Prices, cost drivers and 2026 rules
vCISO pricing in Australia: retainers, day rates and what a virtual CISO delivers
How virtual CISO services are priced (monthly retainers, day rates, fixed programs), typical deliverables, an illustrative 12-month budget and how to avoid paying for reports.
A vCISO (virtual chief information security officer) is part-time security leadership, usually sold as a monthly retainer for a set number of days, a day rate for ad hoc work, or a fixed-price program for a defined outcome such as an Essential Eight roadmap or a security policy set. In the illustrative example below, a 12-month vCISO program at two days a month costs $43,200 ex GST, which is far less than a full-time security executive but buys advice and governance, not hands-on implementation. The right question is not "what does a vCISO cost?" but "what decisions and documents will we have at the end of the year that we do not have now?"
This guide belongs to the pricing overview. The work a vCISO plans is often delivered through Essential Eight uplift projects and managed services. Figures are illustrative, ex GST.
What a vCISO typically does
| Area | Typical deliverables |
|---|---|
| Risk | A cyber risk register in business language, reviewed quarterly |
| Governance | Security policies (acceptable use, access, backup, incident response), roles and responsibilities |
| Strategy | A 12–24 month roadmap, often mapped to Essential Eight maturity targets |
| Reporting | Board or owner reports on risk, incidents and progress |
| Suppliers | Security questions for key suppliers, review of managed service contracts |
| Incidents | An incident response plan and a tabletop exercise; support during real incidents |
| Customers and insurers | Answers to customer security questionnaires and insurer proposal forms |
| Compliance | Mapping obligations under the Privacy Act, contracts and any sector rules |
A vCISO usually does not configure firewalls, deploy agents or monitor alerts. If a proposal blends advice and implementation, ask for the two to be priced separately so you can see what you are paying for each.
Pricing models compared
| Model | How it works | Good for | Watch out for |
|---|---|---|---|
| Monthly retainer | Fixed fee for a set number of days or hours a month | Ongoing governance and reporting | Unused days may not roll over; check the rule |
| Day rate | Pay per day used | Occasional advice, one-off reviews | No guaranteed availability in a crisis |
| Fixed-price program | Set price for a defined set of deliverables | Roadmaps, policy sets, maturity assessments | Scope creep; anything outside the list is extra |
| Bundled with managed services | vCISO time included in an MSSP package | Smaller businesses wanting one supplier | Independence: the adviser may recommend the provider's own services |
The independence point matters. A vCISO employed by the provider that sells you MDR is not neutral when assessing whether you need more MDR. That is not necessarily a problem, but you should know it and consider an occasional independent review.
Illustrative 12-month budget
| Item | Calculation | Cost |
|---|---|---|
| Retainer, 2 days a month | 24 days × $1,800 | $43,200 |
| Alternative: 1 day a month plus a fixed program | 12 × $1,800 + $15,000 program | $36,600 |
| Alternative: day rate as needed | estimated 15 days × $2,000 | $30,000 |
The cheapest option on paper is the day rate, but it gives no guaranteed availability and tends to be used reactively. The retainer costs $13,200 more than the day-rate estimate ($43,200 − $30,000). That premium buys a regular cadence of reviews and reporting, priority access, and continuity of someone who knows your business.
A first-year program for a 30–80 person business might look like this:
- Months 1–2: current-state review, risk register, Essential Eight maturity snapshot.
- Months 3–4: policy set, incident response plan, supplier review of the MSSP contract.
- Months 5–8: roadmap delivery oversight; quarterly board report.
- Month 9: tabletop exercise based on a ransomware scenario, including the reporting timeline.
- Months 10–12: re-assessment, next-year roadmap and budget.
How to judge value
- Outcomes in the contract. Ask for a list of deliverables per quarter, not just "advisory services".
- Plain-language reporting. If owners or the board cannot understand the risk register, it is not doing its job.
- Experience with your size. A vCISO used to large enterprises may propose controls and documents a 30-person business cannot sustain.
- Clear authority. Decide who approves risk acceptance. The vCISO advises; the business decides.
- Exit. Make sure policies, registers and plans belong to you and are handed over in editable form.
Credentials such as CISSP, CISM or ISO/IEC 27001 lead auditor show training, but ask for examples of similar work (without confidential details) and speak to a reference yourself.
Frequently asked questions
Is a vCISO worth it for a 15-person business?
Often a short fixed program is a better fit: a risk review, a basic policy set, an incident response plan and an Essential Eight snapshot. An ongoing retainer makes more sense as the business, its data and its customer obligations grow.
Can my MSP act as my vCISO?
Yes, many do. Make sure the adviser can challenge the MSP's own service, and consider an independent review every year or two.
What should a vCISO not do?
They should not be the only person who knows where things are. All documents, passwords and decisions should sit with the business.
Do unused retainer days roll over?
It depends on the contract. Some allow rollover within a quarter, others expire monthly. Ask before signing.
Sources
- ASD's Australian Cyber Security Centre — Essential Eight, governance guidance and incident response planning resources
- Office of the Australian Information Commissioner — data breach preparation and response guidance
- business.gov.au — creating a cyber security policy for your business
