Managed Security Costs, Price Drivers and 2026 Rules
Virtual CISO cost in India: retainers, days per month and what a vCISO delivers
How virtual CISO (vCISO) services are priced for Indian MSMEs — monthly retainers, days, deliverables, audits and customer questionnaires — with illustrative rupee examples.
A virtual CISO (vCISO) is a senior security professional you rent for a set number of days or hours a month, usually on a monthly retainer with a minimum term of six to twelve months. For Indian MSMEs, an illustrative range is about ₹50,000 a month for two days of light-touch support to ₹3 lakh or more for a near-weekly presence through an audit or a major customer onboarding. What you are buying is leadership and paperwork done properly: a risk register, policies people follow, answers to customer security questionnaires, readiness for audits and a plan your managed security provider can execute. This guide explains the pricing and deliverables, and is part of the managed security pricing overview.
What a vCISO typically does
| Area | Typical deliverables |
|---|---|
| Governance | Security policy set, roles and responsibilities, management reporting |
| Risk | Asset list, risk register, risk treatment plan, yearly review |
| Compliance | Mapping to CERT-In Directions, DPDP readiness, ISO/IEC 27001 preparation, customer contract clauses |
| Vendors | Security review of SaaS and outsourcers, including your MSSP |
| Incidents | Incident response plan, CERT-In reporting procedure, tabletop exercise |
| Customers | Answers to security questionnaires and audits from larger clients |
| Oversight | Reviewing the MSSP's monthly reports and SLA performance |
A vCISO usually does not run tools or watch alerts. That is the managed service's job. See MSSP, MDR and SOC explained.
How vCISO services are priced
- Days-per-month retainer: for example 2, 4 or 8 days a month, unused days may or may not carry over.
- Hours bank: a block of hours used as needed, valid for a year.
- Project fee: a fixed price for a defined outcome such as ISO/IEC 27001 readiness or a DPDP gap assessment.
- Hybrid: a small retainer plus project fees for audits.
Illustrative retainer bands (before GST)
| Engagement | Days per month | Illustrative monthly fee |
|---|---|---|
| Light-touch advisory | 1–2 | ₹50,000–₹90,000 |
| Standard programme | 3–5 | ₹1,00,000–₹2,00,000 |
| Audit or certification push | 6–10 | ₹2,00,000–₹3,50,000 |
Worked example (illustrative)
A 70-person IT services exporter must pass a large customer's security audit within nine months and wants ISO/IEC 27001 readiness.
- Months 1–3: 6 days a month at ₹28,000 a day = ₹1,68,000 a month → ₹5,04,000
- Months 4–9: 3 days a month = ₹84,000 a month → ₹5,04,000
- Total for 9 months: ₹10,08,000 before GST; with 18% GST ₹11,89,440.
Compare this with hiring a full-time security head: if an illustrative total employment cost is ₹40–60 lakh a year, nine months is about ₹30–45 lakh. For a firm of this size, a vCISO costs a fraction of that, though with less day-to-day presence.
What to put in the engagement letter
- Named person and back-up, with their qualifications (ask for evidence; do not rely on titles).
- Deliverables by month, not only days.
- Carry-over rules for unused days.
- Response time if an incident happens between scheduled days.
- Independence: whether the vCISO's firm also sells the tools or managed services it may recommend. If so, ask for that conflict to be disclosed and decisions documented.
- Confidentiality and data handling under a written agreement.
- Exit: hand-over of all documents in editable formats.
When a vCISO is worth it
| Situation | vCISO likely useful? |
|---|---|
| Customers send long security questionnaires you struggle to answer | Yes |
| You are preparing for an ISO/IEC 27001 certification or a customer audit | Yes, often as a project |
| You have an MSSP but nobody reads its reports | Yes, a few days a month |
| You have fewer than 15 people and everything is in SaaS | Perhaps a short project, not an ongoing retainer |
| You are a regulated entity needing a designated CISO | Check your regulator's rules first; some require an employee in the role |
Regulated entities such as banks, NBFCs and market intermediaries should read RBI and SEBI cyber rules before relying on an outsourced CISO.
How to compare two vCISO proposals
- Convert both to cost per delivered outcome (policy set, risk register, audit pass), not per day.
- Check the seniority of the person who will actually turn up.
- Ask for sample deliverables with client details removed.
- Check that the plan uses your existing tools before recommending new ones.
- Add GST with the GST-inclusive price calculator.
FAQ
Is a vCISO the same as a consultant?
Broadly, yes, but a vCISO is ongoing and accountable for the programme, while a consultant usually delivers a single project.
Can the vCISO be our point of contact for CERT-In?
The CERT-In Directions require entities to designate a point of contact. Many businesses name an internal person and list the vCISO or provider as support; check the current CERT-In format and FAQs.
Do we need ISO/IEC 27001?
No law requires it for every MSME. Customers, tenders and some regulators may ask for it. A vCISO can tell you whether the cost is justified by the business it unlocks.
Sources
- CERT-In — Directions of April 2022 and guidance on points of contact
- Bureau of Indian Standards — Indian adoption of information security standards
- MeitY — IT Act and DPDP framework
