What is a virtual CISO, and when should we consider one?
A virtual CISO (vCISO) is a senior security executive who provides the strategic leadership, governance, and board-level advisory of a full-time CISO on a fractional or contracted basis. Organizations typically consider a vCISO when they lack senior security leadership but need it, when they’re facing a major audit, certification, or M&A event, when they’re building or maturing a formal program, or when they’re navigating a specific challenge like a cloud migration, AI adoption, or post-incident remediation. CBTS vCISO engagements scale from focused project leadership to ongoing strategic oversight, with delivery from senior security executives who bring sector-specific expertise to the role.
How does an AI Risk Assessment differ from a traditional compliance assessment?
A traditional compliance assessment evaluates your security program against established frameworks (e.g., PCI, HIPAA, SOC 2, and NIST CSF) with mature controls and well-understood audit expectations. An AI Risk Assessment evaluates your AI footprint, including LLMs, agents, and AI-integrated workflows, against frameworks that are still emerging (EU AI Act, NIST AI Risk Management Framework, sector-specific guidance). While the assessment work overlaps in some areas, the risk model, control set, and governance expectations are different. CBTS recommends both for organizations adopting AI at scale, with the AI Risk Assessment focused specifically on the new exposures AI introduces and the governance work needed to manage them.
What does an incident response tabletop exercise look like?
A CBTS tabletop is a facilitated, scenario-based exercise that walks your leadership, security, IT, legal, and communications teams through a realistic incident. The exercise usually takes two to four hours. The facilitator presents an evolving scenario (often ransomware, business email compromise, third-party breach, or AI-related incident), surfaces decision points, and stress-tests your existing playbooks, escalation paths, and inter-team coordination. Output is a written findings report with specific recommendations for improvements. CBTS clients often gain a much clearer shared understanding across the leadership team of what would happen in a real incident.
Which compliance frameworks does CBTS support?
CBTS supports the major frameworks most organizations are measured against: NIST CSF 2.0 (including the six core functions of Govern, Identify, Protect, Detect, Respond, and Recover), ISO 27001 and 27002, CIS Controls, PCI DSS, HIPAA, SOC 1 and SOC 2, GDPR, and CSAE 34-16. For AI governance, we work with the EU AI Act and the NIST AI Risk Management Framework. Engagements are scoped to the frameworks your business is measured against, with deliverables designed to support audit, customer due diligence, and board reporting alongside your internal program work.
How do you measure security program maturity over time?
CBTS assesses program maturity against established frameworks (most commonly NIST CSF and CIS Controls), measuring across categories like governance, identity, detection, response, and recovery. We capture a baseline at the start of an engagement, then re-measure on a defined cadence to track progress against the roadmap. Maturity scoring gives the board and executive team a clear, year-over-year view of how the program is improving and where investment needs to focus next. For vCISO engagements, maturity progression is one of the primary metrics we report against.
.png "Right (13)")
.png "Image (93)")
%20(1).png "Right (6) (1)")
.svg "CBTS_IconSet_Green Duotone (6)")
.svg "CBTS_IconSet_Green Duotone (7)")
.svg "CBTS_IconSet_Green Duotone (8)")
.svg)
.svg)
.svg)