In an incident

What vCISO does when something is happening right now, and who else you need to call.

vCISO is not an emergency service. If an account has been taken over, files have been encrypted, money has gone to the wrong place, or customer data may have left the building, bring in an incident response firm today and call your cyber insurer if you have one. Do that as well as, not instead of, anything you do here.

What your vCISO does

Tell it what is happening, in plain words. When you describe something going on right now, your vCISO:

Gives the first steps that stop the bleeding.
Says plainly, in the same message, to bring in an incident response firm today and to call your insurer. It will not let the conversation become your whole response.

Those first steps are advice for you to act on. They are not a full response, and they are not a substitute for the people above.

What it will not do

Handle the incident for you. It has no access to your systems and cannot see or stop what is happening in them.
Give legal advice. Whether and whom you must notify, such as customers, a regulator, or a prime contractor, and what your contracts require, are questions for a lawyer. Your vCISO can help you work out what to bring to that conversation.

Be ready before you need it

The time to prepare is before anything happens. The Respond and Recover areas of your program are where this lives. Questions worth raising with your vCISO:

Who do you call first, and do you have their number somewhere that does not depend on your email?
Does your cyber insurance come with a response firm you are required to use?
Do any of your contracts set a deadline for telling a customer or a prime about an incident?
Have your backups ever been restored, end to end, and how long did it take?

Your answers become risks, policies, and decisions on your records, so they are there when you need them. See Your security program.