Virtual CISO? Senior security leadership without a full-time hire.
You get a named senior lead who works at board and executive level and sets out security priorities and investment for your leadership, so you can decide with the cost and consequences in front of you. Accel Comply was founded by Behzad Motaghi, who has held senior IT and security roles since 2009.
The short answer
Your executive team and board get a clear basis for setting security priorities and deciding what to invest in, and Accel Comply follows up with IT and suppliers on what they decide. Founded by Behzad Motaghi, Accel Comply works with companies in Denmark and the Nordics that have nobody leading security, or where the security or IT lead wants support. The work is what a virtual CISO typically covers, and you can appoint Accel Comply as your CISO.
An in-house CISO, an appointed security officer or outside senior help?
These are three different things, and they can sit side by side. An in-house head of security is in the organisation every day, manages people and owns the function over the long term. An appointed security officer is formally given responsibility for information security by leadership. An external adviser prepares leadership's security decisions and follows up on the agreed work. Accel Comply can be appointed as your CISO. If you have already appointed someone internally, your senior lead works alongside them on the part of the work you agree. If you are weighing up hiring instead, see Hire or bring in outside help.
The work people usually want a virtual CISO for
Accel Comply turns your security position into priorities the executive team and board can decide on and keep track of. You learn where you're exposed and what that means for the plans you have, what to do first, what it will cost and what you risk by waiting. Your senior lead joins executive and board meetings if you want, and, once leadership has decided, comes back when something changes the picture, such as a new supplier, a new market or an acquisition. What you get is a proposed security plan for the executive team and board to decide on.
No security leader yet, or one who wants backing
If security sits with the CEO or CFO, Accel Comply takes on the part that needs senior experience, so whoever is accountable can decide without first having to master the technical detail. If you already have a head of security or IT, your senior lead works with that person, either testing a plan or budget before it reaches the executive team or taking on a defined piece of work, such as board reporting. Your head of security or IT gets time back for running the function day to day.
Three situations where it makes sense
Your IT supplier pitches a big security project nobody at the top can weigh up
Accel Comply checks the proposal against what you actually need to protect and says what to buy now, what can wait and what to ask the supplier. The executive team can then put the money where it protects the business and explain the choice to the board.
Your head of security is tied up in operations, and the board wants a clear picture
Your senior lead agrees with your head of security what the board should see at each meeting and which investments to ask for. The board can keep track of security without a technical briefing.
An acquisition or a new market pulls security into leadership's plans
You get a clear view of what the move means for your security and what it's likely to cost, before you commit. Security is part of the plan from the start, not a bill that turns up afterwards.
What Accel Comply takes on, and what it doesn't
What Accel Comply takes on
- Security priorities and investment set out for the executive team and board, with costs and consequences
- Attending executive and board meetings, if you want your senior lead there
- Following up with IT and suppliers on what leadership has decided
- A sounding board for your own head of security or IT
- Scoping work for specialists, so you know what you're buying
What Accel Comply does not take on
- Security operations and monitoring
- 24/7 incident response
- Penetration testing
- Audit and certification
Your board and executive team make the decisions and stay accountable, even when Accel Comply is your appointed CISO.
Common questions about virtual CISOs
What should we look for in a virtual CISO in Denmark?
Look at who does the work and at what level. Do they talk to the executive team and board, or only to IT? Is it clear what is included and who is responsible for what? At Accel Comply you know who leads your engagement, and you work with that same person throughout, in English or Danish.
What's the difference between a vCISO, CISO as a service, an interim CISO and a part-time CISO?
The terms are often used interchangeably, but they usually mean different things. A vCISO, or CISO as a service, is ongoing outside help. An interim CISO covers a set period, often until a permanent hire starts. A part-time CISO works a fixed number of days a week. Whatever it's called, you need to know what's included, how often the work happens and who is responsible for what. At Accel Comply that is set out in the contract.
Can Accel Comply be our formally appointed CISO?
Yes. Accel Comply can be your formally appointed CISO and lead your information security work. Scope, availability and response times are agreed in the contract.
We already have a CISO. What can outside help add?
Someone to test their thinking and take some of the load: Accel Comply can go through a plan, budget or board paper with your CISO before it goes to the executive team, or take on a defined piece of work, such as choosing between suppliers. Second opinion explains how that works.
Do you handle security incidents and operations?
Not directly. 24/7 incident response, monitoring and security operations need a provider set up for exactly that. Accel Comply brings in a partner from its network and can run the project for you.
What is a head of information security, and can the role be external?
Yes, the role can be external. A head of information security leads the work of protecting the company's information. In practice the title covers much the same ground as a CISO: risks, rules, supplier requirements and reporting to leadership. Accel Comply can hold the role, or work alongside someone you already have in it.
More on leading security
Describe what leadership needs to decide on security.
Write a short note on what's on leadership's agenda this year and whether anyone leads security. You'll hear where the work would start, or whether something else would suit you better.