vCISO for NIS2: what the role must cover and what stays with management

Does your NIS2 program need a vCISO or a security officer?

NIS2 does not require a specific job title, but Commission Implementing Regulation (EU) 2024/2690 requires at least one person to report directly to the management bodies on network and information system security (Annex, point 1.2.3). That person can be a full-time employee or an external vCISO, and the choice is yours. If a customer questionnaire, contract clause or national authority now asks for a named security role, the first step is to confirm whether your entity is in scope at all, then decide who can meet the reporting line in practice. The duties attached to that role, the reviews it runs and the accountability it carries depend on your entity size, your sector and whether your national authority classifies you as essential or important. Your organization owns its controls and its decisions. An implementation partner or vCISO can prepare the systems, documents and evidence, but only an independent auditor or assessor issues reports, so the role should be scoped to produce evidence that such a reviewer can test.

Before appointing anyone, write down the duties you expect the role to perform: maintaining the risk assessment, reporting residual risk to the board, running the annual review of personnel assigned to security roles (Annex, point 10.1.3), and coordinating incident handling against the Article 23 clocks. Then check whether the candidate can actually hold the line on those duties. An external vCISO works well when the scope is clear and the entity lacks the internal capacity to fill a senior role, but the contract should name the individual, the hours or days expected, the escalation path to management and the handover of documents at exit. An internal officer keeps institutional knowledge in-house but must have enough seniority and budget to report to the board without filtering. Ask any candidate how they would keep the independent reviews outside their own line of authority (Annex, point 2.3.2), because a vCISO who also operates the controls they review will struggle to satisfy that point without additional impartiality measures.

Management keeps the accountability either way. Article 20(1) makes the management body of an essential or important entity liable for infringements of Article 21, and Article 20(2) requires its members to follow training that lets them assess cybersecurity risk-management practices. Implementing Regulation 2024/2690 also expects mechanisms ensuring that board members understand their role and act within their authorities (Annex, point 10.1.2(c)). Outsourcing the role does not transfer this duty. Management should record which risks it accepts, or which accountable person accepts them on its behalf with adequate reporting upward (Annex, point 2.1.1), and should review the vCISO's contract and performance at the same planned intervals it uses for other security roles. The NIS2 Article 20 text on EUR-Lex sets out these governance duties, and your national transposition law may add detail to them.

Which security role model fits your organization

This table compares four ways to staff the NIS2 security role: an in-house security officer, a part-time fractional vCISO for one entity, a shared virtual CISO service and a designated employee supported by a vCISO advisor. Read each column for when the model fits, who accepts risk, how the reporting line to management is met and what an internal person must still cover. The main takeaway is that the role model changes who does the work, but accountability for the decisions stays with management and an external vCISO cannot review controls they designed.

Role model	In-house security officer	Fractional vCISO for one entity	Shared vCISO service across entities	Designated employee with vCISO advisor
When it fits	Larger entities with enough security workload to justify a full-time role and steady internal hiring	Mid-sized entities that need senior direction part-time and have a capable internal technical lead	Groups or small entities that share a common platform and want consistent governance across several legal entities	Entities with a suitable internal employee who can take the role, backed by outside advice on specific decisions
Who signs off risk acceptance	Management body, or an accountable person with authority to manage risk, with adequate reporting to the management body	Management body or the accountable person named in the risk policy, not the vCISO alone	Each entity's management body must accept risk for its own systems, even when the shared service prepares the analysis	Management body, informed by the employee; the advisor recommends but does not accept risk
How the direct reporting line to management is met	Role reports directly to the management body, which should be written into the role description and governance minutes	VCISO attends management sessions on a set schedule and reports directly, with the contract naming this duty	Reporting line must reach each entity's management body separately, so confirm the service provides this for every entity	Designated employee reports directly; the advisor supports the reports but does not replace the line
What an internal person must still cover	Staff time for daily operations, access reviews and day-to-day incident contact	Named internal owner for daily operations, asset data, access approvals and incident contact	Named internal contact in each entity for systems, data and local incident handling	Employee carries daily operations, evidence collection and the management reporting itself
Independent review of work they designed	Independent reviewer must sit outside the line of authority of the area reviewed, or use alternative impartiality measures	The vCISO cannot act as the independent reviewer of controls or policies they designed, so an internal or external reviewer is still needed	Same limit applies: the shared service cannot review its own design, so reviews need a separate reviewer	The advisor should not review their own advice; an independent reviewer must be appointed
Annual review of security role assignments	Management reviews the assignment of the role at least annually and when circumstances change	Management reviews the contract and role assignment at least annually, including the scope of the external person	Each entity's management reviews its own assignment at least annually	Management reviews the employee's assignment and the advisor relationship at least annually
Training for management members	Management still completes its own training, which no role model can delegate	Management still completes its own training; the vCISO can provide the content but not the duty	Each entity's management completes training separately	Management completes its own training, with the advisor helping to design the content
Ask before signing	Confirm the job description, reporting line and budget authority in writing	Confirm hours, reporting attendance, named internal owner and who attends audits or supervisor meetings	Confirm the reporting line for each entity, conflicts between entities and the internal contact in each	Confirm the employee's time allocation, the advisor's scope and who reviews the advisor's work

