Strategy & roadmap
A security program built around your business, with a clear plan for what to do this quarter and this year.
- Security program assessment
- Multi-year roadmap and budget planning
- Framework alignment (NIST CSF 2.0, CIS Controls)
Services / Fractional CISO
Fractional CISO
Security leadership without the full-time hire.
An experienced CISO who owns your security strategy, manages risk and compliance, and reports to your board, backed by Legion's offensive and defensive teams.
Sound familiar?
- Your board is asking about cyber risk and nobody owns the answer.
- Security questionnaires from clients and insurers keep piling up.
- Regulators expect a named security leader.
- Your IT team is stretched between keeping the lights on and security.
What's included
Everything a CISO does, sized for you.
Get the leadership a full-time executive provides, scoped to the hours and priorities your organization actually needs.
Risk & compliance
Know where you stand and be ready when auditors, regulators or customers ask.
- Risk assessments and risk register
- HIPAA, GLBA, PCI DSS, SOC 2 and CMMC readiness
- Audit and examiner support
Governance & policy
The policies, roles and controls that make security repeatable.
- Policy and standards development
- Vendor and third-party risk management
- Incident response planning and tabletop exercises
Board & executive reporting
Translate technical risk into business decisions your leadership can act on.
- Board and executive briefings
- Security metrics that matter
- Cyber insurance and customer questionnaire support
How it works
From first assessment to board-ready program.
- 01 Assess We review your environment, obligations and current program to find the biggest gaps.
- 02 Plan You get a prioritized roadmap tied to business risk and budget.
- 03 Lead Your Fractional CISO drives execution with your IT team, vendors and our operations teams.
- 04 Report Regular updates to leadership and the board show progress and remaining risk.
Why Legion
A CISO backed by a full security operation.
Most fractional CISOs work alone. Ours can call on Legion's penetration testers, 24/7 SOC and AI governance team, so the plan gets executed, not just written.
Common questions
How is this different from an MSSP?
An MSSP runs security tools and monitoring. A Fractional CISO owns the strategy, policy, risk decisions and reporting. At Legion you can have both, working from the same plan.
How much time does a Fractional CISO spend with us?
It depends on your size and goals. Engagements are scoped to the hours and cadence you need, and can scale up during audits, incidents or major projects.
Can your CISO serve as our named security leader?
Yes. We can support or fill roles such as a HIPAA security official or a GLBA Safeguards Rule qualified individual, depending on your organization and regulators.
Do we need to use Legion's other services?
No. Our CISOs work with your existing tools and providers. Many clients find it efficient to pair leadership with our testing and monitoring, but it isn't required.
Put a security leader on your team.
Start with a conversation about your goals, obligations and where your program stands today.