SAK Services / vCISO
SAK Services · flagship engagementA security executive without the executive hire
Most regulated organisations need the compliance before they need a full-time CISO. Our vCISO service carries the mandate — for NCA ECC, SAMA CSF and PDPL in the Gulf, Essential Eight and the Privacy Act in Australia — with the whole consulting bench behind it.
vCISO — mandate, roadmap and regulator readiness
CISO-grade ownership of the programme, reported to your board in Arabic or English, and accountable to the regulator's timeline rather than a consulting statement of work.
- Security strategy and a costed 12-month roadmap, mapped to the framework that binds you
- A risk register your board can read (5×5) and your CFO can price (FAIR)
- Maturity uplift plans — SAMA CSF for financial institutions, Essential Eight ML1 → ML2 — with the evidence assessors actually ask for
- PDPL readiness: lawful basis, cross-border transfer, breach notification, DPO duties
- Aramco CCC / SACS-002 supplier certification path where it applies
- Incident response plan written, tested and rehearsed with your executive team
- Third-party and supply-chain assessment for your critical vendors
- Security input to tenders, customer due diligence and cyber insurance renewals
What lands on the board table
- Quarterly board pack in Arabic or English, generated from live control evidence — not last quarter's memory
- Your compliance position by framework domain — NCA ECC, SAMA CSF maturity or the Essential Eight scorecard — with gaps and owners named
- Breach-notification readiness, with the clock for your regulator mapped
- Third-party and supplier cybersecurity status across the register
- Top five risks with financial exposure, not a heat map of coloured squares
Arabic and English reporting · bench-delivered · data residency options in KSA
The eight domains a SAK vCISO owns
Not a menu to pick from — all eight are in scope from day one. What changes between tiers is depth and cadence, not coverage.
Security strategy & roadmap
Current state assessed in the first fortnight, a target state defined against the framework that actually binds you, and a costed 12-month roadmap with sequencing, owners and dependencies — re-baselined quarterly, not written once and filed.
Roadmap tracked in GRCorbGovernance
The full branded policy set — information security, acceptable use, access control, cryptography, supplier security, secure development, continuity, incident response — plus the machinery around it: roles, a steering group with a standing agenda, an exception register with expiry dates, and an annual management review.
Satisfies ISO 27001 clause 9.3Risk management
A register your board can read (5×5, plain language) and your CFO can price (FAIR quantification on the top risks, in dollars). A written risk appetite statement, so "acceptable" stops being a matter of opinion. Treatment plans with named owners and due dates.
ISO 31000 · FAIRCompliance & certification
Framework selection and scoping, gap assessment, and an evidence program configured once and then collecting continuously — rather than assembled in a panic before an audit. Your assessor works inside the platform. Covers NCA ECC, SAMA CSF, PDPL, Aramco CCC (SACS-002) and NDMO in the Gulf; Essential Eight (ML1 → ML3), the Privacy Act and Notifiable Data Breaches scheme, the SOCI Act risk management program, APRA CPS 234 and CPS 230 and ISM/IRAP in Australia; and ISO/IEC 27001:2022, SOC 2 and PCI DSS v4.0.1 globally.
Mapped natively in GRCorb · Arabic and English reportingThird-party & supply chain risk
A vendor register tiered by the access each supplier actually has. Security requirements written into contracts and renewal checklists. Assessments proportionate to tier — not a 300-question spreadsheet for the company that supplies your coffee.
Monitored by SAK VendorTechnical standards & oversight
Identity and MFA, privileged access, patching SLAs by severity, logging and retention, backup and restore testing, cloud baselines, endpoint hardening, secure development. The vCISO sets the standard and verifies it is met; your team does the hands-on work.
Each becomes a control with evidence attachedIncident readiness & response
An incident response plan written for your organisation, playbooks for the scenarios that actually apply to you, an annual tabletop with your executive team, and a breach-notification decision tree mapped to your obligations. When something happens, the vCISO leads the executive response.
PDPL and NCA reporting · Privacy Act serious-harm test · 30-day OAIC clockBusiness enablement
Security questionnaires and RFP responses answered properly and fast. Customer due-diligence calls attended, so sales isn't defending a control set it doesn't understand. Cyber insurance renewals, board and investor reporting, security diligence for funding or acquisitions.
Where the retainer pays for itselfYou are buying a practice, not a personality
vCISO is a service, delivered by our consulting bench. Every consultant on it works to the same method, the same control library and the same board-pack format — so what you get does not depend on which individual you happened to draw, or on one person’s calendar, health or notice period.
- Bench-delivered
- Your engagement is staffed from our consulting bench and led by whichever consultant fits your sector and framework. They chair your leadership meeting and present to your board — and because the method and the evidence live in the platforms, not in one person’s head, cover and continuity never depend on a single diary.
