vCISO services · fractional CISO · Client Vision by 3HUEThe CISO seat, filled.
3HUE's vCISO services put a fractional CISO in the seat, and everything they own in Client Vision. They declare your risk appetite, publish your information security policy, weigh every decision against tolerance, measure what the board holds you to, and report it the same way every quarter.
Screens show the Big Venture Incorporated demo workspace. All figures are sample data.
Trusted in regulated industriesA transit technology companyA large North American bankA marine services company
3 regulated industries10 business-day Snapshot100% executive-led delivery
What is a vCISO?
A security leader on your team, without the full-time hire.
A vCISO (virtual chief information security officer), also called a fractional CISO, is an experienced security executive who leads your program part-time or on retainer. They set risk appetite, write and publish policy, own security decisions, measure the program and report to your board.
Full-time CISO3HUE vCISO
Time to startMonths of recruitingWeeks, with a 90-day plan
CostExecutive salary and equityA fraction, scoped to your needs
BenchOne personA team behind the seat
Proof of workSlides and spreadsheetsEvery decision in Client Vision
How a fractional CISO runs your program
Seven words. Every screen is the real product.
Minimaloverall appetite, calculated from 12 declared tolerance areas
1,713actively exploited items, measured against an Averse ransomware tolerance
0 → 12controls carrying a policy statement after one standard was published
37KRIs and KPIs the board can hold the program to, 6 derived live
Figures from the Big Venture Incorporated demo workspace (sample data), Sep 24–25, 2026.
Free tool · risk appetite statement
Build your risk appetite statement in two minutes.
Pick a tolerance for each area. The overall appetite is calculated the way Client Vision does it: the median of what you declare, never typed in. Your choices stay in this browser.
What a fractional CISO delivers in 90 days
Day 30. Day 60. Day 90. Live in Delivery.
Day 30Foundations
- Risk appetite workshop with leadership
- Information security policy set, v1 published
- Metrics baseline recorded
Day 60Operate
- Treatment decisions weighed against tolerance
- Third-party review cycle
- Incident response tabletop exercise
Day 90Report
- First board report, frozen and branded
- Security roadmap for next year
- Master policy and standards compilation
Information security policy
Your information security policy, generated. Not templated.
Skip the IT security policy template. Your vCISO generates family standards from the controls you actually run, cross-walked to the frameworks you answer to, and writes the plain-English enterprise policy every employee acknowledges. Approved versions are published and frozen, so the document a customer received stays reproducible.
SOC 2 — TSC 2017ISO 27002:2022EU GDPR
- Our commitment to information security
- Acceptable use of technology
- Accounts, passwords and sign-in
- Protecting information
- Email, messaging and phishing
- Working remotely and on the move
- Reporting security incidents
- Third parties and cloud services
- Physical security
- Training and acknowledgement
Ways to work with 3HUE
See pricing for all three lanes →01 · Client VisionRun it yourselfFree workspace to start. Assurance adds CloudSignals, RiskOps and a governance pack; Multi adds all six. Annual or monthly.Start free →
03 · Managed by 3HUEWe run it with youA named vCISO and scoped programs (RMP, CIRP, ISP, VCP, SEA), run in the Client Vision plan you hold. Priced to your program in the builder.Book a vCISO strategy call →
vCISO services · two ways in
Your program. Your call on who sits in the seat.
Self-serve
Your team runs it.
- Declare risk appetite and see it measured against live posture
- Generate, approve and publish policy and standards
- Record decisions and metric readings on the record
- Freeze a branded board report whenever you need one
Fractional CISO by 3HUE
Or put a 3HUE vCISO in the seat.
- A named security leader who owns the program and the board conversation
- A 90-day plan, tracked live from the delivery workspace
- Policy, decisions and metrics done, not just advised
- The same platform, so every piece of work is provable
Questions
What leaders ask first.
What is a vCISO?
A vCISO, or virtual chief information security officer, is an experienced security executive who leads your security program part-time or on retainer. They set risk appetite, publish policy, own security decisions, measure the program and report to your board, without the cost of a full-time hire.
Is a vCISO the same as a fractional CISO?
Yes, in practice. Both describe a CISO who works for you part-time. "Fractional" emphasizes the share of time; "virtual" emphasizes that the role is delivered as a service. 3HUE's vCISO services cover both.
What do vCISO services include?
A risk appetite and tolerance declaration, an information security policy set, treatment decisions weighed against tolerance, a metrics program with KRIs and KPIs, a 30/60/90-day roadmap, and board reporting. With 3HUE, all of it lives in Client Vision.
How much does a vCISO cost?
A fraction of a full-time CISO. Engagements are scoped to your size, obligations and how much of the seat you need filled. Book a 15-minute call and we'll scope it with you.
What is a risk appetite statement?
A short statement from leadership on how much risk the organization will accept, area by area: regulatory, ransomware, data protection, third parties and so on. It gives every later decision a line to be measured against. Use the builder on this page to draft yours.
Does the vCISO report to our board?
Yes. Your vCISO presents the program to leadership and the board, using a frozen, branded report so the numbers are the same every time they're shown.
The CISO seat, filled.
Start with a vCISO strategy call: fifteen minutes, your questions, real screens.