Fractional CISO (vCISO) · BCP / DR
A fractional CISO — vCISO in the trade — is security leadership on a monthly retainer. Most small and mid-size companies have no written plan for ransomware, hardware failure, or a breach, and no one keeping those risks in check. These two services close both gaps. They sit next to the IT you already have. How this sits next to fractional CIO →
A fractional CISO reviews posture, trains staff, and catches gaps before they become incidents. Your in-house IT or MSP still runs the tickets. We give them a senior security backstop and documents they can hand to an auditor, insurer, or attorney.
If you have an admin, a helpdesk, or an out-of-town MSP, we do not replace them. We sit next to that person: vendors, budget, security program, surge, and someone who can be in the building. Tickets and day-to-day ownership stay where they are unless you ask otherwise.
HIPAA, GLBA, ABA, and most cyber policies want a written continuity plan. Most practices do not have one. A disaster-recovery plan tells the team what to do when systems fail. Without it, recovery takes longer and costs more.
If you are mid-incident, a monthly retainer is the wrong product. Start with emergency incident response. We quote BCP and vCISO after the environment can stand it.
A written, compliance-ready BCP and DR plan: what to do when systems fail, data is compromised, or operations stop — documented for auditor, insurer, and counsel.
Which functions are critical, recovery order, impact of each failure.
How long each system can be down, and how much data loss is acceptable.
A process that proves backups restore — not only that a job ran.
Who does what, who to call, HIPAA / GLBA / ABA wording as it applies.
$2,500–$3,500
$4,500–$7,500
$500–$1,500 / year
It is not a dashboard login and a PDF of CVEs. It is a named person who already knows how a 20-person office actually runs: the shared mailbox, the imaging PC that cannot be patched this week, the cyber application the owner signed last year without reading.
Month one is honesty: MFA, backups that restore, who has global admin, whether email forwarding rules exist, and whether the last “security training” was a video nobody finished. Then a written list — what is actually dangerous versus what a vendor is trying to sell. After that, the monthly review keeps the list honest.
If you need a document for an insurer, a hospital partner, or counsel, that is the BCP / DR engagement above. If you need CMMC or a SPRS number, that is CMMC readiness and DefensibleScore — not a vCISO sticker on a half-finished SSP.
Clinics and law offices: see healthcare and professional practices. Mid-incident: call IR, do not start a retainer.
Security posture, policies, staff training, and a tested incident-response plan — at a monthly flat rate. Same person every month.
$1,500 / month
$2,500 / month
$3,500 / month
Defense contractors: start free at DefensibleScore.com, then talk readiness. BCP/DR and vCISO available in the Tri-Cities and remotely nationwide.
Fractional leadership only works if the person on the call has actually run the stack. Avery Parker has.
Office at 4100 North Roan Street, Suite 208, Johnson City, TN 37604. Onsite across the Tri-Cities and Western North Carolina. You talk to Avery, not a tier-1 queue. Retainers are month-to-month. We do not sell you a stack we are paid to push — vendor-neutral advice.
This is Avery Parker’s practice. Scheduled work is booked. Incident response jumps the queue. If he is already on a site, you hear that on the first call — not after you have waited. Partner MSPs get a scoped window in writing. We do not invent a second-shift team we do not have.
No. Start with emergency incident response. vCISO and BCP are for after the environment can stand a monthly program.
No. Tickets stay with your IT or MSP. We review posture, write the plan, train staff, and sit next to that person.
BCP language includes HIPAA, GLBA, and ABA where it applies. We do not pretend to be your counsel. Clinics and firms should also see the healthcare page.
We will look at what you have and say which service actually fits.
