Fractional AI Governance Lead
From £4,250 per month, plus VAT
VIRTUAL CISO
A named security lead, without hiring a CISO
For companies of around 10 to 250 people that need someone accountable for security: the board report, the policies, the incident plan and the answers to customer security questions. Delivered as our Security & Governance package, so the security lead comes with the controls, monitoring and evidence behind them.
From £1,495 a month + £9 per user, plus VAT, 12-month termCompanies of around 50 to 250 people: from £3,250 a month + £7.50 per user, plus VAT.
THE ROLE
What your vCISO does
- Named security lead
- Monthly leadership meeting and board report
- Ownership of security policies
- Annual incident exercise
- Supplier security reviews
- Central log collection where the audit requires it, scoped on the proposal
Built on everything in Secure Compliance and Evidence Essentials
- 24/7 managed detection and response on every Windows, Mac and Linux laptop, desktop and server
- Threats contained and the device isolated, with clean-up steps and an incident report
- Ransomware tripwires on every device
- Managed Microsoft Defender antivirus on Windows devices
- 24/7 account protection for Microsoft 365 or Google Workspace, covering suspicious sign-ins, stolen passwords, hijacked sessions, rogue apps, hidden inbox rules and phishing sent from a compromised account
- Every account alert checked by a person, with the steps to close it carried out with your admin
- Formal risk acceptance
- Quarterly trend report
- We run your compliance platform, or our UK-hosted GRC workspace at no extra subscription
- Evidence calendar
- Quarterly risk review
- Access and supplier reviews
- Internal audit by an independent auditor appointed by Goldline
- Certification body liaison
- Help with customer security questionnaires
- Monthly report
- Managed security awareness training: story-based episodes, phishing tests, just-in-time coaching, and reporting ready for your auditor and insurer
- Two hours of practitioner time a month
FIT
Who it is for
- Companies that hold or are working towards ISO 27001, Cyber Essentials, SOC 2 readiness or DCC and have no security lead.
- Companies whose customers or board now ask who owns security.
Who it is not for
- Organisations needing a full-time, on-site CISO or a 24/7 incident response retainer.
INDEPENDENCE
How we stay independent
- The person who builds a control never audits it alone.
- Testing is done by a separate firm.
- Decisions to accept a risk are always yours.
- Goldline does not certify; an accredited certification body does.
Also need AI covered?
FAQ
Common questions
Is the vCISO a named person?
Yes, one named security lead, not a rota.
How much time do we get?
Set on the scope check against what the role needs to own.
Can we keep our current IT provider?
Yes; we work alongside them.
What happens if there is an incident?
A threat is contained on the device and handed over; investigation and recovery are a separate engagement, as on the packages page.