You Think You Need a CISO. You Probably Need a CSO.
A CISO covers cybersecurity. A CSO covers all thirteen risk domains — physical, cyber, information, fraud, brand, supply chain, workplace violence, business continuity, and more. For most mid-market businesses, the real gap is at the CSO level. They just call it "CISO" because that's the term they've heard.
$2,500–$7,500/month · same price band as vCISO
The reframe
The vCSO Role. The ESRM Program.
A virtual Chief Security Officer (vCSO) owns the whole risk surface — not just the cyber slice. The discipline they run is called Enterprise Security Risk Management (ESRM): thirteen domains, one program, one quarterly board report.
Most mid-market organizations have a CISO for cyber, a facilities lead for physical, an HR partner for workplace violence, a CFO worried about fraud — and nobody owning the whole picture. The vCSO closes that gap.
Thirteen Domains. Four Working Clusters.
ESRM covers thirteen distinct risk domains. We organize them into four working clusters so the program stays operable — not a thirteen-headed monster. Any domain can be your starting point: a $2,500 fixed-fee assessment, credited in full toward the program if you continue within 90 days.
People
3 domainsRisks to the humans in your organization.
- Workplace Violence Prevention Pre-incident risk identification, threat assessment, response protocols, post-incident support.
- Travel Risk Pre-trip briefings, in-transit support, executive protection where the risk warrants it.
- Threat Management Proactive identification of credible threats to executives, facilities, and information. Escalation procedures.
Assets
4 domainsProtecting what the business is built on.
- Physical Security Perimeter design, access control, surveillance, intrusion detection, on-site response protocols.
- Cybersecurity Network, endpoint, identity, detection and response. The vCISO scope, embedded in the wider ESRM program.
- Information Security Confidentiality, integrity, availability. Data classification, handling, retention, disposal.
- Brand Protection Reputation monitoring, IP enforcement, executive social media risk, counterfeit and impersonation response.
Operations
4 domainsKeeping the business running through disruption.
- Organizational Resilience Anticipate disruptions. Withstand them. Recover faster than competitors do.
- Business Continuity Documented plans for maintaining critical operations during and after disruptive events. Tested at quarterly cadence.
- Crisis Management Prepare. Respond. Recover. Communications for media, regulators, customers, employees.
- Supply Chain Security Vendor risk assessment, third-party access governance, dependency mapping, resilience planning.
Financial
2 domainsPreventing financial loss and fraud.
How We Run an ESRM Program.
A five-step lifecycle, run continuously. Every quarter the program advances; every year the whole cycle gets reviewed at the board level.
Risk Assessment
Map every asset. Identify threats and vulnerabilities across all thirteen domains. Prioritize by likelihood and consequence.
Mitigation Strategy
Design the policies, controls, and resource plans. Allocate responsibility. Train the people who will execute them.
Monitor & Review
Measure what was mitigated. Audit at regular cadence. Adjust as the threat landscape changes.
Security Culture
A program nobody owns is paperwork. We build shared responsibility, open reporting, and ongoing education.
Stakeholder Alignment
Brief the board. Coordinate with IT, HR, Legal. Share intelligence with peers and authorities where appropriate.
How It Runs as a Subscription.
ESRM isn’t a project. It’s a continuous subscription with quarterly milestones and an annual board-level review. Same engagement model and pricing band as vCISO.
Q1
Assess
Comprehensive risk assessment across all thirteen domains. Risk register stood up. Day-30 baseline briefing.
Q2
Build
Policies and controls designed and ratified. Top-priority gaps remediated. Training programs launched.
Q3+
Operate
Continuous monitoring, audit, and refinement. Quarterly board reports. Year-one program review.
Ongoing
Culture & Stakeholders
Security culture work, board briefings, IT/HR/Legal coordination, and peer/agency intelligence sharing run in parallel.
Subscribe to the program. Cancel with 30 days’ notice. No multi-year lock-ins.
Licensed. Credentialed. Run by Operators Who've Held the Title.
Most vCISO firms are pure-play cybersecurity consultants. They can’t legally execute physical security, executive protection, or investigations work. We can. Texas DPS-licensed, ASIS-credentialed, run by an executive who’s held the title.
Texas DPS Licensing
Licensed Private Security & Investigations
Regulated by the Texas Department of Public Safety under Occupations Code Chapter 1702. Class C and Class F licenses cover investigations and security services contractor work.
CSO-Level Credentials
CPP, CISSP, CISM — All Three
The CPP (Certified Protection Professional, ASIS) is the CSO baseline credential and the foundation of ESRM practice. Paired with CISSP and CISM for cyber and information security depth, plus an MS in Security Management.
Run all thirteen domains as one program.
A 30-minute Risk Discussion. No deck. No sales pitch. We’ll tell you whether ESRM, vCISO, or something else is the right fit.
Schedule a Risk Discussion →