vCISO & Fractional CISO Services & Engagement Model — Denver, CO
vCISO & fractional CISO leadership, scoped to fit your organization
Every organization's security needs are different — a growing startup needs a foundation; a company preparing for acquisition needs a fast, defensible security story; a board needs a trusted, independent voice they can rely on. Below are the ways I work with clients. Every engagement starts with a conversation, not a fixed package.
What it is
Ongoing, embedded security leadership — without the cost or commitment of a full-time executive hire. I act as your organization's CISO on a part-time, scoped basis: setting strategy, building governance, managing risk, and reporting to leadership and the board.
What's typically included
- Security strategy and program roadmap ownership
- Policy and governance framework development
- Vendor and third-party risk oversight
- Compliance program management (HIPAA, SOC 2, PCI DSS, ISO 27001, NIST 800-53/CSF, FedRAMP, GDPR, CCPA, and other frameworks as applicable)
- Incident response planning and tabletop facilitation
- Executive and board reporting on a regular cadence
What it is
Security and compliance due diligence for companies going through an acquisition, merger, or divestiture — plus, where needed, post-close remediation and integration support.
What's typically included
- Pre-acquisition security and compliance risk assessment
- Identification of compliance gaps (HIPAA and other regulatory frameworks) before they become deal risks
- Post-close remediation planning and execution
- Security integration planning across merging organizations
- Incident readiness during the vulnerable transition period
Security gaps discovered after a deal closes are far more expensive — financially and reputationally — than gaps found during diligence.
I've led this process directly, including managing an active incident during integration while simultaneously closing HIPAA compliance gaps identified in diligence.
What it is
A trusted, independent security voice at the board or executive level — for organizations that need security expertise in governance and risk conversations without adding a full-time executive.
What's typically included
- Board-level security risk briefings and reporting
- Governance framework review and recommendations
- Independent assessment of management's security posture and claims
- Support for board risk committees navigating security or compliance decisions
What it is
Scoped, time-bound engagements for organizations with a specific, defined security need — not an ongoing retainer relationship.
What's typically included
- Security program or architecture assessments
- Compliance readiness reviews
- Tabletop exercises and incident response planning sessions
- One-off strategic security consulting
Getting Started
How engagements begin
-
Discovery Call
We discuss your organization, your security posture, and what you're trying to accomplish. No obligation, no sales pressure.
-
Scoped Proposal
You receive a clear, written proposal: what's included, how many hours, and what it costs.
-
Engagement Begins
Work starts directly with me — not a hand-off to a junior team member or account manager.
Common Questions
Frequently asked questions
What is a vCISO (virtual or fractional CISO)?
A vCISO — also called a virtual or fractional CISO — provides ongoing, embedded security leadership on a part-time, scoped basis — setting strategy, building governance, managing risk, and reporting to leadership and the board — without the cost or commitment of a full-time executive hire.
How much does a fractional CISO cost?
Fractional CISO engagements are structured as a monthly retainer scoped to a set number of hours based on an organization's size and complexity. Pricing is discussed directly per engagement rather than published as a flat rate, since scope varies significantly by organization.
What does a fractional CISO do during M&A due diligence?
Security and compliance due diligence for companies going through an acquisition, merger, or divestiture, including identifying compliance gaps before they become deal risks, and post-close remediation and integration support during the vulnerable transition period.
How does a fractional CISO engagement begin?
Engagements begin with a no-obligation discovery call to discuss the organization's security posture and goals, followed by a scoped written proposal covering what's included, hours, and cost, then work begins directly with the CISO rather than a hand-off to a junior team member.
What compliance frameworks does AASecure support?
AASecure supports compliance program management across HIPAA, SOC 2, PCI DSS, ISO 27001, NIST 800-53/CSF, FedRAMP, GDPR, CCPA, and other regulatory frameworks as applicable to the organization.
Does AASecure provide vCISO services in Denver, Colorado?
Yes. AASecure is based in Denver, Colorado and provides vCISO and fractional CISO services to organizations in Denver and across Colorado, as well as clients nationally.