You Think You Need a CISO. You Probably Need a CSO.
A CISO covers cybersecurity. A CSO covers all thirteen risk domains — physical, cyber, information, fraud, brand, supply chain, workplace violence, business continuity, and more. For most mid-market businesses, the real gap is at the CSO level. They just call it "CISO" because that's the term they've heard.
$2,500–$7,500/month · same price band as vCISO
The reframe
The vCSO Role. The ESRM Program.
A virtual Chief Security Officer (vCSO) owns the whole risk surface — not just the cyber slice. The discipline they run is called Enterprise Security Risk Management (ESRM): thirteen domains, one program, one quarterly board report.
Most mid-market organizations have a CISO for cyber, a facilities lead for physical, an HR partner for workplace violence, a CFO worried about fraud — and nobody owning the whole picture. The vCSO closes that gap.
Thirteen Domains. Four Working Clusters.
ESRM covers thirteen distinct risk domains. We organize them into four working clusters so the program stays operable — not a thirteen-headed monster.
People
3 domainsRisks to the humans in your organization.
- Workplace Violence PreventionPre-incident risk identification, threat assessment, response protocols, post-incident support.
- Travel RiskPre-trip briefings, in-transit support, executive protection where the risk warrants it.
- Threat ManagementProactive identification of credible threats to executives, facilities, and information. Escalation procedures.
Assets
4 domainsProtecting what the business is built on.
- Physical SecurityPerimeter design, access control, surveillance, intrusion detection, on-site response protocols.
- CybersecurityNetwork, endpoint, identity, detection and response. The vCISO scope, embedded in the wider ESRM program.
- Information SecurityConfidentiality, integrity, availability. Data classification, handling, retention, disposal.
- Brand ProtectionReputation monitoring, IP enforcement, executive social media risk, counterfeit and impersonation response.
Operations
4 domainsKeeping the business running through disruption.
- Organizational ResilienceAnticipate disruptions. Withstand them. Recover faster than competitors do.
- Business ContinuityDocumented plans for maintaining critical operations during and after disruptive events. Tested at quarterly cadence.
- Crisis ManagementPrepare. Respond. Recover. Communications for media, regulators, customers, employees.
- Supply Chain SecurityVendor risk assessment, third-party access governance, dependency mapping, resilience planning.
Financial
2 domainsPreventing financial loss and fraud.
- Loss PreventionMitigate theft, shrinkage, and accident-driven loss across the physical and operational footprint.
- Fraud Risk MitigationPrevent, detect, respond to fraudulent activity — internal and external.
How We Run an ESRM Program.
A five-step lifecycle, run continuously. Every quarter the program advances; every year the whole cycle gets reviewed at the board level.
Risk Assessment
Map every asset. Identify threats and vulnerabilities across all thirteen domains. Prioritize by likelihood and consequence.
Mitigation Strategy
Design the policies, controls, and resource plans. Allocate responsibility. Train the people who will execute them.
Monitor & Review
Measure what was mitigated. Audit at regular cadence. Adjust as the threat landscape changes.
Security Culture
A program nobody owns is paperwork. We build shared responsibility, open reporting, and ongoing education.
Stakeholder Alignment
Brief the board. Coordinate with IT, HR, Legal. Share intelligence with peers and authorities where appropriate.
How It Runs as a Subscription.
ESRM isn’t a project. It’s a continuous subscription with quarterly milestones and an annual board-level review. Same engagement model and pricing band as vCISO.
Q1
Assess
Comprehensive risk assessment across all thirteen domains. Risk register stood up. Day-30 baseline briefing.
Q2
Build
Policies and controls designed and ratified. Top-priority gaps remediated. Training programs launched.
Q3+
Operate
Continuous monitoring, audit, and refinement. Quarterly board reports. Year-one program review.
Ongoing
Culture & Stakeholders
Security culture work, board briefings, IT/HR/Legal coordination, and peer/agency intelligence sharing run in parallel.
Subscribe to the program. Cancel with 30 days’ notice. No multi-year lock-ins.
Licensed. Credentialed. Run by Operators Who've Held the Title.
Most vCISO firms are pure-play cybersecurity consultants. They can’t legally execute physical security, executive protection, or investigations work. We can. Texas DPS-licensed, ASIS-credentialed, run by an executive who’s held the title.
Texas DPS Licensing
Licensed Private Security & Investigations
Regulated by the Texas Department of Public Safety under Occupations Code Chapter 1702. Class C and Class F licenses cover investigations and security services contractor work.
CSO-Level Credentials
CPP, CISSP, CISM — All Three
The CPP (Certified Protection Professional, ASIS) is the CSO baseline credential and the foundation of ESRM practice. Paired with CISSP and CISM for cyber and information security depth, plus an MS in Security Management.
Run all thirteen domains as one program.
A 30-minute Risk Discussion. No deck. No sales pitch. We’ll tell you whether ESRM, vCISO, or something else is the right fit.
Schedule a Risk Discussion →