What is the typical engagement size?
Most clients start at 2 to 4 days per month, scaling to 6 to 8 days during regulator submissions, incidents or M&A activity.
Extended FAQs
Extended FAQs — Virtual CISO (vCISO)
Extended answers to the questions buyers, boards and procurement teams ask before commissioning Virtual CISO (vCISO).
- ISO/IEC 27001 Certified
- ISO/IEC 27701 Certified
- ISO 9001 Certified
Delivered by an ISO/IEC 27001, 27701 & 9001 certified organisation
Do you provide 24×7 cover?
Yes — vCISO retainers include on-call escalation for major incidents and breach response.
How is a vCISO different from a consultant?
A consultant delivers a project. A vCISO holds the CISO accountability — owns the strategy, board narrative, regulator relationship and incident command across an open-ended retainer.
Who is our vCISO?
A named senior practitioner with 15+ years of CISO or Head-of-Security experience in your sector. Same person every month — no rotating account team.
Can we hire your vCISO into a full-time role?
Yes. Several clients have converted vCISOs into permanent hires after 9 to 18 months. We support the transition with no buy-out fee.
Will a vCISO replace our security team?
No — the vCISO leads and orchestrates your existing team (or MSSP). They provide leadership, governance and external credibility, not hands-on engineering.
Do you support board and audit committee meetings?
Yes — preparation, attendance and follow-up across the quarterly audit committee, board risk committee and ad-hoc cyber forums.
What if our needs grow mid-engagement?
Days flex up monthly. We have moved clients from 2 days/month to a full-time interim CISO during regulator events, M&A and major incidents.
How experienced is the team that will actually deliver Virtual CISO (vCISO)?
Every engagement is led by a partner or principal with at least 12 years in managed services and supported by certified consultants (CISA, CISM, CISSP, CIPP/E, ISO 27001 Lead Auditor, ISO 42001 Lead Implementer, OSCP, CREST). You meet the actual delivery team before contracts are signed.
How do you handle confidentiality and data residency?
All client data stays within the regions you authorise. NDAs are signed before scoping calls, and we offer fully on-premise delivery for sensitive engagements. For UAE and KSA clients, evidence remains in-country by default.
Can MAST work alongside our existing Big 4 auditor?
Yes. We routinely collaborate with EY, Deloitte, KPMG, PwC, BDO and Grant Thornton as your implementation partner while they retain audit independence. Roles are agreed upfront in writing to preserve auditor independence rules.
Do you offer multi-year continuous compliance?
Yes — our Managed Compliance Service operates the programme on a monthly subscription, covering control monitoring, evidence collection, internal audit and recertification across every framework in scope.
How is success measured?
Success criteria are agreed in the engagement charter — typically a passed certification or regulator submission, an audit-ready evidence repository, trained control owners and a 12-month continuous-improvement plan.