The Bank Asked Who Is Responsible for Our Security. The Honest Answer Is Nobody. What Do We Do?

The general manager of a family-owned car dealership in New Castle opened an email from the dealership's floor-plan lender in the middle of a busy Saturday. It was a vendor security review, and the first question was simple: "Name the individual responsible for overseeing your information security program." The dealership had an IT company that fixed computers and a sales manager who reset passwords. Nobody, if the GM was honest, was responsible for the security program, because nobody was sure the dealership had one.

That gap is exactly what virtual CISO services exist to close. A CISO is a chief information security officer, the executive who owns security strategy at a large company. A virtual CISO (often written vCISO, and sometimes called a fractional CISO) does that same job on a part-time basis for businesses that cannot justify, and do not need, a full-time security executive. This post, built from a composite of the situations we see across Lawrence, Mercer, and Butler counties and the Youngstown area, explains what a vCISO actually does, when a small business needs one, and how to tell real security leadership from a rebranded sales call.

What do virtual CISO services actually include?

A vCISO owns the security program, not the security tools. Your IT company installs the antivirus and patches the laptops. The vCISO decides what the business needs to protect, how much risk is acceptable, which controls come first, and how you will prove all of that to the people who ask.

For a 10 to 50 person business, a virtual CISO engagement usually covers:

• A written risk assessment. What customer, patient, or financial data you hold, where it lives, who can reach it, and what would happen if it leaked or disappeared. Most regulations start here, and most small businesses have never done it on paper.
• Written policies people can follow. Access control, acceptable use, password and multi-factor authentication rules, vendor management, data retention, and incident response. Short enough that employees will read them, specific enough to hold up when an auditor or insurer asks.
• A prioritized security roadmap. Which gaps get closed this quarter, which wait, and what each one costs in effort. A good roadmap is tied to real deadlines like an insurance renewal or a lender review.
• Vendor and third-party oversight. Your dealer management system, payroll provider, cloud storage, and IT company all touch your data. Someone has to ask them the hard questions and keep their answers on file.
• Incident response planning and testing. Who gets called at 2 a.m., who talks to the insurer, who decides whether to notify customers. A tabletop exercise once a year turns a document into something people actually know how to use.
• Reporting to ownership. A plain-English update to the owner or board on where the program stands, what changed, and what still needs money or attention.

Notice what is not on that list: buying more software. If a security engagement starts with a product demo, it is not a vCISO engagement.

When does a small business need a virtual CISO?

Most small businesses do not go looking for a vCISO. Someone outside the company forces the question. The triggers we see most often in Western Pennsylvania and eastern Ohio:

• A lender, bank, or large customer sends a security questionnaire that asks who is responsible for your security program, and "our IT guy" is not an acceptable answer.
• Your cyber insurance renewal asks for documented controls, written policies, and an incident response plan, not just a yes or no on multi-factor authentication.
• A regulation names a responsible person. The FTC Safeguards Rule requires covered businesses to designate a Qualified Individual to oversee the program. HIPAA requires a designated security official. Defense suppliers working toward CMMC need someone who can own the documentation.
• You had an incident, a compromised mailbox, a wire-fraud attempt, a ransomware scare, and realized afterward that nobody was in charge of deciding what to do.
• Your company is growing past the point where the owner can keep it all in their head, typically somewhere between 15 and 40 employees, or when a second location opens.

If none of those apply yet, solid managed security from your IT provider may be enough for now. Our overview of cybersecurity services for small business covers that baseline. The vCISO question gets real when someone outside the business needs a name and a paper trail.

Is a vCISO the same as a vCIO or your IT company?

No, though the roles overlap and in a small business the same provider sometimes fills more than one.

Your IT company (or managed IT provider) runs day-to-day operations: the help desk, patching, backups, monitoring, and installing the security tools. A vCIO (virtual chief information officer) plans technology for the business as a whole, the server replacement, the office move, the multi-year budget. We covered that role in our post on IT consulting for small business. A vCISO focuses only on security and risk. The vCISO sets the rules, checks that they are being followed, and answers to ownership for the result.

There is an honest tension here worth naming. If the same company that runs your IT also grades your security, it is partly grading its own work. That does not make it wrong, and for many small businesses it is the practical choice. But it means you should expect independent evidence: outside vulnerability scanning, documented test restores, and a periodic review by someone who did not build the system. If you already have an in-house IT person, a co-managed arrangement can pair their daily work with outside security oversight.

What does the FTC Safeguards Rule require from a Qualified Individual?

