Virtual CISO services and compliance programs for small and mid-sized companies, built to hold up when a customer, an auditor, or a regulator looks closely.
Three situations account for most engagements. If yours looks like one of these, we should talk.
A framework has become a condition of doing business. I build the program end to end — risk analysis, policies, controls, and the evidence to back them up — so it survives the first serious look.
Start with a Readiness Assessment ($6,500 fixed), then a Program Implementation.
An enterprise customer sent a questionnaire and the answers aren't there yet. I organize the evidence, answer what's answerable, and close the gaps that are holding up signature.
Fixed-fee option: the Deal-Unblock Sprint, $3,500.
You need someone accountable for the security program without carrying a full-time executive. A virtual CISO on retainer covers the roadmap, vendor risk, and board and customer reporting.
What it costs: vCISO retainers run $2,000, $6,500, or $12,000 per month depending on scope, billed monthly against a written scope of services. Project work such as a framework implementation is quoted as a fixed fee. See the tiers.
A paid first step with a defined result and a set price, before any retainer.
$3,500 fixed
One stalled security questionnaire answered in 10 business days.
$6,500 fixed
Know exactly where you stand against one framework, with a 90-day plan.
100% of the assessment fee is credited toward an implementation signed within 30 days.
Start with an assessmentFrom $30,000 fixed
ISO 27001 or SOC 2 built and audit-ready.
Different requirements, the same discipline: what you’re actually obligated to do, a ranked gap assessment, controls written for how you operate, and evidence that holds up.
For B2B SaaS and service companies whose enterprise customers want an independent report on their controls.
For companies selling internationally or to buyers who require an accredited certificate for the ISMS.
For healthcare providers, health plans, and the software and service vendors that handle their patient data.
For defense contractors and subcontractors that handle federal contract information or controlled unclassified information.
For merchants and service providers that store, process, or transmit payment card data, or can affect its security.
For companies that need a defensible security program and a common language for boards, insurers, and customers.
For mortgage lenders and brokers, fintechs, auto dealers that arrange financing, tax preparers, and other non-bank financial institutions.
Not sure where you stand? Start with a Readiness Assessment ($6,500 fixed) against one framework; 100% of the fee is credited toward an implementation signed within 30 days. Certification and attestation are issued by independent auditors and certification bodies; my role is getting you ready to pass.
Most clients have between 20 and 1,000 people and a requirement they haven’t had to meet before.
Mortgage lenders, fintechs, credit unions, and their service providers facing examiners, bank partners, and investors.
GLBA · NYDFS · FFIEC · SOC 2 →Enterprise deals stuck in security review, and the SOC 2 or ISO 27001 program that stops it happening again.
Questionnaires · SOC 2 · ISO 27001 →Also healthcare organizations and their vendors (HIPAA), defense contractors (CMMC), and merchants (PCI DSS).
No open-ended hourly arrangements. Scope and price are agreed before work starts.
Thirty minutes. What's driving the deadline, what's already in place, and what you're actually obligated to do — which is often narrower than you've been told.
A fixed fee against defined deliverables, each with a stated completion standard. You know what you're getting and what it costs before anyone signs.
The program is yours to run when I'm done — editable policies, a live risk register, and a compliance calendar. Retainer support afterward is optional, not assumed.
Every engagement is scoped and priced to what the situation actually requires. Retainers are scoped separately.
How I handle your data: I use business AI tools that don’t train on client data, and every deliverable gets a human review from me before it reaches you.
I'm Jason Hamilton. I've spent 30 years in IT and security, with security leadership roles across financial services, healthcare, technology, and defense — building and running programs in regulated environments where the work has to hold up under outside scrutiny.
Most of my work is with small and mid-sized companies facing a requirement they haven't had to meet before. They rarely need a scaled-down enterprise program. They need the parts that carry real weight, documented well enough to defend, and nothing they'll never use.
I've worked across the major regulatory and security frameworks. Whatever standard is in front of you, the conversation starts the same way: what are you actually obligated to do, and what will it take to prove it.
Not ready for an engagement? The same guidance, written down for you to work through yourself.
Forty pages on where to start when nobody in the building owns security yet.
$27167 pages. The full program, structured so you can build it without me.
$297What to do in the first 72 hours, and who to call in what order.
$27Thirty minutes, no pitch. Pick a time below, bring your deadline and whatever you’ve got so far, and we’ll scope it honestly.
Loading available times… If nothing appears, open the calendar in a new tab.
Prefer email? jason@ineedaciso.com