Who does what: management, the security officer, the vCISO and the independent reviewer

The management body keeps the accountability for NIS2 risk management. Under Article 20, members must approve the Article 21 measures, oversee how they are carried out, and can be held liable for the entity's infringements of Article 21. Approval is a decision the board records, not a delegation it can forget. Members also have to follow cybersecurity training so they can identify risks and judge whether the entity's practices are adequate for its services. Implementing Regulation 2024/2690 adds that mechanisms must ensure members understand and act in line with their role, responsibilities and authorities for network and information system security.

Approval: Board minutes should show that the risk assessment, residual risks and the Article 21 measures were reviewed and approved.
Oversight: Set a recurring agenda item where the security officer reports on open risks, incidents and remediation.
Risk acceptance: Management accepts residual risk itself, or formally delegates that authority to a named accountable person with reporting back to the board.
Training: Keep records of completed training for each member, covering the risks and the entity's specific services.
Liability: Confirm with counsel how national transposition law assigns liability, since it varies by Member State.

Check that the board can show, from its own records, what it decided and what it was told.

What the security role must do under Implementing Regulation 2024/2690

Implementing Regulation 2024/2690 sets specific expectations for who runs security and how management is kept informed and independently checked. The four duties below shape the job description, the reporting line and the governance calendar of any vCISO or security officer an entity appoints.

Direct reporting to management

The regulation requires at least one person to report directly to the management bodies on the security of network and information systems. For a fractional vCISO, this means a standing agenda slot at management meetings, not a report that passes through an IT director first. Check that the contract names the reporting line, the frequency of briefings and who receives written risk updates. The organization owns this duty, and the minutes of those briefings are the evidence an assessor will ask to see.

Annual review of security role assignments

Entities must review who holds security roles at planned intervals and at least once a year. This catches gaps created by departures, outsourcing changes or a vCISO whose time commitment has shrunk. The review should confirm each named role, its responsibilities and its capacity, and record any reassignment. Ask your provider how the review is documented and who signs it off. Management owns the decision, and the signed review record is the evidence.

Independent reviews of security work

Reviews of the security program must be carried out by people with audit competence who sit outside the line of authority of the area being reviewed. A vCISO who also runs the security operations they oversee cannot independently review that work. Where the entity is too small to separate these lines, the regulation accepts alternative impartiality measures, which must be documented and justified. Confirm who performs the review, their audit skills and how their findings reach management. The internal audit function or an external reviewer typically owns this duty.

Mechanisms for management understanding

The regulation requires mechanisms that help members of management understand their role, responsibilities and authorities for network and information system security. In practice this means structured briefings, decision papers that explain risk in business terms and a short record of what each board member has been trained on and has approved. Ask your vCISO to show how they translate technical findings into decisions management must make. Management remains accountable for understanding these matters, and the briefing records and training completion records are the evidence.

Why the reporting line decides whether a vCISO model works

A vCISO model only meets the NIS2 governance requirement if the role reaches the management body directly. Implementing Regulation (EU) 2024/2690 requires at least one person to report directly to the management bodies on network and information system security, so a title on an org chart that routes through the CIO or a department head does not satisfy it. In practice, the vCISO should own a standing item on the management body agenda, present a short paper each cycle, and be able to answer questions without an intermediary. The papers should show the top risks from the risk register, the residual risks that remain after the Article 21 measures are applied, the status of open remediation items, and any significant incidents or near misses since the last meeting. Where the regulation allows management or accountable persons to accept risk, the minutes should record who accepted which residual risk, on what information, and with what review date. Ask the provider to show a sample paper and a sample minute before signing, and confirm that the minutes are kept in a form a supervisor could read.