This is where the vCISO question stops being abstract for a lot of small businesses that do not think of themselves as financial institutions. The FTC Safeguards Rule covers non-bank financial businesses, which includes auto dealers that arrange financing, mortgage brokers, tax preparers and accounting firms, payday lenders, and many others. The updated rule requires covered businesses to:

1. Designate a Qualified Individual to oversee and enforce the information security program. That person can be an employee or can work for a service provider, but the business keeps responsibility for compliance and must oversee the provider.

2. Base the program on a written risk assessment.

3. Put specific safeguards in place, including access controls, encryption of customer information, multi-factor authentication for anyone accessing customer information systems, and secure disposal of old data.

4. Test and monitor the safeguards, through continuous monitoring or annual penetration testing plus vulnerability assessments at least every six months.

5. Train staff and oversee service providers.

6. Maintain a written incident response plan.

7. Have the Qualified Individual report in writing to the owner or board at least once a year.

8. Notify the FTC within 30 days of discovering a security event that involves the unencrypted information of 500 or more consumers.

The rule has a limited exemption for businesses with information on fewer than 5,000 consumers, which drops some of the written requirements (like the risk assessment and the annual report) but not the core safeguards. Ask your attorney or compliance advisor where your business falls. Either way, the Qualified Individual is effectively a vCISO by another name, and the rule explicitly allows that role to come from outside the company.

Medical and dental practices face a parallel requirement under HIPAA, which calls for a designated security official and a documented risk analysis. We cover that side in our guide to managed IT services for healthcare.

How is a virtual CISO engagement usually structured?

There are three common shapes, and the right one depends on how much is already in place.

Program build. A defined project to get you from nothing to a working program: risk assessment, policies, roadmap, incident response plan, and the first report to ownership. This usually starts with a full cybersecurity assessment so the program is built on what you actually have, not on a template. Ongoing oversight. A recurring engagement, often monthly or quarterly, where the vCISO reviews progress against the roadmap, keeps policies current, handles questionnaires and vendor reviews, runs the annual tabletop, and writes the yearly report. For Safeguards Rule businesses, this is how the Qualified Individual role stays filled. On-call advisory. A block of hours for a business with a capable internal team that needs a senior security opinion a few times a year. The risk is that nobody owns the program between calls.

Cost is driven by scope: how many people and locations, how much regulated data, which frameworks apply, and how much hands-on remediation the engagement carries. We do not quote vCISO work before we have seen the environment, because the honest number depends on what is already there. Request an IT assessment for pricing.

How do you judge a virtual CISO provider?

A few questions separate real security leadership from a rebranded sales pitch:

• What will you deliver in the first 90 days? You should hear "a risk assessment, a ranked list of gaps, and a written roadmap," not "we will deploy our platform."
• Who exactly is the named person? If the provider will serve as your Qualified Individual or security official, get the individual's name in writing, and ask what happens if that person leaves.
• How do you report to ownership? Ask to see a sample report with client details removed. If it is a dashboard screenshot, keep looking.
• What evidence will we have if an insurer or lender asks? Policies, training records, test results, and meeting notes should belong to you and live where you can find them.
• What do you recommend we not buy? Good security leadership is as much about stopping waste as adding controls.

For a broader checklist on evaluating any security partner, our post on cyber security audit services walks through the questions to ask before anyone touches your network.

What happened at the New Castle dealership?

The dealership started with an assessment. Most of the basics were partly in place. The gaps were the ones the lender cared about: no written risk assessment, no named Qualified Individual, multi-factor authentication on email but not on the dealer management system, a former finance manager whose account was still active, and an incident response plan that consisted of "call the IT company."

The first month produced a risk assessment, a short policy set, and a roadmap. Multi-factor authentication went onto the dealer management system and remote access, the stale accounts were closed, and the GM and office manager sat through a one-hour tabletop where a fake wire-fraud email landed in the finance office. The lender's questionnaire went back with a named Qualified Individual, documents attached, and honest answers about the two items still in progress. Once a year, the owner now gets a written report on where the program stands.

That is what virtual CISO services should deliver for a small business: a name, a plan, and a paper trail, without hiring an executive you do not need.

MCR Business Tech Solutions provides security leadership, risk assessments, and ongoing security oversight for small and mid-sized businesses across Lawrence, Mercer, Butler, Crawford, Erie, and Allegheny counties in Western Pennsylvania, and Trumbull and Mahoning counties in eastern Ohio. If a lender, insurer, or regulator is asking who is responsible for your security, call 833-859-9021 or Request an IT assessment through our contact page. We will start by finding out what you have, what they are asking for, and what needs to happen first.