When a vCISO Relationship Stops Working

Many companies bring in a virtual or fractional security leader and are happy for the first year. Then something slips. Reports arrive late, meetings are rushed, and the board asks questions nobody can quickly answer.

It is rarely one big failure. It is drift, and drift is easy to miss because the relationship feels familiar.

A short scorecard turns a vague feeling into a decision. It lets you say what is working, what is not and what to do about it.

TLDR

• Outsourced security relationships drift, and drift is easy to miss.

• Score the relationship on deliverables, response, board readiness and cost.

• Three outcomes are legitimate: fix, rebid or bring in-house.

• Compare cost with real alternatives, not with nothing.

• Have the review conversation before the renewal date, not after.

Start with what was promised

Pull the original scope and the deliverables. What was supposed to happen each month and each quarter? What was actually delivered?

The interim CISO contract guide explains how to write deliverables that can be checked, which makes this review much easier.

The relationship scorecard

Score each area from one to five with the people who work with the leader most. The entries below are illustrative.

Area (illustrative)	What to check	Score (1 low, 5 high)	Note
Deliverables	Were agreed reports and reviews delivered on time?	3	Two quarterly reports late
Response time	How fast are urgent questions answered?	2	Several day delays
Board readiness	Can they brief the board clearly and on short notice?	4	Strong at briefings
Team trust	Does the internal team work well with them?	3	Some friction
Cost against alternatives	What would a full-time hire or another provider cost?	3	Fair, not a bargain

The numbers matter less than the conversation they start. Disagreement between scorers is a finding too.

Fix, rebid or bring in-house

If the scores are mostly fine with one weak area, fix it. Write down what must change and by when. If the problems are broad or the leader does not accept feedback, consider rebidding.

If you depend on the role every week, or the cost is close to a full-time salary, bring it in-house. Run the numbers honestly. Oversight of outside providers is also part of supply chain risk management, which NIST covers in SP 800-161.

Keep the relationship honest

Hold a short review each quarter, not only when something goes wrong. Ask the same questions each time and keep the notes.

When the scores fall, say so early. Most providers prefer a direct conversation to a surprise at renewal. For how the two common models differ, see interim CISO services versus vCISO.

Frequently asked questions

How often should we review a vCISO relationship?

Quarterly is enough for most companies. Keep the questions the same so you can see trends.

What are the signs a relationship is drifting?

Late reports, slower responses, rushed meetings, vague answers to board questions and a growing list of items nobody owns.

When does it make sense to bring the role in-house?

When you rely on the role most days, when the cost approaches a full-time hire, or when the work needs deep daily knowledge of the business.

Should we tell the provider before a formal review?

Yes. A direct, early conversation is fair and usually gives the best chance of fixing the problem.

A Defensible Next Step

Fill in the scorecard this week with two or three people who work with your leader. Where the scores differ most is where to begin. Book a Decision-Clarity Call if you want an independent view.