Do We Need a vCISO, vGRC, Cyber GRC Consultant or Full-Time Hire?

If an organization knows it needs more cybersecurity or GRC expertise but is not sure whether to hire a full-time employee, engage a vCISO or vGRC, bring in a consultant, or outsource part of the work, start with the problem rather than the job title.

Different models solve different problems.

A company may need strategic cybersecurity leadership. It may need someone to design and operate a Cyber GRC program. It may need specialized expertise for a framework, remediation effort or GRC technology initiative. It may simply have more work than the existing team can perform. In many cases, it needs a combination of these capabilities.

Hotman Group helps organizations determine what cybersecurity and Cyber GRC expertise and capacity they actually need, then provides or supports the appropriate mix of leadership, specialized expertise, implementation and ongoing program support.

What Is the Difference Between a vCISO, vGRC, Cyber GRC Consultant and Full-Time Hire?

The differences are primarily about responsibility, expertise, capacity, duration and the problem being solved.

A vCISO typically provides experienced cybersecurity leadership on a fractional or external basis. The role may include cybersecurity strategy, governance, risk management, leadership reporting, program oversight and helping executives make cybersecurity decisions.

A vGRC typically focuses more deeply on governance, risk and compliance. That can include Cyber GRC strategy, frameworks, controls, risk management, policies, evidence, assessments, audit readiness, GRC technology and ongoing program operations.

A Cyber GRC consultant is often brought in to solve a defined problem, provide specialized expertise, design or implement a program, remediate gaps, support technology decisions, or help with a major initiative.

A full-time hire becomes part of the internal organization and may be appropriate when the company has enough sustained work, responsibility and budget to justify a permanent position.

These models are not mutually exclusive. An organization may have an internal CISO and use external GRC expertise, or have an internal GRC leader who brings in specialized consultants for a significant initiative.

Should We Start by Deciding Which Role We Need?

No.

Start by identifying the work that needs to be performed.

Questions to ask include:

Do we need executive cybersecurity leadership?
Do we need someone to build or redesign the cybersecurity strategy?
Do we need a Cyber GRC operating model?
Do we need help with risk management?
Do we need to implement a cybersecurity framework?
Do we need to remediate assessment or audit findings?
Do we need someone to operate ongoing GRC processes?
Do we need GRC technology expertise?
Do we need help managing several frameworks?
Are we missing expertise, capacity or both?
Is this a permanent organizational need or a temporary initiative?
Does the work require one person or several different skill sets?

Once the work is understood, the appropriate sourcing model becomes much easier to determine.

When Does an Organization Need a vCISO?

A vCISO can make sense when an organization needs experienced cybersecurity leadership but does not need, cannot justify or is not ready for a full-time CISO.

Common situations include:

Cybersecurity responsibilities have grown beyond what IT leadership should manage alone.
Executives or the board need experienced cybersecurity guidance.
The organization needs a cybersecurity strategy.
Leadership needs better visibility into cyber risk.
The organization needs stronger governance and accountability.
Customer, regulatory or contractual expectations require more mature cybersecurity leadership.
The organization is growing quickly or entering more demanding markets.
The existing cybersecurity program needs executive-level direction.
A permanent CISO role is not yet justified.
The organization needs interim leadership while recruiting a permanent CISO.

A vCISO should provide more than a title for customer questionnaires or organizational charts. The value comes from helping the organization make better cybersecurity and risk decisions.

When Does an Organization Need vGRC?

vGRC can make sense when governance, risk and compliance work requires ongoing expertise and operating capacity but the organization does not need to build a large internal GRC function.

The need may include:

Managing multiple cybersecurity frameworks.
Operating controls and evidence processes.
Maintaining policies and procedures.
Managing risk registers and risk treatment.
Preparing for audits and assessments.
Coordinating control owners across the business.
Managing remediation.
Supporting customer assurance requirements.
Operating GRC technology.
Maintaining compliance after certification.
Helping leadership understand program status and risk.

vGRC can provide continuity between major audits or implementation projects so Cyber GRC does not become an activity that only receives attention when a deadline approaches.

When Do We Need a Cyber GRC Consultant?

A Cyber GRC consultant is particularly useful when the organization needs specialized expertise, an independent perspective or help executing a defined initiative.

