What is not included?
Penetration testing (scoped and referred to partners), the certification audit itself (a conflict of interest), large-scale incident response and forensics (that is MDR and its DFIR retainer), and awareness-training delivery (we set the programme; a platform delivers it). Honest scope is the point.
How fast until we have a roadmap?
A prioritised, costed roadmap inside the first 30 days. It is the first deliverable, and everything else hangs off it.
Can we start with one framework and expand?
Yes. Many clients start with a single pressure, NIS2 or an insurance renewal, and widen the programme once the first deliverables land. The engagement is month to month after the initial 90 days, so scope follows need.