- The bar every consultant meets
- Every SAK vCISO holds CISSP or CISM, has held security leadership accountability inside a regulated organisation, and has taken at least one organisation through a certification end to end.
- Matched to you
- Matched on sector and on the framework that binds you. The vCISO who took a scale-up through Essential Eight is not automatically the right one for a SAMA-regulated bank.
- Continuity by design
- Your roadmap, risk register, control evidence and board packs are all held in GRCorb, not in a consultant’s notes. Anyone on the bench can pick your programme up without a handover period, and holiday or illness does not stall it.
- How we work
- Remote-first, in Gulf working hours, with Arabic and English reporting. On-site for the kickoff, the annual tabletop, and board meetings where being in the room matters. Additional on-site days can be added to any tier.
- Why the bench is the point
- Every SAK vCISO runs the same method: the same discovery on SAK Surface, the same control library in GRCorb, the same risk model, the same board-pack format. Consistency is engineered, not hoped for — which is also why we can scale without the quality drifting.
What the retainer does not cover
Almost nobody publishes this. We do, because an engagement that starts with an unspoken assumption ends badly — and because the buyer who reads this section carefully is the buyer worth having.
| Not included | What happens instead |
|---|---|
| 24/7 monitoring and alert triage | We do not offer round-the-clock monitoring. Managed exposure covers continuous external discovery in business hours; where genuine 24/7 operations are required we will say so and help you select a provider. |
| Hands-on remediation and engineering | The vCISO sets the standard and verifies it. The work is done by your team, or scoped as a separate SAK engagement. |
| Being the on-call responder at 3am | The vCISO leads the executive response to an incident — decisions, comms, notification, post-incident review. They are not the person staffing a rota. |
| Penetration testing | A separate engagement, deliberately. A tester should not assess controls they helped design. |
| Legal advice and regulatory filings | We prepare the facts and draft the notification content. Your lawyer advises and files. |
| Statutory roles that require an employee | Some regulator-facing designations must sit with an officer of your entity. The vCISO supports the person holding it; they cannot be it. |
| Unlimited availability | Days are fixed per tier. Incident surge time is agreed and billed at the time, not absorbed silently. |
Three levels, one minimum term
Minimum one quarter, then month to month. Anything shorter doesn't produce something worth paying for — the first ninety days is where the value is created.
| Essentials | Standard | Embedded | |
|---|---|---|---|
| Days per month | 2 | 4 | 8 |
| Typical fit | 20–80 staff, first framework, insurance or customer pressure | 80–300 staff, certifying, regulated, or selling to enterprise | Regulated entity, multi-framework, or post-incident rebuild |
| Leadership meeting | Monthly | Fortnightly | Weekly |
| Board reporting | Quarterly | Quarterly + on request | Quarterly + committee attendance |
| Frameworks in scope | 1 | Up to 2 | Unlimited |
| Incident response leadership | Business hours | Business hours + escalation | Business hours + escalation |
| Platforms included | SAK Surface + GRCorb | Full attack surface monitoring + GRCorb | Full attack surface monitoring + GRCorb |
Priced as a flat monthly retainer, not a day rate. Arabic and English board reporting. Minimum one quarter, then month to month.
The first 90 days
A vCISO who spends the first month "getting up to speed" has wasted a sixth of the year. attack surface monitoring does discovery on day one, so the assessment starts with facts rather than a questionnaire.
- Days 1–14
Discovery
Stakeholder interviews. A SAK Surface baseline of everything internet-facing, including what nobody remembered owning. Asset and vendor registers built from discovery, not from a questionnaire.
- Days 15–30
Assessment
Gap assessment against the chosen framework. Risk register v1. Roadmap costed and sequenced. First leadership presentation: here is where you are, here is what it costs to get where you need to be.
- Days 31–60
Foundations
Branded policy pack issued. Incident response plan written. Quick wins started — MFA coverage, patching SLA, restore testing, privileged account cleanup. Evidence collection configured, so proof starts accumulating.
- Days 61–90
Operating rhythm
First board pack. Tabletop exercise with the executive team. Tier-1 vendor assessments underway. The roadmap moves from a document to a tracked program.
What we need from you
- An executive sponsor with authority to decide — without one, a vCISO produces recommendations nobody acts on
- Read-only access for evidence collection: cloud tenants, identity provider, endpoint console
- A named technical counterpart who can implement
- Attendance at the monthly leadership meeting
- Honesty in discovery — we will find what is there anyway, and finding it early is cheaper
What you have after 90 days
- A costed roadmap your board has seen and approved
- A complete, branded policy set with evidence attached to each control
- A risk register in both board language and dollars
- An incident response plan that has been rehearsed, not just written
- Continuous control evidence accumulating without anyone chasing it
- A security executive accountable for all of it, backed by the whole practice
A 20-minute call, then a written proposal
We confirm scope and the framework that binds you, then send a written proposal with a fixed monthly retainer and a start date.
Book a vCISO discovery call