Nownet Security
Home / Services / Consultant and interim CISO
Service

Consultant and interim CISO for regulated firms

Senior security leadership without the cost or delay of a permanent hire. We set your security strategy, own the risk conversation with your board and regulators, and build the capability that carries it forward.

Discuss your needsSee packages

When firms bring in a consultant CISO

  • Your CISO has left and the role needs covering while you recruit
  • You're growing into regulated activity and need security leadership in place
  • A regulator, auditor or major client has raised findings that need an owner
  • You have security staff but no one setting direction at board level

What's included

  • Security strategy and operating model: a clear plan tied to business risk, with roles, responsibilities and a roadmap
  • Board and executive reporting: risk explained in business terms, with honest status rather than everything marked green
  • Regulatory engagement: preparing for and supporting conversations with the FCA and other regulators, auditors and clients
  • Policy and control framework: aligned to ISO/IEC 27001, NIST CSF, PCI DSS and operational resilience requirements
  • Team and supplier leadership: directing internal staff and managed service providers, and hiring your permanent successor if needed

How an engagement runs

  1. Discovery. A short review of your current position, obligations and priorities.
  2. Agreed scope. Fixed-scope or ongoing part-time leadership, with days and outcomes agreed up front.
  3. Delivery. Regular reporting to your executive and board, with clear ownership of actions.
  4. Handover. Documented decisions and a smooth transition to your permanent team.

Virtual CISO packages

Ongoing security leadership from a named senior consultant, for a set number of days each month. Every engagement starts with a Security Baseline, which shows where you stand and which package fits.

Security Baseline

Fixed scope, 3 to 4 weeks

From £4,950

The starting point for every engagement.

  • A review of your current security position, with a risk register
  • A 90-day plan and a 12-month roadmap
  • A briefing for your leadership team

Essentials

2 days a month

From £2,950 a month

For organisations of 20 to 100 people appointing their first security leader.

  • A named virtual CISO, with a monthly call and written update
  • Core security policies and a live risk register
  • Help answering customer security questionnaires
  • A quarterly report to your leadership team
  • An incident response plan, tested once a year

Professional

4 days a month

From £5,500 a month

For organisations of 100 to 250 people, or firms selling to banks and large enterprises.

  • Everything in Essentials
  • Leadership of ISO 27001 or SOC 2 readiness
  • A supplier risk process for your key suppliers
  • Attendance at two board meetings a year
  • Staff training and quarterly phishing tests

Regulated

8 days a month

From £10,500 a month

For FCA-regulated firms, and organisations of 250 to 500 people.

  • Everything in Professional
  • Attendance at board and risk committee meetings
  • A control framework mapped to your FCA duties, and DORA where it applies
  • Oversight of third-party and outsourcing risk
  • Leadership of your response to security incidents

Guide prices, excluding VAT. The final price depends on the size and complexity of your organisation, and we confirm it in writing before any work starts.

Add-on projects

Fixed-scope projects you can add to a package or buy on their own.

  • ISO 27001 certification programmeWe build your information security management system and support you through the certification audits.From £14,950
  • AI governance readiness checkAn AI inventory, AI policy, risk assessment and ISO/IEC 42001 gap analysis.From £5,950
  • Incident response plan and playbooksPlaybooks for ransomware, invoice fraud, data breaches and supplier outages.From £3,450
  • Tabletop exerciseA half-day exercise for your leadership team, with written lessons.From £2,450
  • IT provider assurance reviewAn independent check of your outsourced IT provider.From £3,950
  • Board cyber briefingA session for directors on the government's Cyber Governance Code of Practice.From £1,950
  • Cyber Security and Resilience Bill readinessA scope check, gap review and preparation for the proposed incident reporting deadlines.From £6,950
  • Operational resilience security reviewA review of the security controls behind your important business services.From £7,450
  • Penetration test scoping and oversightWe choose and brief a CREST-accredited tester, then agree the fix plan with you.From £1,950
Ask for a quote

Relevant experience

Global payments

As consultant CISO for an international payments business, Phil founded a security architecture practice from scratch and strengthened identity and privileged access across the cloud estate.

Frequently asked questions

What does a consultant CISO do?

A consultant CISO provides the same leadership as a permanent Chief Information Security Officer, on a part-time or fixed-term basis. That covers security strategy, risk reporting to the board, regulatory engagement and directing the security team and suppliers.

How is an interim CISO different from a virtual CISO?

An interim CISO usually covers a vacancy full-time or close to it for a set period. A virtual or fractional CISO works a few days a month on an ongoing basis. We offer both, depending on what you need.

Do you work with FCA-regulated firms?

Yes. Our experience is in regulated financial services, including payments, digital banking and work for a UK financial regulator.

Where do you work?

We're based in London and work with clients across the UK, combining on-site and remote working.