# What Does a Virtual CISO Do? A Guide for Saudi Organisations By CYBRT Advisory Team 30 September 2026 4 min read On this page 1. What a virtual CISO delivers 2. Who benefits most 3. How it fits national requirements 4. A good first 90 days 5. Choosing a virtual CISO 6. Engagement models 7. Measuring success Not every organisation needs, or can find, a full-time chief information security officer with twenty years of experience. Most still need the decisions that person would make. A virtual CISO, sometimes called CISO as a Service, gives an organisation access to senior security leadership on a part-time or flexible basis. Instead of hiring one executive, you engage an experienced practitioner, usually backed by a wider team, for a set number of days each month or for a defined programme of work. It is a model that suits many organisations in the Kingdom right now. Regulatory expectations are rising, experienced security leaders are in high demand, and boards want clear answers about cyber risk. Here is what a virtual CISO does, when it makes sense, and how to get value from the arrangement. ## What a virtual CISO delivers - **Strategy and roadmap:** a security strategy tied to business goals, with a prioritised plan your team can actually execute. - **Governance:** policies, roles, a risk management approach and the committee structures that keep decisions moving. - **Regulatory compliance:** interpreting NCA, SAMA and PDPL requirements for your organisation and steering the work to meet them. - **Board and executive reporting:** turning technical issues into risk, cost and priority that leadership can act on. - **Incident leadership:** experienced judgement when something goes wrong, including escalation, communication and decisions under pressure. - **Technology decisions:** independent advice on what to buy, what to retire and how to evaluate vendors, without a reseller's incentives. - **Team development:** mentoring your in-house security staff and building their capability over time. ## Who benefits most - **Growing organisations** that have outgrown having IT handle security on the side, but are not yet ready for a full security leadership team. - **Organisations between CISOs** that need continuity while they recruit. - **Newly regulated organisations** facing NCA or SAMA requirements for the first time and needing to build a programme quickly. - **Organisations going through change,** such as a merger, acquisition, major cloud migration or restructuring, where security decisions come thick and fast. - **In-house security leads** who would benefit from a senior adviser alongside them. ## How it fits national requirements It is important to be precise here. For organisations within the scope of the NCA Essential Cybersecurity Controls, the head of the cybersecurity function and other critical cybersecurity roles are expected to be held by full-time, qualified Saudi professionals. SAMA expects its member organisations to have a CISO within an independent cyber security function. In these cases, a virtual CISO does not replace the in-house role. It supports it. Many regulated organisations appoint a capable Saudi head of cybersecurity who is earlier in their career, and engage a virtual CISO to provide senior guidance, structure the programme, prepare for assessments and mentor the in-house lead into the role. For organisations outside these scopes, a virtual CISO can serve as the security leader directly. ## A good first 90 days 1. **Days 1 to 30, understand:** interview leadership and key teams, review existing policies, architecture and incidents, and assess the current state against the frameworks that apply to you. Identify quick wins. 2. **Days 31 to 60, decide:** build a risk register with owners, agree risk appetite with leadership, and produce a prioritised roadmap with costs and timelines. Close the most urgent gaps. 3. **Days 61 to 90, establish rhythm:** stand up the governance routine, including a security committee and monthly reporting, approve core policies, and start delivering the roadmap with clear owners. By the end of the first quarter, leadership should be able to answer three questions: what our biggest cyber risks are, what we are doing about them, and how we will know it is working. ## Choosing a virtual CISO Look for: - Experience leading security programmes, not only auditing or consulting on them. - Knowledge of the regulators that matter to you, including NCA, SAMA and SDAIA. - A team behind the individual, so you can draw on testing, operations, cloud or GRC expertise when needed. - Independence from product sales, so advice on technology is impartial. - Clear commitments on availability, especially during incidents. ## Engagement models Most engagements are structured as a set number of days per month, sometimes with additional days available for incidents or assessments. Others are scoped around a programme, such as reaching SAMA CSF Level 3 or preparing for an NCA assessment, with a defined end point and handover. Either way, agree the deliverables, reporting rhythm and success measures at the start. ## Measuring success A virtual CISO engagement is working when the roadmap is moving, risks are falling, audit and assessment findings are being closed, the board is receiving reporting it understands, and your own team is becoming more capable. If the main output is a stack of documents, something has gone wrong. If you are weighing whether CISO as a Service fits your organisation, our team is happy to talk it through. Question two of our [free maturity assessment](https://cybrt.sa/maturity/) asks who is responsible for cybersecurity today, and it is a good place to start the conversation. How CYBRT can help ## CISO as a Service Experienced CISO leadership when you need it: to structure your security programme, meet SAMA and NCA requirements, steer incidents and guide big decisions. ## Keep reading Governance 20 Jul 2026 3 min read ### Do You Perform Third Party Risk Management? (The EY Breach) What the EY breach of a third-party IT platform teaches about vendor risk, and how to build third-party risk management that works. Governance 27 May 2026 4 min read ### Security Awareness Training That Actually Changes Behaviour Why annual awareness slideshows fail, and how short role-based training, phishing simulations and the right metrics change behaviour. Resilience 18 Oct 2026 7 min read ### Ransomware Response Plan for Saudi Organizations: The First 72 Hours A practical ransomware response plan for Saudi organisations: what to do in the first hour, day and 72 hours, including NCA reporting and PDPL notice. ## Ready to protect your business? Book your free security consultation today. --- Canonical page: https://cybrt.sa/what-does-a-virtual-ciso-do/ Guide for AI agents: https://cybrt.sa/llms.txt