Security Leadership. Not A £250k Salary.
One named lead owns your cyber security and reports to your board in plain English. From £2,375 a month. Days to start, not months.
Running Isn't The Same As Secure.
Your IT Support
Keeps the systems running: patching, monitoring, filtering, the lights staying on.
Your vCISO
Decides what’s actually worth defending, proves it to your board, and checks whether “running” is good enough.
A vCISO is a senior security lead who works for you part time instead of full time. One named person owns the decisions, backed by the rest of GoodChoice IT for anything that needs more hands. Your Managed IT and Cyber Standard packages already handle monitoring, patching, filtering, keeping the lights on, a vCISO makes sure all of that is actually pointed at your real risks, not just switched on and left running. It owns one thing: security, leadership, compliance, proof, not your whole technology strategy, not infrastructure, not budget. Just the one job, done properly.
Not If. When.
46%
of small UK businesses breached in the last 12 months
If you handle customer data, or you’re chasing a bigger contract, you’re already a target. The only question is whether anyone actually owns it.
A vCISO is something you have for the same reason you have an accountant: not because you’re expecting a crisis, but because you can’t afford to find out too late that you needed one.
Source: DSIT/Home Office Cyber Security Breaches Survey 2025/26, published April 2026 (46% of small businesses, 42% of micro businesses, phishing the dominant attack type). Dave did his own MSc in IT Security years ago, when cyber security was a luxury for a small business. It isn’t any more, it’s become critical to whether a business survives at all.
Built for small and mid-sized businesses, including the UK arm of a bigger group. Two situations come up most: financial services, already being asked to prove your security by a regulator, an insurer, or a parent company’s compliance team, and construction, skilled trades, and green energy, growing fast on solar, heat pumps, and retrofit, where the security side hasn’t caught up and insurers and bigger contractors are starting to ask.
Worth a conversation if two or more of these sound like you:
- Nobody senior owns security decisions
- A customer, insurer, or parent company has asked for Cyber Essentials, ISO 27001, or a completed security questionnaire
- You’ve had an incident, or a near miss that rattled the people above you
- You’re growing fast, moving to cloud tools, or bringing on suppliers faster than you can vet them
- You handle customer, payment, or personal data and know your current setup wouldn’t survive someone asking hard questions about it
A real client, anonymised
Ransomware hit before anyone at the business had taken the risk seriously. There was no named lead, no plan, nobody who owned the decision to act sooner.
Their own IT team called us in to help untangle it. What should have been a controlled recovery turned into several weeks of complex, expensive work, systems rebuilt, evidence gathered, decisions made under pressure that should have been made calmly months earlier.
By the time it was over, the ransomware itself and the recovery together had cost more than £1 million. Almost all of it was avoidable. That’s the real price of leaving cyber risk unowned, not the ransom on its own, but the weeks of disruption and everything spent afterwards fixing what could have been stopped before it started.
One Name. Full Backup.
You get one accountable lead, backed by GoodChoice IT’s whole team and the tooling already running in your business. Not a consultant parachuting in to guess at your systems from the outside.
- ✓A named lead, not a rotating cast
- ✓Straight answers, not a pitch for more spend
- ✓Someone who can represent you to customers, insurers, and auditors
It’s also a plan your board, or head office, can actually fund, risk turned into a roadmap both your technical people and whoever signs the budget can follow, and a route through the certifications that matter to you, not all of them. Baselined against NIST, ISO 27001, SOC 2, Cyber Essentials, Cyber Essentials Plus, and GDPR all overlap with it heavily, Cyber Essentials first for most clients in construction and trades since that’s what gets asked for most, ISO 27001 and SOC 2 only where the work genuinely calls for it.
If you’re already a Managed IT or Cyber Standard client, your vCISO is directing tools that are already running, dark web monitoring, email and DNS filtering, endpoint detection, patch management. The job is pointing all of it at your real risks, not just switching it on and leaving it running.
One Process. Many Standards.
Our Governance, Risk and Compliance Portal maps every cyber standard you need against one evidence base, kept current for your team, your auditors, and your customers.
✓NIST
✓SOC 2
✓Cyber Essentials Plus
✓GDPR
✓Data Protection Act
✓NCSC CAF
✓FCA Requirements
✓DORA
✓NIS2
✓EU AI Act
That leaves us free to focus on your real business risks, not paperwork you’ve already done once.
Most businesses end up juggling more than one standard without ever choosing to. A customer asks for Cyber Essentials, a bigger customer asks for ISO 27001, a parent company asks for something else again. Handled badly, that’s the same evidence rebuilt three times, for three auditors, each time from a blank page. We map your controls against NIST, ISO 27001, SOC 2, Cyber Essentials, GDPR, the NCSC’s Cyber Assessment Framework, and, where EU rules touch you, DORA, NIS2, or the relevant parts of the EU AI Act, all at once.
