Frequently asked questions

A fractional CISO (or vCISO) takes on the role of information security lead on an agreed part-time basis: setting strategy, managing risk, prioritising investment, coordinating suppliers and reporting to the board.

It’s the usual choice when an organisation needs the function but can’t justify a full-time security executive.

Your IT provider keeps systems running. A fractional CISO makes sure risk is managed: what to protect first, what regulations require and how to demonstrate it.

I don’t replace your provider. I work with them and add the security governance that usually sits outside their contract.

No. Part of the job is turning technical issues into business decisions: what the risks are, what impact they could have and which measures are proportionate for your organisation.

I work remotely with organisations in Spain and abroad. In Madrid and the surrounding area I’m also available on site when the work calls for it: board meetings, audits or technical work.

Yes. Meetings and deliverables can be in English, Spanish or both.

If you process personal data about customers, employees or suppliers, the GDPR requires security measures appropriate to the risk (Article 32).

If you work with the Spanish public sector, you may also need to comply with the ENS, and the EU NIS2 Directive extends security obligations to new sectors and parts of their supply chains.

It depends on scope, the size of the organisation and what’s already in place. After the initial call and gap analysis, you’ll receive a written timeline.

No. That decision rests with the certification body. My job is to prepare the system and the evidence so your organisation goes into the audit in the best possible position.

Always with a written proposal before work starts. Projects are fixed-price; the fractional CISO service is billed as a monthly retainer; one-off needs are covered by a block of hours.

I sign a non-disclosure agreement before accessing sensitive information and, where I process personal data on your behalf, a data processing agreement under Article 28 of the GDPR.

All work is documented, and credentials and configurations are kept in your organisation’s systems, not mine. Planned absences are notified in advance and scheduled so they don’t affect agreed milestones.

Yes. The first step is to understand what happened and what was affected; then contain, recover and fix the root cause. If the case needs specialist forensic analysis, I’ll say so and coordinate with the right people. In these situations, it’s best to call.