Impartiality is the harder design question when the vCISO also runs the controls. Independent reviews must be carried out by people with audit competence who sit outside the line of authority of the area reviewed, or under alternative impartiality measures where the entity's size does not allow that separation (Implementing Regulation 2024/2690, Annex, point 2.3.2). A vCISO who configures the logging platform cannot be the only person who reviews it. For a small entity, the usual options are an internal audit function that reports to a board committee, a separate assessor engaged for the review cycle, or documented alternative measures such as a peer review by a second qualified person and a review of the vCISO's own work by a board member. The choice, and the reason it suits the entity's size, should be written into the security governance documents and approved by the management body. Ask the vCISO to name who reviews their work and when.

The annual review of security roles also belongs in this model. Entities must review the assignment of personnel to security roles at planned intervals and at least annually (Annex, point 10.1.3). The management body should therefore decide, once a year, whether the vCISO's mandate, time commitment, and authority still match the entity's risk profile. Confirm with the provider how many days per month the vCISO will spend on your entity, who covers absence, and what happens to evidence and access if the engagement ends. These are commercial and governance questions that should be settled in writing before the role starts, not after the first supervisory inquiry.

How to appoint and run the role in the first year

The sequence turns a vCISO or security officer appointment into a documented accountability chain, with the management body informed, trained and holding the decisions it must own. Each step leaves a record that a supervisor or independent reviewer can inspect.

Define the role and its authority in writing
Management and the HR or legal function draft a role description that states the person's responsibilities for network and information system security, the decisions they may take alone, the decisions reserved for the management body, and who they report to. The security officer or CISO should review it before sign-off. The step is complete when the signed role description is filed with the security policy set and the management body has approved it in a recorded decision.
Choose the employee, fractional or virtual model
The organization decides whether the role is filled by a permanent employee, a fractional executive shared with other companies, or a virtual CISO service delivered by an external firm. The decision rests on the entity's size, the complexity of its systems and the time the person can give to the role. Whichever model is chosen, the named individual must be identified in writing, and the contract or job description must state the authority and the reporting line. The output is a short decision note and the appointment letter.
Put the reporting line on the management agenda
Implementing Regulation 2024/2690 requires at least one person to report directly to the management bodies on network and information system security. The appointee should be placed on the agenda of management body meetings at a set cadence, with a standing item for security risk, incidents and open decisions. The step is done when the minutes record the reporting line and the first security report has been received and discussed.
Complete the management body training
Article 20(2) of NIS2 requires members of the management body to follow training that gives them enough knowledge and skills to identify cybersecurity risks and assess the entity's risk-management practices and their effect on its services. The training should be scheduled for every member, not only the chair, and should cover the entity's own risk picture. The step closes when attendance records and training content are on file, and the security officer confirms that members can explain their role under the same Annex mechanisms that govern understanding and action.
Set up the risk acceptance cycle
The security officer prepares the risk assessment results and residual risk register for each cycle. Under Implementing Regulation 2024/2690, residual risks are accepted by the management body or by accountable persons with authority to manage risks, provided the entity reports adequately to the management body. The organization should record who may accept which risk levels, the review date for each acceptance and the reporting route. The output is a risk acceptance record, signed or minuted, for each accepted residual risk.
Schedule the independent review
Independent reviews must be carried out by people with audit competence who sit outside the line of authority of the area under review. Where the size of the entity does not allow this, alternative impartiality measures must be documented. The organization should decide who performs the review, whether an internal audit function, an external assessor or a combination, and set a review plan that the management body approves. The step is complete when the plan is minuted and the first review report is delivered to the management body with findings and an action owner for each.
Fix the annual review of role assignments
Entities must review the assignment of personnel to security roles at planned intervals and at least annually. The review confirms that the appointee still holds the authority, time and skills the role needs, and that backups for critical security tasks are named. Management should record the review outcome, any change to the role description or reporting line, and any new appointment. The output is a dated review record that feeds into the next year's management body agenda.

Risk acceptance and liability stay with management

Under Article 20(1) of NIS2, management bodies of essential and important entities can be held liable for the entity's infringements of Article 21. A vCISO can prepare the decision, but cannot take it on the board's behalf. Implementing Regulation 2024/2690 (Annex, point 2.1.1) allows risk assessment results and residual risks to be accepted either by the management body or by accountable persons who have authority to manage risks, and only where the entity ensures adequate reporting to the management body. In practice, that means the board or an empowered executive signs off on each accepted residual risk, and the minutes or decision record show what was accepted, by whom and on what basis. What a vCISO can usefully prepare includes the risk assessment itself, the register of identified risks with their likelihood and impact, and a set of treatment options for each material risk: remediate, transfer, avoid or accept. For each option the vCISO should estimate the cost of the measure, the effort it needs and the residual risk left afterward, so the board can compare them. Those cost figures come from the vCISO's own quotes and the entity's environment, not from a standard, so the decision paper should state where each number came from. What the vCISO cannot decide is whether the entity accepts a residual risk, reallocates budget or delays a measure. Those choices belong to management, and the vCISO's written advice should say so. Liability rules are not uniform. Article 20(1) expressly leaves national liability rules for public institutions, public servants and elected or appointed officials untouched, so public-sector entities may face different personal exposure than private companies under the national transposition law. Ask counsel to confirm which regime applies to your entity in your Member State, how personal liability and any D&O cover interact with NIS2, and whether the vCISO's reporting line and written advice create a record that protects directors. Legal advice on these questions should come from qualified counsel, not from the vCISO or an implementation partner.

