vCISO vs Managed ISMS: Which Service Do You Need?

A Managed ISMS keeps an existing ISO 27001 management system running: the risk register, the Statement of Applicability, the evidence schedule, corrective actions, internal audit coordination and management review. A vCISO provides senior security leadership: strategy, risk prioritisation across the business, supplier security strategy, incident governance and reporting to executives and the board. The first answers "is our ISMS still operating?". The second answers "what should we do about security risk, in what order, and what does the board need to decide?".

If your problem is that certification work keeps landing on whoever has a spare afternoon, you probably need a Managed ISMS. If your problem is that nobody can explain your security position to a customer, an investor or a regulator, and priorities are set by the last questionnaire, you probably need a vCISO. Some organisations need both at different times. Very few need both at once.

Two different jobs, often sold under one name

The confusion is commercial, not technical. "vCISO" sounds more senior, so light ISMS upkeep is often marketed with that label. The test is capacity and outputs, not the title on the proposal.

At Kellwick the two services are deliberately separate:

• Managed ISMS covers up to one advisory day a month at base, for one ISMS scope and one legal entity. That is enough to run the monthly rhythm of a stable, certified system. It is not enough to set strategy.
• vCISO covers up to five advisory days a month as standard, with more by agreement. That capacity exists because leadership work is slower and more political than upkeep: preparing decisions, sitting in executive sessions, working through supplier strategy, running tabletop exercises and writing board reports.

Between the two sits a Fractional GRC Lead, with up to three days a month, for organisations whose problem is coordinating several frameworks rather than leading security. That comparison deserves its own article; here we stay with the two ends.

What each one produces

The cleanest way to choose is to look at the artefacts you will hold at the end of a quarter.

Area	Managed ISMS	vCISO
Risk	Risk register re-assessed against business changes; treatment plans updated with owners	Risk appetite proposal for management; top risks ranked across the business, not only inside the ISMS scope
Planning	Evidence schedule and annual ISMS calendar	Security roadmap for the next two to four quarters, with cost and options
Reporting	Monthly status note: evidence due and received, open actions, changed risks	Monthly executive session with decisions prepared; quarterly board report where included
Suppliers	Supplier register kept current; review records for new and critical suppliers	Supplier security strategy: which dependencies matter, what assurance to require, exit thinking
Incidents	Incident records and lessons learned captured in the ISMS	Incident governance: escalation thresholds, decision rights, regulatory reporting readiness, tabletop exercises
Audits	Internal audit programme coordinated; surveillance readiness checked	Uses audit results to inform priorities; does not audit its own work
Frameworks	One ISO 27001 scope	Security across the frameworks agreed in the mandate, for example ISO 27001 with DORA or NIS2 obligations

Neither column includes operating your firewalls, monitoring alerts around the clock or running forensics. A vCISO is not a 24/7 security operations centre or an incident response retainer. If you need those, buy them separately and have the vCISO or your internal owner govern them.

Who decides what

Both services leave legal accountability where it is. Under ISO 27001 clause 5, top management must demonstrate leadership and commitment to the ISMS. Under DORA Article 5, the management body of a financial entity defines, approves and oversees the ICT risk management framework and bears ultimate responsibility for it. NIS2 Article 20 places similar duties on the management bodies of essential and important entities. No retainer moves those duties to a supplier.

What changes is who prepares the decisions:

• With a Managed ISMS, your internal ISMS owner makes the day-to-day calls and escalates to management. The service keeps the system's records honest and on schedule, and tells you when something is overdue.
• With a vCISO, the vCISO analyses risks, sets out options with costs and consequences, makes a recommendation and records the decision management takes. Management still decides which risks to accept, treat or transfer.

If your organisation has nobody who can make those calls internally, a Managed ISMS alone will produce well-kept records of decisions nobody is making. That is the most common sign of a mismatch.

A five-question test

Answer these honestly. Two or more "yes" answers in the second group usually point to a vCISO.

