Led by
Steve SharmaVerifiable credentials
ASD-endorsed IRAP AssessorCISSPCREST
Named executive security leadership
A Virtual CISO, named and accountable, without the permanent hire.
A vCISO is a senior security executive, retained fractionally, who provides accountable security leadership across strategy, risk, compliance and executive reporting. Where appropriate, the vCISO presents directly to the board, risk committee or executive leadership team.
Need AI leadership as well? Our vCAIO service combines AI strategy, governance, risk and security leadership. Explore vCAIO
Founded and led by an ASD-endorsed IRAP assessor · A named executive on every engagement · Senior-led delivery
Delivery capacity
Through our delivery partner Cyber Arista
Explore the partnershipWe work in
Why now / 04
Most people arrive here for one of five reasons.
Start with the event that changed the conversation.
Reason 01
Your security leader left
The resignation landed. The accountability didn't leave with them.
How fast we can startReason 02A regulator or board is asking
Someone needs to own this, by name, in writing.
What your vCISO ownsReason 03A customer or tender demands it
A contract needs certification, and someone senior on the call.
How we unblock dealsReason 04An audit finding needs an owner
The report exists. The remediation plan doesn't.
The first 90 daysReason 05You can't justify a full-time hire
The exposure is real. The salary isn't approvable.
What this costsDefinition / 05
What a Virtual CISO actually is
A Virtual CISO (vCISO) is a senior security executive, retained on a fractional basis, who provides accountable leadership across an organisation's security strategy, risk, compliance and executive reporting.And what it isn't
Not an MSSP.
They run tools and watch alerts. We decide what should be running, and why. Most organisations need both.
Not a consultant.
A consultant delivers a report and leaves. A vCISO holds the accountability and stays.
Not your auditor.
We prepare organisations for assessment and certification, but we do not certify our own work.
Not a platform.
Software produces a dashboard. A dashboard cannot sit in front of your board or regulator.
Accountability / 06
What your vCISO owns
This role provides executive security leadership alongside your existing technology and security teams. It can fill gaps, add capacity or lead change.
Standing mandate
Security strategy aligned to your obligations and risk appetite
The risk register: owned, maintained and defensible under scrutiny
Compliance leadership across the frameworks that apply to you
Board and executive reporting, in business language
Third-party and vendor risk
Incident response readiness, and leadership if it happens
Oversight of your internal team, your MSP, or both
The security budget: what to spend it on, and what not to
Evidence artefact
Risk assessment
Remediation roadmap
Board reporting pack
Incident response plan
Policy set
Standards register / 07
Standards, frameworks and obligations we work with.
Standards, frameworks, technical resources and regulations do different jobs. We treat them that way.
International
ISO/IEC 27001
prepare · advise · evidence
NIST CSF 2.0
prepare · advise · evidence
ISO/IEC 42001
AI management standard
SOC 2
attestation framework, advisory
OWASP LLM Top 10
LLM security resource
PCI DSS
payment card standard
Jurisdiction-specific
Essential Eight
current maturity · transition readiness
APRA CPS 234 / 230
information security / operational risk
SOCI Act
critical infrastructure obligations
ACSC ISM
control framework
Protective Security Policy
government policy framework
IRAP readiness
assessment preparation
Financial servicesInsuranceSuperannuationGovernment & agenciesLocal governmentHealthcareCritical infrastructureTechnology & SaaS
Legal interpretation stays with your counsel.
Finance memorandum / 08
What you're actually comparing
for a permanent CISO, before equity, on-costs and search fees
of executive search, while nobody owns the risk
holds the role. When they leave, the search restarts.
Senior security leadership does not always require a permanent executive hire.
Choosing a tier / 09
Three engagement models
The tier describes your situation, not the quality of the service.
Establish
“Nobody owns security here.”
You're here if:
There is no security leadership, you are facing your first framework, or a departure has created an interim CISO gap.
What your named executive owns:
- Risk picture assessed and documented
- Policy set fit for your business
- Prioritised remediation roadmap
- Incident response plan
- Board-readable report
Not included: Implementation, monitoring, certification audit
See how Establish is pricedAssureMost common
“We have to prove it.”
You're here if:
A regulator, customer, insurer or board has attached a date to your obligation.
What your named executive owns:
- Everything in Establish
- Evidence position maintained
- Control testing oversight
- Third-party and vendor risk
- Assessor liaison
- Quarterly executive reporting
Not included: The certification audit itself, 24/7 monitoring
See how Assure is pricedLead
“We need a CISO in everything but payroll.”
You're here if:
You carry multiple obligations, have an internal team to lead and a board reporting cadence to meet.