Examples include:

Designing or redesigning a Cyber GRC program.
Fixing a fragmented cybersecurity and GRC program.
Implementing a new framework.
Building one program across multiple frameworks.
Performing a cybersecurity risk assessment.
Remediating assessment findings.
Selecting a GRC platform.
Implementing or repairing a GRC platform.
Designing governance and control ownership.
Building a common control framework.
Improving audit readiness.
Addressing a customer-driven cybersecurity requirement.

A consultant can also be valuable when the organization knows something is not working but does not yet know what kind of cybersecurity or GRC help it needs.

When Does It Make Sense to Hire a Full-Time CISO or GRC Leader?

A full-time leadership role makes sense when the organization has enough ongoing responsibility, complexity and strategic need to justify permanent executive or program leadership.

That decision depends on factors such as:

Organization size and complexity.
Cybersecurity risk.
Regulatory and contractual obligations.
Customer expectations.
Internal cybersecurity team size.
Executive and board expectations.
Amount of ongoing decision-making required.
Whether the work requires continuous internal authority.
Whether the organization can attract and retain the required expertise.
Whether the role represents a full-time workload.

The existence of cybersecurity work does not automatically mean the organization needs a full-time executive.

Conversely, using fractional leadership indefinitely may not make sense once the organization's scale and risk require a permanent internal owner.

When Does It Make Sense to Hire Full-Time GRC Staff?

Full-time GRC staff can make sense when the organization has a stable, ongoing workload that requires dedicated internal ownership and execution.

But organizations should avoid building headcount around inefficient processes.

Before hiring, determine:

What work actually needs to be performed continuously?
Which work belongs within GRC?
Which responsibilities should remain with control owners elsewhere in the business?
Which activities are duplicated?
Which processes could be simplified?
Which work can be supported through technology?
Which activities require specialized expertise only occasionally?

The objective is to design the operating model first and then staff it appropriately.

What If Our Existing Cybersecurity or GRC Team Is Simply Overwhelmed?

Determine why.

An overwhelmed team may genuinely need more capacity.

But workload can also be created by a fragmented program, manual processes, duplicate frameworks, repeated evidence collection, poor technology implementation, unclear ownership or cybersecurity work that should be performed elsewhere in the organization.

Adding people without fixing those problems can increase cost without making the program more effective.

See what cybersecurity and GRC work should be outsourced when the team is overwhelmed.

Could We Need Both Internal Staff and External Cyber GRC Support?

Yes.

Many organizations benefit from a hybrid model.

Internal leaders and employees provide organizational knowledge, authority, continuity and relationships across the business.

External Cyber GRC professionals can provide specialized expertise, additional capacity, independent perspective and experience with problems the organization may encounter only occasionally.

For example, an internal GRC leader may own the program while an external firm helps implement a new framework, remediate findings or select GRC technology.

An internal CISO may lead cybersecurity while external vGRC support helps operate a complex multi-framework program.

A smaller organization may use fractional leadership while internal IT and business teams continue to operate individual controls.

The right model is the one that gives the organization the expertise, ownership and capacity necessary to manage risk effectively.

What Is the Difference Between Consulting and Staff Augmentation?

Staff augmentation generally adds an individual to perform work within an existing role or operating model.

Consulting should provide expertise to understand and solve a problem.

That distinction matters when the organization does not yet have the right operating model.

If the problem is simply that a defined process needs more hands, staff augmentation may be appropriate.

If the organization needs to determine what the process should be, redesign governance, rationalize frameworks, select technology or change how the program operates, adding a person to the existing model may not solve the problem.

Organizations should distinguish between needing labor and needing expertise, design and execution.

Can a vCISO Also Manage GRC?

Sometimes.

The answer depends on the person's expertise, the scope of the program and the volume of work.

Some vCISOs have deep governance, risk and compliance expertise. Others focus primarily on cybersecurity strategy, technical security or executive leadership.

Likewise, operating a large multi-framework GRC program can involve significant ongoing work that should not be assumed to fit within a limited fractional leadership engagement.

Organizations should evaluate the capabilities and capacity required rather than assuming a particular title guarantees every skill set.

Can a vGRC Replace a vCISO?

Not necessarily.

vGRC and vCISO services overlap in areas such as governance, risk and cybersecurity strategy, but they are not identical.

A vCISO may take broader responsibility for cybersecurity leadership, executive communication, security strategy and oversight of technical security functions.

vGRC may focus more deeply on governance, risk, frameworks, controls, policies, audit readiness, evidence, remediation and ongoing GRC operations.

An organization may need one, both or neither depending on its existing leadership and the problem it needs to solve.

