Opinion: SMBs Need Affordable Cybersecurity Leadership

Summary

The article argues that vCISO and fractional CISO services can give small businesses affordable security leadership, and proposes government guidance, incentives and procurement requirements to encourage their use.

Key points

• The article argues that many small and medium-sized businesses cannot afford a full-time CISO despite facing significant cyber risks.
• A vCISO typically advises multiple organizations remotely; a fractional CISO works part-time with deeper involvement in one organization.
• The author recommends CISA and SBA publish provider criteria, example scopes of work and case studies to help businesses assess services.
• Suggested engagement deliverables include an initial risk assessment, prioritized remediation roadmap and progress metrics.
• The author proposes that NIST include these leadership models in SMB-focused Cybersecurity Framework guidance.
• The article calls for targeted incentives and federal contractor requirements to encourage cybersecurity oversight across supply chains.