A Virtual CISO (vCISO), also referred to as a fractional CISO, outsourced CISO, or part-time CISO, is an experienced security executive engaged on a recurring, contractual basis to lead an organization's information security program without the cost or commitment of a full-time hire. Unlike a one-off consultant, a vCISO carries ongoing accountability: defining security strategy, owning the risk register, reporting to the board or executive committee, liaising with regulators, and leading response when incidents occur. Engagements are typically scoped in hours per month or as a fixed monthly retainer, scaling up during audits, incidents, or compliance milestones.