vCISO — external CISO and designated cybersecurity officer
For companies that need CISO expertise but don't want to hire full-time. We take on security strategy, risk management, compliance oversight (NIS2/DORA/ISO) and board reporting — on a fixed monthly subscription. Optional in-house SOC (24/7 monitoring) available.
What is a vCISO?
Virtual Chief Information Security Officer (vCISO) is an external information security expert who acts as a CISO for your company without the need for full-time employment. They provide strategic security management, regulatory compliance oversight and board reporting.
What's included in RedMoon Security vCISO
Security strategy
Creation and updating of an information security strategy tailored to your business.
Risk management
Risk register, threat assessment, risk treatment plan — updated continuously.
Compliance oversight
NIS2, DORA, ISO 27001, PCI-DSS — we ensure compliance with regulations affecting your company.
Board reporting
Regular security posture reports in a format understood by the board and supervisory board.
SOC (optional)
24/7 security monitoring with our own Security Operations Center — as a vCISO service extension.
Incident support
Readiness to respond to security incidents — coordination, analysis, reporting and remediation plan.
An external cybersecurity officer under the KSC Act
The amended National Cybersecurity System Act (KSC, the Polish implementation of NIS2, in force since 3 April 2026) makes the head of an essential or important entity responsible for meeting the cybersecurity obligations. The head may entrust these obligations to another person. In Polish practice this person is often called a cybersecurity officer (pełnomocnik ds. cyberbezpieczeństwa), although the Act itself does not use that term.
Responsibility of the head of the entity
The head of the entity is responsible for meeting the obligations. Where the company is run by a collective management board and no responsible person has been designated, all of its members are.
Entrusting the obligations
The head may entrust some or all of the obligations to another person with their consent, but remains responsible for them.
Annual training
The head of the entity and the person entrusted with the head's cybersecurity duties complete training once every calendar year. Participation must be documented.
Contact persons
The entity designates at least two people for contacts with the entities of the national cybersecurity system (at least one in a micro or small enterprise). The head of the entity can be fined for failing to do so.
The fine for the head of the entity can reach 300% of their remuneration. As a rule, fines can be imposed once 2 years have passed since the amendment entered into force, i.e. from April 2028.
How RedMoon vCISO helps
- ✓We act as your external cybersecurity officer or support the person designated within your company.
- ✓We prepare proposals for the head of the entity's decisions on the ISMS and the allocation of tasks, then oversee their implementation.
- ✓We regularly report to the board on the state of security and compliance with the Act.
- ✓We keep track of deadlines: annual management training, audits for essential entities and documentation reviews.
- ✓We support incident handling and, with the optional SOC, provide 24/7 monitoring.
A vCISO does not take over the responsibility of the head of the entity. It gives them the expertise, process and documentation they need to fulfil it.
Not sure whether your company falls under the Act? See the NIS2/KSC applicability opinion
How we work together
Onboarding and review
We get to know your organisation, review its security and compliance posture, and agree on priorities and the split of responsibilities on both sides.
Action plan
Based on the review, we prepare a risk register and an action plan for the board to approve.
Monthly cadence
As part of the subscription, we carry out the tasks in the plan, keep the risk register up to date and oversee regulatory compliance.
Board reporting
We regularly report on the state of security in a format the board and supervisory board understand, with recommendations for next steps.
vCISO vs full-time CISO
| Criterion | Full-time CISO | RedMoon vCISO |
|---|---|---|
| Monthly cost | 25,000–40,000 PLN | from 3,000 PLN |
| Availability | After recruitment period | From 1 month |
| Experience | One person | Team of experts |
| Regulatory knowledge | Depends on person | NIS2/DORA/ISO/PCI-DSS |
| SOC / operations | Requires separate team | Option in package |
| Turnover risk | High | None |