What your named executive owns:
- Everything in Assure
- Leadership of your security function
- Board and committee attendance
- Vendor and budget governance
- Incident leadership
- Multi-framework programme management
Not included: Product supply; assessment of systems we advise on
See how Lead is pricedNot sure which one fits?
Request an indicative scopeWe'll help you work out which engagement suits your situation. If the honest answer is a full-time hire, we'll tell you that too.
Commercial register / 10
What this costs
Fees are scoped to organisational size, regulatory exposure, mandate and reporting requirements. Register with your work email to see indicative fees.
Register to see indicative feesFixed monthly fee
There is no security leadership, you are facing your first framework, or a departure has created an interim CISO gap.
Full scope and pricingRegister to see indicative feesFixed monthly fee
A regulator, customer, insurer or board has attached a date to your obligation.
Full scope and pricingRegister to see indicative feesFixed monthly fee
You carry multiple obligations, have an internal team to lead and a board reporting cadence to meet.
Full scope and pricingWhat moves the price
- Number and overlap of obligations
- Whether there is an internal team to lead
- Board reporting and attendance cadence
- Any live audit, assessment or certification
How we quote
- Short scoping conversation
- Written proposal naming people, scope and fee
- Fixed monthly fee, no hourly billing
Indicative fees are shown to registered users and confirmed in writing after scoping. If your situation does not fit a tier, we will not pretend that it does.
Alternative analysis / 11
How the vCISO model compares
| Dimension | Full-time CISO | Advisory vCISO | MSSP | Cybersecurity Link |
|---|---|---|---|---|
| Time to start | Months | 2-4 weeks | Days | Days |
| Named executive | Yes | Varies | Usually no | Named before work begins |
| Flexible capacity | No | Usually | Yes | Yes, tiered |
| Executive accountability | Yes | Varies | No | Yes |
| Product independence | Yes | Varies | Vendor dependent | Yes, contractually |
| Cost | Full salary | Varies | Lower | Fixed fee, shared on registration |
| 24/7 monitoring | No | No | Yes | No, we'll refer you |
We included the row we lose. If round-the-clock monitoring is what you need, an MSSP is the right answer and we will point you to one.
Named accountability / 12
Your named executive
Every engagement is assigned a named senior executive before the engagement begins. Where additional specialists are required, they are identified in the proposal and subject to client approval.
Founder & PrincipalSteve Sharma
IRAPCISSPCREST
18+ years across four major banks, defence and government. Author, The CISO's AI Firewall.
Cybersecurity DirectorManju Sharma
CISMISO 27001Risk
15+ years leading enterprise risk, governance and compliance programmes across government and regulated sectors.
HR & Admin DirectorSanjeev Kumar
PeopleOperationsCompliance
15+ years overseeing strategic talent management, workforce operations and administrative governance for technology enterprises.
COO India OperationsParas Sharma
OperationsDeliveryAgile
12+ years driving offshore service delivery, operational scaling and cross-border security engineering operations.
Cybersecurity DirectorMansee Sharma
ISO 42001NIST AICloud
Specialist in emerging tech security, AI governance frameworks and cloud security architecture for modern enterprise environments.
If a named person changes, you hear before it happens.
Operating method / 13
How the engagement runs
Establish the position
01Understand
Establish the position
02Assess
Run the mandate
03Prioritise
Run the mandate
04Lead
Make it defensible
05Report
Your first 90 days
Risk assessment complete
Applicable-framework gap analysis
A shared view of what is exposed
Costed remediation roadmap
Incident response plan drafted
Priority policy gaps closed
First board report delivered
Governance cadence running
A defensible, fundable position
Independence rule / 14
Where we draw the line
Four clauses form the independence charter behind every recommendation.
Our advisory is product-neutral, and we take no commissions.
That is a term in the engagement letter, not a statement of intent.
We do not assess and advise on the same system.
For IRAP-related work, we clearly separate assessment and advisory roles.
We prepare you for certification; we do not certify you.
The audit belongs with an accredited body.
Where additional delivery capacity is required, we extend capability through our strategic partnership network, including our delivery partner Cyber Arista.
Partners are named in writing before you sign.
Contract controlThese clauses are documented before the mandate begins.
Decision point / 15
Want to know what this would look like for you?
A senior executive takes the call. If we are not the right fit, we will say so.
Success stories / 16
What changes
Success stories are anonymised by sector.
Our engagements are covered by NDA. These success stories are anonymised by sector.
Evidence register / 17
The evidence
01
🚩 Featured success story to supply
🚩 To supply: the situation, what the named executive owned and what changed in business terms, anonymised by sector.
