Cyberprotech

vCISO · CISOaaS · Regulated roles

A professional of reference and an ongoing service are not the same thing.

A vCISO is an external professional providing specialist leadership. CISOaaS is the contracted service that may combine that vCISO with a supporting team, working cadence, deliverables and continuity. The choice depends on the required outcome, availability and depth of support.

Understand the approachTalk to us
vCISO coordinating cybersecurity leadership, risk, operations and evidence

The problem

An organization may need leadership without requiring the same service model.

Some organizations need a senior professional to guide specific decisions. Others need an ongoing capability supported by a team, method, substitution and regular follow-up. Separating these needs avoids contracting a vague designation or assigning to a service responsibilities that belong to specific people and governing bodies.

Two intervention models

Choose between a vCISO intervention and a CISOaaS capability.

The models may be connected, but they address different needs. CISOaaS may provide a vCISO; an individual vCISO does not automatically represent the full capability of CISOaaS.

01 · Professional of reference

vCISO

virtual Chief Information Security Officer

An external individual who provides specialist cybersecurity leadership on a part-time, temporary or ongoing basis, with a defined mandate and availability.

When it may be appropriate

Organizations requiring seniority, executive guidance or support for a defined program without recruiting a full-time internal role.

What distinguishes this model
  • Named professional of reference
  • Direct contact with management
  • Risk, priorities and advice
  • Contracted cadence and availability
Essential boundary

The intervention depends on the person's availability and the contracted scope. It does not automatically constitute a permanent team, 24/7 operations or appointment as Cybersecurity Officer (RCS).

02 · Ongoing service

CISOaaS

Chief Information Security Officer as a Service

A structured Cyberprotech service that provides vCISO leadership and complements it with a team, method, deliverables, working cadence and operational continuity.

When it may be appropriate

Organizations requiring cross-functional, ongoing support across management, risk, implementation, suppliers, evidence and reporting.

What distinguishes this model
  • vCISO of reference
  • Team and complementary capabilities
  • Continuity and substitution arrangements
  • Roadmap, reporting and recurring deliverables
Essential boundary

The service does not transfer management's legal responsibilities to the provider and the contract does not, by itself, constitute an appointment as Cybersecurity Officer (RCS).

Regulated roles

The contracted service must remain separate from the formal appointment.

After choosing the leadership model, the entity must separately address the formally appointed individual, the permanent operational contact and the responsibilities that remain with the competent governing bodies.

Legal role

Cybersecurity Officer (RCS)

An individual appointed by the entity for the functions established in Article 31, with reporting arrangements, authority, resources and formal communication. This person need not be the vCISO; any combination of roles depends on the specific model and applicable framework.

Operational role

Permanent Point of Contact (PCP)

A person, team or third-party entity communicated to assure operational and technical flows, primary and alternative contacts and availability during the activation periods established in Article 32.

Organizational examples

Three possible models with different boundaries.

These examples help structure the decision; they do not replace analysis of the framework, the appointment instrument or the entity's actual circumstances.

01

Internal model

Internal RCS + internal PCP or internal team

The entity concentrates governance and operational contact within its own structures and may contract specialist support for assessment, implementation, exercises or review.

Requires authority, competence, availability, substitution and genuine internal capability.
02

Externally assisted model

Internal RCS + vCISO/CISOaaS + internal or third-party PCP

Appointment and reporting remain clearly internal while the external service reinforces method, risk, documentation, reporting and coordination of delivery.

The contract must distinguish advice, performance, decision-making, availability and responsibility.
03

Mixed model requiring validation

CISOaaS + named individual + internal or third-party PCP

May be examined where the entity intends to integrate an external professional into its governance model, but compatibility with a possible appointment as RCS must be confirmed for the specific case.

It must not proceed by analogy: it requires a formal instrument, direct reporting, resources, conflict management, substitution and legal validation or guidance from the competent authority.
Primary sourcesArticles 31 and 32 of the RJCS (PT) ↗Articles 14 and 15 of the Regulation (PT) ↗

What we structure

An approach connected to the organization's reality.

01

vCISO: integrated leadership

Provide a professional of reference to guide strategy, risk, priorities and decisions and coordinate management, teams and suppliers.

02

Cybersecurity Officer (RCS) role

Support performance of the legal role and, where the framework permits, structure its external provision under the terms formally defined by the entity without displacing its legal responsibilities.

03

Risk and operational oversight

Keep risks, priorities and the roadmap aligned with management while coordinating internal teams, suppliers, technical delivery and executive oversight of incidents.

04

Executive and auditable reporting

Record decisions, indicators, reviews and evidence suitable for management and audit.

Method

From context to ongoing support.

The specific scope is adjusted to the organization's size, maturity, risk and internal capability.

  1. 01Understand the organization
  2. 02Define responsibilities
  3. 03Establish priorities and cadence
  4. 04Monitor delivery and risk
  5. 05Report to and review with management

Expected outcomes

What should improve after the intervention.

  • Clearly identified vCISO and point of liaison
  • Documented distinction between CISOaaS and the RCS role
  • Traceable decisions
  • Monitored priorities
  • Better coordination between management and operations

Clear boundaries

What the intervention neither assumes nor transfers.

  • CISOaaS and vCISO do not automatically constitute appointment as the legal Cybersecurity Officer (RCS).
  • Management retains the responsibilities assigned to it by law and the entity's governance arrangements.
  • Authority, availability, conflicts and substitution must be formally defined.

Possible connections

These links help continue the pathway; they do not represent mandatory dependencies or a closed package.

Implementation CenterExplore →Cybersecurity risk management (PT)Explore →Regulation No. 756/2026Explore →

Next step by maturity

Move forward from where you are.

Choose the action that matches the organization's current clarity and capability.

01 · Understand

I am still framing the subject.

Begin with related information and validate assumptions before selecting an intervention.

Explore knowledge → 02 · Structure

I already recognize the problem.

Review the intervention, method, deliverables and boundaries to organize internal priorities.

Review the approach → 03 · Act

I need to move forward with context.

We begin by clarifying responsibilities, needs and model boundaries before defining any ongoing service.

Assess the accountability model →

Next step

Does the organization need to structure its cybersecurity function?

We begin by clarifying responsibilities, needs and model boundaries before defining any ongoing service.

Assess the accountability modelLearn about CISOaaS ↗