A construction subcontractor holds Cyber Essentials Plus for a public-sector job, then a private developer on the next site asks for ISO 27001, same evidence, reformatted for a different reader. A UK financial services subsidiary of an EU group already holds Cyber Essentials, then its parent asks it to align with DORA, the overlap saves months, not just some paperwork.
The Portal handles the other direction too: when a customer, insurer, or supply-chain partner sends over their own security questionnaire, you’re not re-answering the same forty questions every time. We use AI on top of it to draft answers straight from the evidence already gathered on your business, you review and send.
This used to be out of reach for a smaller business. Governance portals like this one have historically cost thousands of pounds a month in tooling alone, before anyone’s time gets added. That’s not true any more, and it’s a real part of why this is affordable at the smaller end of GoodChoice IT’s client base.
Start This Week. Not Next Quarter.
The first call is free, you’ll have a plan within days, and there’s no six-month recruitment process to sit through. Step one costs nothing.
1. A Conversation First
A free call about your business, not a sales pitch. Nothing to sign, nothing to prepare.
2. We Scope It
Your size, sector, and exactly what’s driving the need, a customer request, an insurer, a contract.
3. We Find Out Where You Stand
A plain-English review of your current setup against what your customers, insurers, or parent company actually expect.
4. A Roadmap, Straight Away
A written roadmap. The easy wins start immediately, not after a formal project kicks off.
5. Ongoing Leadership
Regular reporting to your board, chairing security discussions, answering supplier and customer questions as they land.
6. It Flexes
More of Dave’s time around an audit, an incident, or a big contract. Less when things are quiet, so you’re not paying for attention you don’t need.
Worth knowing: the work is front-loaded. Building the baseline takes real time up front, then it settles into the rhythm above.
An Investment. Not Just An Expense.
Most businesses appoint a vCISO for two reasons: they don’t understand the risk themselves, and their customers now require proof of compliance to do business with them. Done right, that spend does more than protect you, it wins you the contracts that standards-holders won’t award otherwise.
A vCISO’s real job is making sure your board actually understands the risk and how it’s being managed, so the business can move forward with confidence, not just tick a compliance box. That distinction matters: a lot of businesses barely scrape through their certification because they’re chasing what the standard demands on paper, rather than what’s actually best for the business. Treated as an investment instead of a cost, the same spend does both jobs at once: it wins the contracts that require cyber standards, and it means the changes with the biggest impact get made first, the ones that most reduce the chance of a cyber incident actually damaging the business, not just the ones a checklist happens to list first.
Pay For The Risk You Actually Have.
£2,375–£4,995/mo
scoped to your business in the first conversation
Every engagement is scoped to your business on that first call, not sold off a rate card.
What decides where you land:
- How much active work is needed, versus advisory-only oversight. A credible answer when someone asks sits at the lighter end. Driving a certification through to completion sits at the heavier end.
- Size and complexity. More staff, more systems, more suppliers touching your data.
- What’s actually being asked of you. A Cyber Essentials renewal is a different job to a parent company demanding DORA alignment.
- Where you’re starting from. Nothing written down needs building. Already organised needs stewardship.
Lighter end (from £2,375/month, £28,500/year): a named lead, advice on tap, someone who can represent your security position when a customer, insurer, or parent company asks. Heavier end (up to £4,995/month, £59,940/year): the same named lead, plus active work driving a certification, chairing risk reviews, formal board or head-office reporting.
Under five staff, a named vCISO might not be the right shape at all. GoodChoice IT’s Managed Cyber service on its own is often the better fit, the tooling and monitoring layer without a leadership retainer on top. The named-lead model earns its keep once there’s a board, insurer, or parent company that wants to hear from a specific accountable person regularly. Smaller SaaS and software businesses tend to want a named lead sooner than their size alone suggests, their own customers and investors ask for it directly, a construction or trades business the same size is usually fine on Managed Cyber until a specific contract or insurer forces the question.
Fixed pieces of work outside a retainer, a Cyber Essentials assessment and remediation project, say, are quoted up front, not billed by the hour. See vCISO vs. hiring your own for the cost against employing someone full time.
A Quarter Of The Cost. All Of The Leadership.
£255,000
full-time CISO, fully loaded, per year
£28,500–£59,940
GoodChoice IT vCISO, per year
Technical enough to fix what he finds, instead of billing you twice for it.
The cost. A London CISO’s salary alone runs £131,000 to £220,000, median £184,000 (Robert Half 2026 Salary Guide, London, checked against the primary source 2026-09-08). Add employer National Insurance, pension, and the usual overheads, and the fully loaded cost lands around £255,000 a year. Time to start: three to six months of recruitment, if you find the right person at all, versus days from a first conversation.
No handover tax. A lot of vCISOs are governance specialists, they’ll tell you what’s wrong, then you still pay a separate technical team to fix it. Dave’s background is hands-on infrastructure and Microsoft 365, not governance-only, so a good chunk of what gets found gets fixed by the same person who found it. One invoice, not two.