Should We Hire Someone Before We Define the Cybersecurity Operating Model?

Not if the organization is still uncertain about what the role should own.

A poorly defined operating model creates poorly defined jobs.

The organization may hire someone to "own GRC" only to discover that responsibility is distributed across cybersecurity, IT, legal, privacy, finance, human resources and business control owners.

Before defining permanent roles, establish how the program should operate.

That includes governance, accountability, control ownership, risk ownership, processes, technology and reporting.

See how to build a Cyber GRC operating model and how to establish clear ownership for cybersecurity controls.

What If Our CISO or GRC Leader Just Left?

A leadership departure can create both a capacity problem and an opportunity to reconsider the program.

The immediate priority may be maintaining critical operations, customer commitments, audits, risk processes and major initiatives.

But before automatically replacing the departing person with an identical role, determine whether the organization still needs the same structure.

The business, cybersecurity program and requirements may have changed since the role was originally defined.

See how to keep the cybersecurity and GRC program moving when a CISO or GRC leader leaves.

What If Our Company Has Outgrown Its Current Cybersecurity Team Structure?

That can happen even when the existing team is strong.

Growth changes the amount and type of cybersecurity work required.

The organization may need more formal governance, specialized GRC expertise, additional leadership, stronger risk management, different technology or a combination of internal and external resources.

If the program itself no longer fits the organization, see what to do when a company has outgrown its cybersecurity program.

How Should Cost Factor Into the Decision?

Cost matters, but comparing hourly rates or salaries alone can be misleading.

A full-time hire includes salary, benefits, recruiting, onboarding, management and the risk that one person may not possess every specialty the organization requires.

A fractional or consulting model may provide access to broader expertise but may not provide the same internal presence or authority as a permanent leader.

Outsourcing operational work can reduce the need for internal headcount, but the organization still needs appropriate governance and accountability.

The better question is what combination of resources provides the required outcomes at a sustainable cost.

How Do We Decide What Cybersecurity and GRC Work Should Stay Internal?

Organizations generally need to retain accountability even when execution is supported externally.

Business leaders still own business decisions.

Risk acceptance still belongs to the organization.

Control owners remain accountable for activities within their responsibilities.

External professionals can provide expertise, facilitate decisions, operate processes, implement controls, maintain program activities and advise leadership.

The sourcing model should clarify what the organization owns, what the provider performs and how decisions are made.

What Questions Should We Ask Before Choosing a vCISO, vGRC, Consultant or Employee?

What problem are we trying to solve?
What work needs to happen continuously?
What work is temporary or project-based?
What expertise do we already have?
What expertise are we missing?
What capacity are we missing?
What authority needs to remain internal?
What responsibilities should sit elsewhere in the business?
What can technology support?
What should be simplified before we add people?
What level of leadership does the organization require?
Does the work justify a full-time role?
Would access to a team of specialists be more useful than one additional employee?
How will the model change as the organization grows?

The answers should define the resource model, not the other way around.

How Does Hotman Group Help Organizations Determine the Right Cybersecurity and GRC Resource Model?

Hotman Group starts with what the organization needs to accomplish and what is preventing the cybersecurity and Cyber GRC program from getting there.

HG can help distinguish among leadership needs, operating capacity, specialized expertise, program-design problems, technology issues and inefficient processes.

Depending on the need, Hotman Group can provide vCISO or vGRC leadership, specialized consulting, implementation, remediation, program operations or additional Cyber GRC capacity as an extension of the internal team.

The solution does not have to fit one delivery model.

The objective is to provide the expertise and capacity required for the organization to manage cybersecurity risk effectively and sustainably.

What If We Still Do Not Know Which Model We Need?

You do not need to choose the title before understanding the problem.

If the organization knows it needs cybersecurity or GRC help but cannot determine whether the answer is leadership, consulting, technology, outsourcing or permanent staff, start with diagnosis.

See how to approach cybersecurity and GRC problems when you do not know what kind of help you need.

If comparing external providers, also see how to evaluate a Cyber GRC consulting firm before hiring one.

About Hotman Group

Hotman Group is a cybersecurity and Cyber GRC professional services firm that helps organizations solve complex cybersecurity, risk, governance and compliance problems. Hotman Group designs, builds, implements, remediates, operates and matures cybersecurity and GRC programs.

Learn more about Hotman Group's approach to solving complex cybersecurity and Cyber GRC problems.