Key Takeaways<\/p>\n
- \n
- The specialist work is delegable:<\/strong> A vCISO can handle strategy, ISMS setup, risk analysis, audit preparation, and reporting. As a market term, the role is not defined in law.<\/li>\n
- The organizational duty is not delegable:<\/strong> Section 38 BSIG obligates the executive management of particularly important and important entities to implement the risk measures and monitor their implementation. The leadership\u2019s own training also remains with the management.<\/li>\n
- Wording matters:<\/strong> The German law speaks of implement and monitor. The term \u201capprove\u201d used in many commentaries originates from Article 20 of the NIS2 Directive. Anyone who conflates the two cites the wrong provision in an audit.<\/li>\n
- The model fails at the interface:<\/strong> Without an internal anchor, clear escalation, and an offboarding plan, external expertise creates a governance gap that becomes visible in an audit.<\/li>\n<\/ul>\n<\/div>\n
Related:<\/span>Which Decision Rights of the CISO Must Be Regulated in Writing<\/a> \/<\/span> Why the ISO Certificate Alone Is Not Enough for the BSI<\/a><\/p>\n
What a vCISO Delivers and What the Market Term Does Not Regulate<\/h2>\n
What is a vCISO?<\/strong> A vCISO or CISO-as-a-Service is the external staffing of the CISO function by a service provider, usually on a monthly retainer or daily rate rather than as a permanent employee. It assumes the strategic management of information security at the executive level without becoming part of the executive management.<\/p>\n
In practice, the mandate covers a clear set of tasks. The vCISO establishes or further develops the information security management system, writes policies, conducts risk analyses, and prepares for internal and external audits. This also includes awareness concepts, incident playbooks, and regular reporting to the executive management. As a rough guide without a fixed standard, the scope ranges from half to a few person-days per month, billed as a flat fee or on an as-needed basis. There are no fixed market prices; provider figures vary widely.<\/p>\n
The conceptual distinction is important. The external information security officer operates the ISMS operationally; the vCISO steers strategically at the executive level. In smaller organizations the lines blur because one person wears both hats. For governance, the title does not matter-what counts is the task profile and the question of who ultimately answers to the supervisory authority.<\/p>\n
Section 38 BSIG: What the Executive Management Cannot Buy<\/h2>\n
The new BSIG has been in force since December 6, 2025, and replaced the previous version from 2009. For the role question, Section 38 is the key lever. It obligates the executive managements of particularly important and important entities to implement the risk management measures to be taken pursuant to Section 30 and to monitor their implementation. Section 30 lists the ten minimum measures for this purpose, ranging from risk analysis to cryptography and supply chain security.<\/p>\n
At this point, a close look at the wording is worthwhile. The German law speaks of implement and monitor. The term \u201capprove,\u201d used in many commentaries, originates from Article 20 of the NIS2 Directive and corresponds to the English \u201capprove.\u201d The legislator has therefore deliberately formulated more strongly than the EU standard. Implement means more than consent: The management must ensure that the measures are effectively introduced and operated with resources and anchoring. It keeps their effectiveness under continuous review. An external service provider can prepare this. The responsibility for it lies with the executive management.<\/p>\n
Two further paragraphs make the limits of delegation clear. Section 38 (2) links a culpable breach of duty to the liability of the members of the executive management toward their own entity, in accordance with the rules of the applicable corporate law. And paragraph (3) requires that the members of the management regularly participate personally in training courses to be able to identify and assess cyber risks. An external party may conduct the training, but participation by the governing bodies remains mandatory. A vCISO may provide training; however, he cannot substitute for the participation of the organs. Anyone who believes that compliance has been outsourced with the retainer has missed the core of the provision.<\/p>\n
Role Allocation: Externally Operational, Internally Responsible<\/h2>\n
The clean split follows a simple line. Everything that is specialist work can move outward. Everything that concerns decision-making, resource allocation, and proof of monitoring stays inside. The following overview assigns the typical tasks.<\/p>\n
\n - The organizational duty is not delegable:<\/strong> Section 38 BSIG obligates the executive management of particularly important and important entities to implement the risk measures and monitor their implementation. The leadership\u2019s own training also remains with the management.<\/li>\n
![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/ciso-mandat-entscheidungsrechte-eskalation-cover-hero-250x143.jpg\")
<\/span>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/06\/nis2-after-the-deadline-now-the-bsi-supervision-begins-cover-en-hero-250x143.jpg\")
<\/span>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/05\/nis2-compliance-mittelstand-umsetzung-praxis-cover-hero-250x143.jpg\")
<\/span>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-geopolitik-datacenter-roadmap-lieferkett-8054517-250x143.jpg\")
<\/span>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-eu-ai-act-2026-kennzeichnungspflichten-m-35346140-250x143.jpg\")
<\/span>![\"\"](\"https:\/\/www.securitytoday.de\/wp-content\/uploads\/2026\/07\/net-xfs4iot-cloud-geldautomat-plattform-syna-61345494.jpg\")
<\/span>