Statement of Work
Virtual CISO (vCISO)
Prepared by Starks Enterprise — starksenterprise.com · Irving "Gene" Starks Jr. · [email protected] · (980) 355-9706
Purpose & Overview
Starks Enterprise will act as Client's fractional security leader — owning the security roadmap, policy program, risk register, and audit posture — giving Client executive-grade security leadership without a full-time CISO hire.
Scope of Work
Security program assessment and maturity baseline
Security strategy, budget, and annual roadmap development
Policy and standards suite authoring and annual review
Risk register ownership and periodic risk reviews
Security-awareness program design and cadence
Vendor security review and third-party risk management
Audit and customer-security-questionnaire support (SOC 2, ISO 27001 readiness)
Board / executive reporting and incident-response plan sponsorship
Deliverables
Security maturity assessment and 12-month roadmap
Policy suite and risk register (maintained)
Monthly executive security report
Audit-readiness gap plan and evidence guidance
Timeline
| Phase | Activities | Duration |
|---|---|---|
| Phase 1 | Baseline assessment & roadmap | 2-3 weeks |
| Phase 2 | Program build-out (policies, risk register, awareness) | 4-8 weeks |
| Ongoing | Recurring vCISO cadence & reporting | Ongoing |
Pricing & Payment Terms
| Item | Timing | Fee |
|---|---|---|
| Baseline assessment & roadmap (one-time) | Due at kickoff | $8,000 - $15,000 |
| vCISO retainer (per month, 2 days/wk equivalent) | Monthly, in advance | $5,000 - $10,000/mo |
| Audit-readiness project (SOC 2 / ISO) | Per project | $15,000 - $30,000 |
Invoices are due net 15. Retainer scope is reviewed quarterly and rebalanced as the program matures.
Client Responsibilities & Assumptions
Client will provide access to documentation, staff, and tooling needed for program work.
Client executive sponsor will attend monthly governance reviews.
Client remains responsible for implementing controls; vCISO directs and verifies.
Out of Scope
Full-time employment placement of security staff
Hands-on incident command during live incidents (IR retainer available separately)
Legal counsel or insurance brokerage services
Acceptance Criteria
Roadmap approved by Client executive sponsor
Policy suite ratified and published internally
Recurring governance cadence established with attendance by Client leadership
Term & Termination
This SOW is effective upon signature by both parties and remains in effect through delivery and acceptance of all deliverables, or until terminated by either party with 30 days' written notice. Fees for work performed and expenses incurred prior to termination are non-refundable. This SOW is governed by, and incorporated into, the Master Services Agreement between Starks Enterprise and Client.