Coverage and independence. A single employee has holidays, sick days, and eventually hands in their notice, taking institutional knowledge with them, a team-backed engagement doesn’t stop because one person is off. An employee reports to you, which over time can soften the harder calls, outside leadership finds it easier to be blunt when the answer is uncomfortable.
Where a full-time hire genuinely wins: they’re in the building every day, embedded in every conversation as it happens, not just the ones escalated to them. For a business big enough to keep that person properly busy, that’s worth paying for. See When this isn’t the right fit.
Fixes It. Doesn't Just Flag It.
Dave Lane leads this personally. His background is hands-on infrastructure and Microsoft 365, not governance paperwork, and he never takes on more than 3-5 clients at once.
Most vCISO providers are a security consultancy that’s bolted a leadership product on top. GoodChoice IT is the other way round: an MSP that’s run the operational side of IT for SME clients since 2006, with the vCISO role sitting on top of infrastructure the team already knows. A lot of vCISO providers can tell you what’s wrong and then hand you a list for someone else to go and fix. Dave can often just fix it himself.
Dave works with 3-5 client companies at a time, deliberately, onboarding one at a time rather than batching clients in. That’s what makes it possible to be honest about the edges of it too: broad knowledge of cyber, IT, and business doesn’t make him the best person for every single problem, and other consultants get pulled in when a piece of work genuinely needs them, not by default.
That honesty is the actual difference. Plenty of governance work in this industry produces a certificate and a file of evidence without making a business any harder to breach. This isn’t that.
Dave Lane
Named vCISO
BSc Physics, MSc IT Security, PRINCE2, 25+ years in IT cyber management
Honest, Even When It Costs Us.
Not a fit if…
A regulator or a specific contract requires a permanently employed CISO, by name. That’s an employment-status requirement, not a quality one.
Not a fit if…
Your business needs someone’s full, dedicated attention. Dave works with 3-5 businesses at a time by design, so there’s a real ceiling on how much of his attention any one client can buy.
Neither of those is about size on its own. Most businesses buying a fraction of a CISO are perfectly capable of buying a bigger fraction as they grow, that’s the whole point of the model. A few clients read this and realise the opposite is true for them, then use us as a bridge while they recruit for exactly the role above. That’s a legitimate reason to talk to us as well.
Straight Answers.
The questions buyers actually ask, answered directly.
Are we legally required to have a security lead?
Will we get the same person every time?
Yes. One named lead, backed by the rest of the team when something needs more depth.
Does engaging you create an IR35 problem for us?
Unlikely, and for a lot of our clients the question doesn’t even arise. You’re contracting with GoodChoice IT Ltd, a company that’s been trading since 2006, not employing an individual directly. It works with 3-5 client businesses at a time, using its own equipment and systems and delivering a defined scope of work, the kind of arrangement HMRC’s own tests point towards as a genuine business-to-business service, not disguised employment.
If your business qualifies as “small” under the Companies Act (from 6 April 2026: turnover under £15 million, balance sheet under £7.5 million, or 50 employees or fewer, meeting any two of the three), the off-payroll working rules’ client-determination duty doesn’t apply to you at all, GoodChoice IT is responsible for its own status, not you. If your business doesn’t qualify as small, the responsibility for determining status sits with you as the client. We’ll give you whatever you need to make that call, the contract terms, the multi-client working pattern, but the determination itself is between you and your own adviser, not us.
If your own compliance team decides this engagement needs to run through payroll, that’s fine, we can work that way too. Whether you need to is your call to make, with your own adviser, not something we’ll tell you either way.
We're already certified against one standard, why would a second one cost as much as the first?
It shouldn’t, and with us it doesn’t. See One evidence base, the controls behind Cyber Essentials, ISO 27001, SOC 2, and GDPR overlap far more than the certificates suggest.
Do you work outside the UK?
Yes. UK, EMEA, USA, and beyond, remote-first with on-site visits where they’re useful.
Is this the same as a Fractional CISO or CISO as a Service?
Different label, same idea. Compare providers on who the named person is, not the label.
How does this actually compare to hiring someone full time?
Roughly a quarter to a ninth of the fully loaded cost, and you start in days, not months. Full comparison: vCISO vs. hiring your own.
Our parent company already has its own security team, why would we need this too?
Group policy rarely covers UK-specific obligations like FCA rules or UK GDPR in the day-to-day detail a UK regulator will actually ask about. This is local ownership for what group security doesn’t have time to run itself.
How quickly can we start?
Days from a first conversation, not the three to six months a full-time hire usually takes.
No Hard Sell. Just A Straight Answer.
A short conversation. You’ll get a recommendation, not a sale.
What happens next:
- We reply within one working day, usually sooner.
- A free 45-minute conversation, at a time that suits you.
- A clear recommendation, and a firm price if a vCISO actually fits. Not a sale either way.
If a vCISO isn’t what your business needs right now, you’ll hear that plainly. Prefer to call? 020 8099 5540, UK office hours.