What usually breaks a vCISO arrangement and how to prevent it

A vCISO arrangement rarely fails on expertise. It fails on authority, reporting, independence, and time. The cards below cover six failures we see most often, each with the early warning sign and the fix that keeps NIS2 accountability with the management body.

No written authority

The vCISO has a job title but no document that says what they may decide, approve, stop or escalate. Early sign: they ask a department head for permission to change a firewall rule or to pause a risky project. Fix: a signed mandate from the management body that lists decision rights, budget limits, and the duty to report security risk to the board. Check that the mandate covers the Article 21 measures and the authority to require remediation from other departments.

Reporting line that exists only on paper

The org chart shows the vCISO reporting to the board, but the actual meetings are held with the CIO, or the board sees security only as a line in a quarterly IT update. Implementing Regulation 2024/2690 requires at least one person to report directly to the management bodies on network and information system security, so a nominal line does not satisfy it. Early sign: no minutes record a security item the vCISO raised. Fix: a standing agenda slot with a written risk report, and a record of each session kept by the company secretary or equivalent.

Same person designs and reviews controls

When the vCISO writes the access control procedure and then signs off that the procedure works, nobody has checked it. Implementing Regulation 2024/2690 expects independent reviews by people with audit competence outside the line of authority of the area reviewed, or alternative impartiality measures where size does not allow this. Early sign: the same name appears as author and approver on every security document. Fix: assign an internal audit function, a second reviewer, or an external assessor for periodic reviews, and record who reviewed what.

No record of risk acceptance

Teams defer patches, accept legacy systems or postpone segmentation work, and nobody records the decision. Under Implementing Regulation 2024/2690, risk assessment results and residual risks must be accepted by the management body or by accountable persons with authority to manage risks, with adequate reporting to the management body. Early sign: open risks appear in a tracker with no owner name and no approval date. Fix: a risk register where each residual risk carries a named acceptor, a rationale, an expiry date, and a board-level summary for anything above the threshold the management body sets.

Management training never scheduled

Article 20(2) requires members of the management body to follow training that gives them enough knowledge and skills to identify cybersecurity risks and assess the entity's risk-management practices. Plans often name training as a goal, then the calendar never reflects it. Early sign: board members cannot describe the top security risks or the reporting clocks for a significant incident. Fix: schedule the training in the board calendar before the vCISO starts, record attendance and content, and repeat it when the risk profile changes. Ask for the course outline before you sign.

Shared vCISO stretched across too many entities

A fractional vCISO covering many organizations can attend only a few hours per client each month, which is rarely enough for incident exercises, risk reviews and board reporting. Ask how many entities the individual covers, which ones they cover in the same week, and who deputizes when they are unavailable. Early sign: monthly reports are generic, and the vCISO has not seen your network diagram or your last incident. Fix: a written time commitment in the contract, a named deputy with the same access, and a cap on concurrent clients agreed before signing.

Common questions about a vCISO for NIS2

Does a fractional vCISO satisfy the NIS2 security officer requirement on its own?

A fractional vCISO can fill the role that reports to management, but the requirement is about who holds the role and how it is run, not about the contract type. Implementing Regulation (EU) 2024/2690 requires at least one person to report directly to the management bodies on network and information system security. A vCISO meets that test only if the arrangement gives them direct access to management, a clear mandate, and enough time in the entity to act. The organization still owns its measures, and management still carries accountability under Article 20. Ask the candidate to show how they will report, how often, and which decisions they can escalate without an internal intermediary.

Can the same vCISO also act as the independent reviewer?

Usually not. The Implementing Regulation requires independent reviews by people with audit competence who sit outside the line of authority of the area being reviewed. A vCISO who designs, runs or advises on the controls is inside that line for the same controls, so reviewing their own work fails the test. Where company size does not allow full separation, the regulation accepts alternative impartiality measures, which must be documented and justified. Plan the independent review as a separate engagement, with a reviewer who has not built the controls, and record how impartiality is ensured.

