About the Virtual CISO category
What belongs in this category
The Virtual CISO category covers services in which an experienced security leader works for an organization part-time, on a fixed engagement or on demand. Typical entries set security strategy, build and run the program, write policies, prepare for audits, report to boards and investors, manage vendors, and lead the response when incidents happen. Some providers run a team of virtual CISOs, supported by tools and templates.
A full security program delivered by subscription fits Cybersecurity-as-a-Service (CSaaS), and assessments and audits as one-off projects fit Cybersecurity Assessment. A person who serves as a virtual CISO can be recognized in Chief Information Security Officer of the Year (CISO) or Cybersecurity Consultant of the Year.
Related categories to enter
Each category is judged separately, so you can enter a service in every category that matches what it delivers, with a separate nomination for each. Tailor each nomination to that category's focus. The provider behind the service can also be recognized in Cybersecurity Service Provider of the Year or Best Managed Security Service Provider (MSSP).
How entries are judged
An independent jury of security practitioners, analysts and CISOs scores each nomination on leadership, innovation and impact. Each nomination competes in its category against providers of similar size and region, so a small regional provider is not ranked against a global firm. Your entry package, any sponsorship and public votes do not affect the jury's scores.
Strong entries in this category show:
- Leadership — the leadership the service provides: clients served, the experience and credentials of the virtual CISOs, and the boards and executives they report to.
- Innovation — a leadership problem solved in a new way, such as a security program built in weeks, board reporting that drives decisions, or expertise matched to each client's sector.
- Impact — results for clients: maturity scores raised against a framework, audits and certifications passed, incidents handled, client retention. Give figures from clients, anonymized if needed.
The jury awards Gold, Silver or Bronze, or a Finalist badge, and results are published on this site and announced to the 600,000+ member Cybersecurity Insiders community. Every approved nomination also enters the separate Community Choice award, decided by public votes.
How to enter
A provider can enter its own service, and a PR agency can enter it on the provider's behalf. The nomination form has a confidential field for detail that is shared with the judges and not published, such as client names, contract figures or service levels. Deadlines, pricing and entry steps are on the How it Works page.