🚩🚩 Outcome to supply
02
Clients
🚩 CLIENT LOGO🚩 CLIENT LOGO🚩 CLIENT LOGO🚩 CLIENT LOGO🚩 CLIENT LOGO🚩 CLIENT LOGO🚩 CLIENT LOGO🚩 CLIENT LOGO🚩 CLIENT LOGO🚩 CLIENT LOGO
03
In their words
🚩 Client quote to supply, with written permission and an approved attribution.
🚩[Name]🚩[Role], [Organisation]
🚩 Second client quote to supply, with written permission.
🚩[Name]🚩[Role], [Organisation]
04
Third-party validation
Verifiable credentials
Our founder's seven credentials (ASD IRAP, CISSP, CISM, CREST, SABSA, TOGAF and ISO/IEC 27001 Lead Auditor) each link to their register.
🚩 Register linkPublished work
The CISO's AI Firewall, plus four more books and a free Executive Mini Book.
Speaking and media
Conference talks, podcasts and industry commentary.
Engagement letter / 18
The commercial terms, up front
Plain enough to lift into procurement's notes.
Month to month.
No minimum term and no annual lock-in. If the engagement is not delivering, you should not need a contract clause to leave.
30 days' notice, either side.
Stated in the engagement letter, not buried in it. The same notice applies to us.
We help you leave.
If you hire permanently, we hand over documentation, context and relationships, and can help you interview.
The Sprint counts.
Start with the Sprint, a focused two-week engagement. The fee is credited against your first three months if you continue.
Adjacent mandates / 19
What often comes next
A Virtual Chief AI Officer
Fractional AI leadership across strategy, governance, risk, security and board reporting.
Explore vCAIOYour team learns what we practise
Assure and Lead can include Academy seats, subject to the final engagement scope.
See the AcademyResearch index / 20
If you're still researching
BOARD BRIEFING
Who owns security in your organisation?
A 🚩[N]-page briefing for boards. No technical knowledge assumed.
ANALYSISQuestions to ask any advisory firm before you sign
Starting with who will be in the room.
REFERENCEFramework library and glossary
Plain-English definitions of each standard, framework and obligation here, jurisdiction-labelled.
Common questions / 21
Questions we get asked
Direct answers, kept short enough to quote and forward.
Is one person with a GRC tool enough?
One person with a GRC tool is rarely enough. Every engagement is led by a named senior executive. Where more specialists are needed, the proposal names them. Each one is subject to your approval.
Will a fractional executive satisfy our regulator or board?
A fractional executive can satisfy a regulator or board when accountability is clear. Both look for evidence of oversight, not a particular headcount. You get named accountability, documented governance and board-ready reporting. If your obligations require a full-time officer, we will tell you.
How fast can you start?
We can usually start within days. Interim engagements after a departure start fastest. This model is built to stabilise exactly that situation.
Will this replace our IT manager?
No, a vCISO does not replace your IT manager. The role works alongside your technology and security teams. Your IT lead gains executive air-cover and someone senior to escalate to.
Can you work with our existing MSP?
Yes, we can work with your existing MSP. We set priorities and hold delivery to account. We take no commission from any provider we recommend.
What if we hire a permanent CISO?
If you hire a permanent CISO, the engagement has worked. We hand over properly and can help you interview. Notice is 30 days, with no exit fee or penalty.
What happens if there is an incident?
If there is an incident, your named executive leads the response and communications. We are not a 24/7 monitoring service. If you need one, we will help you select and oversee it.
Are you an auditor, pentester or MSSP?
No, we are not your auditor, pentester or MSSP in a vCISO engagement. We refer the right specialist and take no commission. For IRAP-related work, we clearly separate assessment and advisory roles.
What does it cost?
What it costs depends on scope. Engagement fees are scoped according to organisational size, regulatory exposure, mandate and reporting requirements. The monthly fee is fixed and confirmed in writing after scoping. We do not bill by the hour. Register with your work email to see indicative fees.
Can you support a private equity or venture portfolio?
Yes, we support private equity and venture portfolios. That includes pre-acquisition diligence and portfolio-wide programmes. Share the deal timeline and we will say whether we can meet it.
What if we're too small?
If you are too small, we will say so. Under about twenty people, you usually need an MSP and policies, not an executive. We would rather point you there than take the engagement.
Decision / 22
Your CISO seat may be empty. Your accountability shouldn't be.
Named, fractional security leadership: strategy, risk, compliance, architecture and board reporting.
Book a confidential strategy sessionOr write directly: hello@cybersecuritylink.com.auWe'll assess your situation, define the mandate and tell you whether a vCISO, internal hire or another model is the right answer.
Making the case internally?
A short brief covering the accountability gap, alternatives, cost and executive questions.
Sitting on the board?
Questions to ask management and what a good answer sounds like.