How much time does a vCISO role need, and what drives it?

The time a vCISO needs depends on the entity's scope and maturity, not on a fixed formula. The main drivers are the number of in-scope systems and suppliers, the number of Member States and legal entities covered, whether the entity already has policies and tested controls, the volume of incidents and reporting duties, and how often management reviews are held. A mature program with documented roles needs time mainly for oversight, reporting and annual reviews. A program starting from scratch needs more time up front for the risk assessment and policy set. Ask any provider to state the expected time per month, the activities it covers, and what would change the estimate.

Can one shared vCISO cover a group of several entities?

A shared vCISO can be workable for a group, but each in-scope entity must still have a person reporting to its own management body. The Implementing Regulation's governance requirements apply per entity, so a shared role must give each management body direct access and show that the role has enough time and authority for each one. Conflicts between entities, different sector rules and separate supervisors all raise the bar. Confirm in writing which entities the person covers, how many hours they commit to each, and how they handle a serious incident affecting two entities at once.

What must the annual review of security role assignments record?

The annual review should record who holds each security role, whether that person still has the skills and time the role needs, and whether the assignment still fits the organization's structure. The Implementing Regulation requires entities to review the assignment of personnel to security roles at planned intervals and at least annually. A useful record names each role, the holder, the review date, the reviewer, any gaps or changes, and the management decision that followed. Keep the signed minutes or decision record as evidence. For a vCISO arrangement, the review should also confirm the contract scope and reporting line still match what is in place.

What must management do personally, and what can it delegate?

Management must approve and oversee the risk-management measures, understand the risks, and act on the reports it receives. Article 20 of NIS2 makes management bodies responsible for oversight and can hold them liable for infringements of Article 21. Management members must also complete training that gives them enough knowledge to identify risks and assess the entity's practices. The vCISO can prepare analysis, recommendations and evidence, and can run day-to-day work. Management still decides on risk acceptance, which the Implementing Regulation allows only with adequate reporting to the management body or to accountable persons holding that authority. Write these decisions into the governance record.

How should a buyer check a vCISO candidate's experience?

Check experience against the NIS2 duties the role must perform, not against job titles alone. Ask the candidate to describe prior work on risk assessments, governance reporting to a board or management committee, incident response with reporting clocks, and supplier oversight. Request references from roles where they reported to a management body, and ask how they handled a disagreement with management about risk. Confirm their knowledge of the Implementing Regulation and of ENISA's technical guidance, and ask how they keep current. Verify certifications and employment claims independently before signing, and make sure the contract names who performs the work.

What will the vCISO hand over when the engagement ends?

A good handover leaves the entity able to run the program without the vCISO. Ask for the governance records, the current risk register and risk acceptance decisions, the policy set with version history, the role and responsibility matrix, the annual review records, the training records for management, the incident response plan and its latest test record, and a list of open actions with owners. Also request credential and access revocation, a written summary of supplier obligations, and the evidence location for each control. Agree the handover format and timing in the contract, and check that the documents are stored in systems the entity controls.

How DeployOpen prepares the security role and its evidence

DeployOpen works on the security role as a set of documented systems, controls and evidence inside your own infrastructure. The organization keeps ownership of the role, the risk decisions and the reporting to management, while DeployOpen prepares the platforms, records and review packs that make those duties visible to an assessor.

How we scope

Agree in writing which security role duties DeployOpen supports, such as the evidence pack for management reporting and the annual role review record
Confirm which named person holds the security role and who they report to in the management body
Engagements are fixed-scope, with deliverables and timelines agreed before work starts; ongoing support is available as a retainer

How we build

Set up risk register, residual risk acceptance and training records in self-hosted tools that your own team can read and update
Prepare an independent review plan that states who reviews which area and how impartiality is protected at your size
Build management reporting templates that show risk, incidents and open actions for the management body to review

How we hand over

Deliver documented procedures, runbooks and evidence folders in your environment, with named owners for each record
Walk the security officer and management body members through how to review, approve and update the records
Provide a list of decisions that remain with management so accountability is recorded in one place

How we support

Offer retainers for periodic reviews of role assignments, risk records and training evidence against your written scope
Update documentation after platform upgrades, organizational changes or new supervisory information requests
Confirm with your auditor or competent authority which evidence they expect, since DeployOpen prepares evidence but does not issue reports or certificates

Hiring a vCISO or security officer for NIS2