Board-Level Security Leadership Without a Full-Time Hire
Public companies must describe management’s cybersecurity expertise in their annual report under Regulation S-K Item 106, and describe how the board is informed about cyber risk. An organization with no named security leader has nothing to describe. A Virtual CISO gives you retained board-level oversight of security strategy, budget, risk assessment, and regulatory programs, scaled from a few hours a month to an interim full-time engagement, and flexed up or down as requirements change.
2026 · UPDATE
What boards and regulators now expect
The SEC requires disclosure of management’s expertise, not the board’s
Regulation S-K Item 106 requires public companies to describe the board’s oversight of cybersecurity risk, identify any committee responsible for it, describe how the board is informed, and describe management’s role and expertise in assessing and managing material cyber risk. The instructions define relevant expertise as prior work experience, relevant degrees or certifications, or other background in cybersecurity.
The board expertise requirement was proposed and dropped
The proposed rule would have amended Item 407 to require disclosure of cybersecurity expertise among board members. The SEC did not adopt it, agreeing that effective cybersecurity processes are designed largely at management level and that directors with broad risk and strategy skills can oversee them without specific subject matter expertise. Material claiming the SEC looks for a cyber expert on the board has the rule backwards.
Material incidents carry a four business day clock
Item 1.05 of Form 8-K requires disclosure of a material cybersecurity incident within four business days of determining materiality. The clock starts at the materiality determination, which is a judgment someone has to be qualified to make.
Financial institution boards carry their own expectations
Regulators expect boards to remain actively engaged in IT management and governance, with documented oversight rather than periodic briefings. The FFIEC retired its Cybersecurity Assessment Tool on 31 August 2025, and examiner expectations now point toward NIST CSF 2.0 and the CRI Profile.
WHAT IT IS
Retained leadership, not a staffing gap filler
The Virtual CISO service provides experienced security program oversight and strategy without a dedicated full-time information security officer. What you retain is board-level capacity to oversee, manage, or augment security strategy, budget, risk assessment, and regulatory programs.
The service is tailored to each client rather than packaged. It ranges from a few hours a month of consultancy to an interim full-time CISO, and it flexes up or down as information security requirements change, with knowledge transfer over time so the organization builds capability rather than dependency.
TWO TIERS
Oversight, or oversight plus delivery
The distinction is whether Elevate advises your team or runs the program, and it usually follows from whether dedicated security staff already exist.
Virtual CISO
NP DEDICATED SECURITY STAFF
For companies without dedicated security staff that want help maturing the organization and reducing risk. A part-time Virtual CISO provides oversight, implements a strategy to improve defense, and matures the security domains.
Virtual CISO Plus
DEEPER EXPERTISE, DUNDLED DELIVERY
For companies that may or may not have dedicated staff but need deeper expertise to protect business-critical data. Elevate runs the cybersecurity program, implementing strategy with bundled services supporting the client.
Interim CISO
TRANSITION AND GAP COVERAGE
Full-time interim coverage during a search, a leadership transition, or a period of concentrated regulatory work, with the same flex mechanism afterward.
Board advisory
GOVERNANCE CAPABILITY
Education and advisory for the board or audit committee, tailored to your organization and delivered interactively rather than as a briefing deck.
Scaling
UP OUR DOWN
The engagement flexes with changing requirements. A certification push, an incident, or an acquisition raises the need; a stable period lowers it, without renegotiating the relationship.
Knowledge transfer
CAPABILITY NOT DEPENDENCY
Over time the service transfers capability to internal staff, so the organization is stronger when the engagement changes shape rather than dependent on it continuing.
BOARD ADVISORY AND EDUCATION
Preparing the people who have to ask the questions
Board cybersecurity education is tailored to your board and delivered as a hands-on session with discussion and questions, rather than a slide review. The curriculum covers IT regulatory requirements and the general awareness topics a board needs to govern cyber risk competently.
Security strategy and roadmap
A multi-year program plan tied to business objectives and regulatory obligations, with the sequencing rationale documented so a board can see why one thing precedes another.
Budget and investment guidance
Security spend justified against risk rather than against vendor cycles, with the inherent versus residual risk gap used as the basis for what an investment actually buys.
Board and committee reporting
Reporting written for the audience that decides, covering posture, program progress, open risk, and incident readiness. For public companies, this is the source material behind the Item 106 disclosure.
Risk assessment oversight
Ownership of the periodic risk assessment every applicable framework requires, and of the treatment decisions that follow from it.
Regulatory program oversight
Coordination across the certifications and obligations the organization carries, so ISO, SOC, HIPAA, GLBA, or federal work run as one program rather than competing projects.
Incident readiness
Response planning, tabletop exercises, and the escalation path that determines who makes a materiality judgment and how quickly, which matters where a four business day disclosure clock applies.
Vendor and third-party risk
Provider assessment and contractual security requirements, which is where a growing share of examiner and customer attention now sits.
Board education
Interactive sessions covering IT regulatory requirements and cyber governance, built around the NIST CSF 2.0 functions including Govern, which regulators now point to following the FFIEC CAT retirement.
ENGAGEMENT PHASESÂ
How the work runs
WHO THIS IS FOR
Roles Elevate works with on this standard
+ CEOs and boards
+ Audit and risk committees
+ IT directors without security leadership
+ CFOs and COOs
+ Organizations preparing for certification
+ Public companies with Item 106 obligations
GET STARTED
Ready to put a name on security leadership?
Whether the driver is a disclosure obligation, a board that needs briefing, a certification program with no owner, or risk that has outgrown the IT function, Elevate provides the oversight at the scale the organization actually needs.
FAQ
Common Questions
🡪 Does the SEC require a cybersecurity expert on our board?
No. The proposed rule would have required disclosure of board cybersecurity expertise, and the SEC did not adopt it. What Regulation S-K Item 106 does require is a description of the board’s oversight of cyber risk, which committee is responsible, how the board is informed, and management’s role and expertise. The expertise disclosure attaches to management, which is where a Virtual CISO becomes the thing you have to describe.
🡪 What is the difference between Virtual CISO and Virtual CISO Plus?
Virtual CISO suits companies without dedicated security staff that want oversight, strategy, and maturity across the security domains. Virtual CISO Plus suits companies needing deeper expertise to protect business-critical data, where Elevate runs the cybersecurity program with bundled services rather than advising a team that runs it.
🡪 How much time does the engagement take?
It ranges from a few hours per month of consultancy to an interim full-time CISO, and it flexes up or down as requirements change. A certification push, an incident, or an acquisition raises the need; a stable period lowers it. The flex is built into the relationship rather than requiring renegotiation.
🡪 Will we become dependent on the service?
The engagement is designed with knowledge transfer over time, so internal staff build capability rather than the organization building dependency. Where a client eventually hires a full-time CISO, the program, the documentation, and the board relationship are already in place for that person to inherit.
🡪 What does board cybersecurity education cover?
IT regulatory requirements and the awareness topics a board needs to govern cyber risk competently, delivered as an interactive session with discussion rather than a briefing. The curriculum follows the NIST CSF 2.0 functions including Govern, which regulators point toward following the retirement of the FFIEC Cybersecurity Assessment Tool in August 2025.
🡪 Can a Virtual CISO make the materiality call on an incident?
They can inform it, and that is much of the value. Item 1.05 of Form 8-K requires disclosure of a material cybersecurity incident within four business days of determining materiality, and the clock starts at that determination. Deciding materiality is ultimately a company judgment involving legal and executive leadership, but having someone qualified to frame the technical facts is what makes the judgment defensible rather than delayed.