Security Program Development
Build and mature your security program with expert guidance
In scope
- Security Architecture Review
- Controls Assessment
- Risk Analysis
- Compliance Mapping
- Security Program Evaluation
You receive
- Detailed Assessment Report
- Executive Summary
- Recommendations Document
- Implementation Roadmap
- Follow-up Consultation
Tiers
Choose the depth.
Core Security Program Development
$5K
Up to 20 consulting hours a month with 1 guidance session monthly: programme gap review, core policy set drafted from templates, and a prioritised plan for baseline controls with follow-up on progress.
- hours
- 20
- sessions
- 1
- Up to 20 hours per month
- 1 guidance session per month
- Core policy set from templates
- Baseline controls plan
- Programme roadmap
- — Security architecture design
- — Mapping to a specific compliance framework
- — Board reporting
- — Hands-on tool implementation
Advanced Security Program Development
$8.5K
Up to 40 consulting hours a month with weekly guidance sessions. Adds security architecture review and target design, adaptation of 1 control framework to the organisation, compliance mapping, risk analysis and a maintained risk register.
- hours
- 40
- sessions
- 4
- Up to 40 hours per month
- Weekly guidance sessions
- Security architecture review and design
- 1 control framework adapted
- Compliance mapping
- Risk register
- — Named dedicated consultant
- — More than 1 framework
- — Board presentations
- — Hands-on tool implementation
Enterprise Security Program Development
$15K
Up to 80 consulting hours a month with a named consultant and up to 8 sessions monthly. Adds implementation of up to 3 frameworks, programme metrics, a quarterly programme review with leadership and continuous roadmap updates.
- hours
- 80
- sessions
- 8
- Up to 80 hours per month
- Named consultant
- Up to 3 frameworks implemented
- Programme metrics
- Quarterly leadership review
- Continuous roadmap updates
- — Acting as the named CISO (see vCISO services)
- — Hands-on engineering and tool deployment
- — Audit or certification fees
Members: engagement coupons from the CISO Marketplace coupon book apply to services. There is no blanket discount.
What's inside this engagement
Phase by phase.
How a advisory & fractional leadership engagement runs, what happens in each phase and what you see. Exact scope, tier and timeline are fixed in your proposal and SOW.
01Onboarding & baseline
Current program, risks, commitments and stakeholders reviewed.
You see · Access to leadership and existing documents.
02Priorities & roadmap
A risk-ranked roadmap agreed with leadership.
You see · Decisions on priorities and budget.
03Ongoing cadence
Regular working sessions, decisions and deliverables to the agreed scope.
You see · A named advisor and a standing rhythm.
04Reporting to leadership
Board and executive reporting in business terms.
You see · Board-ready updates.
Commercials
From first call to final report.
- 01
Scoping call
A practitioner, not a salesperson, walks through targets, constraints and what a good outcome looks like for you.
- 02
Proposal & rules of engagement
A fixed-scope proposal with tier, price and deliverables. Rules of engagement, contacts and out-of-bounds systems are agreed in writing.
- 03
Sign, then start
MSA and SOW are signed electronically and the deposit is paid. Only then does testing begin.
- 04
Execution
Testing runs to the agreed plan. Critical findings are escalated as they are found; you don't wait for the report.
- 05
Report & debrief
An executive summary plus technical findings with evidence, reproduction steps and fixes, walked through with your team.
- 06
Retest
Where the tier includes it, we verify your fixes and reissue the report, so auditors and customers see the issues closed.
Timelines are set per engagement in the SOW.
Related
Non-Human & Machine Identity Security
Assess and govern non-human identities — secrets, API keys, service accounts, workload identities, and AI agent identities — covering issuance, rotation, least-privilege, and lifecycle.
Zero Trust Security Assessment
Comprehensive evaluation of your organization's zero trust architecture implementation, examining identity verification, network segmentation, and access controls. Our assessment identifies gaps in your zero trust strategy and provides a roadmap for enhancing security beyond traditional perimeter-based approaches.
CISO Comprehensive Security Assessment
Holistic evaluation of your organization's entire security program across all critical domains. This efficient, structured assessment provides CISOs and security leaders with a complete diagnostic of security capabilities, maturity gaps, and prioritized improvement opportunities. Our comprehensive approach delivers actionable insights across governance, technical controls, and operational security to inform strategic decision-making and resource allocation.
Research
Latest from the blog
ciso-strategy · Sep 17, 2026
Hired for Security, Judged on Growth: Closing the CISO-Board Language Gap
CISOs are recruited for technical depth but evaluated on revenue and growth outcomes. New survey data shows the board translation gap that creates, and a framework for closing it.
ciso-strategy · Sep 15, 2026
AI Is Quietly Hollowing Out the Cybersecurity Talent Pipeline CISOs Will Need
Entry-level IT and software jobs are shrinking sharply as AI tools absorb junior work, and researchers warn the effect will starve security leadership pipelines within three to five years.
ciso-strategy · Sep 13, 2026
Who's Paying for Dinner? Inside the Invite-Only CISO Networks Shaping Vendor Shortlists
Invite-only CISO dinners and peer communities have become a quiet vendor sales channel, shaping shortlists before RFPs exist. Buyers need to know who is funding the room.
Start an engagement