A Virtual CISO is an experienced Chief Information Security Officer working for your organization on a fractional, dedicated basis – typically 1 to 4 days per month, with named individuals (not anonymous staff). The vCISO leads your information security and compliance program, sets the security strategy, runs the risk register, owns regulatory interactions (NIS2, DORA, ISO 27001), and reports to your board. Toreon’s vCISOs are senior consultants with 10+ years of CISO-level experience; engagements are scoped, paced, and quality-assured by the same person who delivers them.

The terms are largely interchangeable in 2026 practice. ‘Fractional CISO’ emphasizes the part-time nature (‘a fraction of a CISO’); ‘Virtual CISO’ originally emphasized remote-first delivery. Toreon delivers what the market calls fractional vCISO services: a named senior consultant on a recurring monthly cadence, with on-site presence for board meetings or audit work and remote engagement for everything else. The difference that matters more is whether you get a senior named individual (Toreon’s model) or a rotating pool of junior-staffed delivery (some competitors).

A Toreon vCISO leads four streams: (1) Strategy and roadmap – sets the multi-year security maturity plan and aligns it with business goals, (2) Compliance and audit – owns NIS2, DORA, ISO 27001, GDPR Article 32 audit cycles and prepares evidence, (3) Risk and policy – runs the risk register, drafts and maintains policies, makes risk acceptance decisions with stakeholders, (4) Program leadership – leads cross-functional security improvement projects, manages vendors, reports to executive leadership. Day-to-day execution (vulnerability scanning, monitoring, incident triage) is handled by the supporting Managed Security Office (MSO) team.

The vCISO provides leadership and decision-making (strategy, policy, risk, audit). The Managed Security Office (MSO) is the operational backoffice that executes the vCISO’s roadmap: vulnerability scanning across IT and OT, phishing awareness programs, privacy and compliance advice, security KPI tracking, FAQ and 8/5 support. The two services work together – the vCISO delegates operational tasks to the MSO, freeing strategic time for board reporting, regulatory work, and program leadership. This combo is unique in the European vCISO market.

European regulations explicitly require security leadership: NIS2 (Article 21) requires risk management measures and accountability; DORA (Article 9) requires ICT governance with senior leadership oversight; ISO 27001 (Clause 5.3) requires top-management security accountability. A vCISO satisfies these leadership obligations without full-time headcount. Toreon’s vCISOs prepare the audit evidence, lead the certification programs (ISO 27001 in 6-12 months, NIS2 readiness in 4-6 months), maintain the policy stack, and represent the client in regulatory interactions including NIS2 incident reports to the Centre for Cybersecurity Belgium (CCB).