Points towards a Managed ISMS

1. You already hold ISO 27001 certification, or are close to it, and the scope is stable.
2. You have an internal person who owns the ISMS and can make decisions, but lacks time or method.
3. Your surveillance audits keep finding the same things: a stale risk register, evidence that stopped, corrective actions never verified.

Points towards a vCISO

1. Customers, investors or a regulator ask who leads security, and the honest answer is "our CTO, part time".
2. You answer to more than ISO 27001: DORA as a financial entity, NIS2 through national law, contract clauses from regulated customers, or AI governance.
3. Security spend and effort follow whichever questionnaire or incident arrived last.
4. The board receives no regular security reporting, or receives a list of tools rather than exposure and decisions.
5. Nobody owns supplier security strategy, so critical dependencies were chosen by engineering convenience.

Hypothetical examples

A 70-person B2B software company, certified for two years. The founder who led certification has moved to product. The risk register was last updated before the previous surveillance audit. The company has an operations manager who can own the ISMS, and its customers mainly want the certificate kept current. This is a Managed ISMS case. Paying for strategy it will not use wastes money; what it needs is a working monthly rhythm and someone checking that evidence still exists. Our earlier article on ISO 27001 maintenance without a full-time GRC manager sets out what that rhythm looks like.

A 140-person payment institution in the EU. It holds ISO 27001, but DORA applies directly. Its management body must approve an ICT risk management framework, it needs a major-incident classification process, a register of information for ICT contracts and an exit strategy for critical providers. Nobody below the CEO owns these as a programme. This is a vCISO case, often alongside the existing ISMS upkeep, because the gap is leadership and regulatory ownership rather than record-keeping.

A 40-person AI start-up preparing for its first enterprise deals. No certification yet. Security questions arrive weekly. The temptation is to buy a vCISO title for sales credibility. Often the better first step is a defined implementation project or a readiness assessment, then a Managed ISMS once a system exists to manage. A vCISO makes sense here only if the company genuinely needs someone to set priorities and talk to buyers and investors at a senior level.

Common mistakes when choosing

• Buying the title, not the capacity. A "vCISO" at one day a month with seven frameworks in scope is maintenance with a bigger name. Our note on how much a vCISO costs explains why capacity is the number to compare.
• Expecting a Managed ISMS to fix governance. If management never decides anything, better records will not help. The service will keep reporting the same overdue decisions.
• Expecting a vCISO to do the upkeep too. Senior days spent chasing access review evidence are days not spent on strategy. If both jobs exist, separate them, either with an internal owner or two scoped services.
• Letting the same person audit the system. Whoever maintains or leads the ISMS must not perform its internal audit. ISO 27001 requires internal audits to be objective and impartial. Plan an independent ISO 27001 internal audit from the start.
• No exit plan. Whichever service you choose, the records, registers and decision log belong to you and should be kept in your systems, so a future hire or provider can take over cleanly.

Signs you have outgrown your current choice

From Managed ISMS towards vCISO:

• New regulation applies directly to you, not only through customer contracts.
• The board or investors start asking for security reporting on a schedule.
• You are adding frameworks, entities or countries, and decisions now cut across them.
• Incidents or near misses raise questions nobody has authority to answer.

From vCISO back towards Managed ISMS:

• The roadmap is largely delivered and the work is now steady-state.
• You have hired an internal security lead who can set strategy, and you need method and continuity underneath them.
• Monthly executive sessions have started to repeat the same status with few decisions to take.

A good provider will tell you when either shift has happened. Each quarter, we review whether the contracted capacity still fits the work and say so if it does not.

How to decide in practice

Write down the three decisions you most need made in the next six months, and who should make them. If they are mostly "keep the certificate, close the audit findings, keep evidence current", start with a Managed ISMS. If they include "what risk are we willing to carry", "which supplier dependencies are acceptable", "what do we tell the board" or "how do we meet DORA or NIS2 as an organisation", you are describing leadership work, and a vCISO is the better fit.

Either way, the proposal should state capacity in days, the frameworks and entities in scope, the reporting audience, and what is excluded. If it does not, you cannot compare it with anything else.