ADVISORY AND vCISO
Someone accountable for the security program, with a calendar attached.
Every rule below names someone accountable for the security program; most want a board report. We fill the role, the artifacts stay yours, and the exit leaves you all of it.
When it fits.
- The accountable person has another job; the board report is written the week it is due.
- A rule or counterparty names the role and asks who fills it.
- The registers do not exist, and an examiner or counterparty will ask for them by name.
Find your row.
| If you are, and the rule | The role | The periodic report | Who it does not reach |
|---|---|---|---|
| A nonbank mortgage lender, broker or servicer: 16 CFR Part 314 | A Qualified Individual (314.4(a)), at any consumer count | Annual, in writing, to the board or an equivalent senior officer (314.4(i)) | Banks, savings associations, federally insured credit unions; for the report only, fewer than 5,000 consumers (16 CFR 314.6) |
| A New York licensee: 23 NYCRR Part 500 | A designated CISO | Certification of material compliance, or acknowledgment of noncompliance with a remediation plan | For the CISO (500.4), an entity limited exempt under 500.19(a); never the 500.17 notices |
| An insurance licensee under an enacted NAIC Model #668 | A responsible person for the written program, under board oversight | Board reporting; notice to the commissioner within 72 hours of determining a cybersecurity event, where its conditions are met | States without it; for the written program only, fewer than 10 employees, contractors included |
| An insurance licensee in Louisiana: La. R.S. 22:2504 | The written program, with board oversight | Board reporting; notice to the Commissioner within three business days of determining a cybersecurity event involving nonpublic information, where its conditions are met | For the program only, the Louisiana program exemptions: fewer than 25 employees, under $5 million revenue or under $10 million assets, among others |
| A bank or thrift: 12 CFR Part 30 and Part 364, Appendix B | Board oversight of a written, risk assessed program, with independent testing of key controls and service provider oversight | Annual, to the board | Nobody by size; scaled, not excused |
| A federally insured credit union: NCUA 12 CFR Part 748, Appendix A and Appendix B | A board approved member information security program, responsibility assigned, with incident response and member notice | Annual, to the board | Nobody by asset size; NCUA supervises |
Part 500 reaches DFS authorization holders only; a New York customer alone does not count. The Qualified Individual may be an employee, an affiliate or a service provider; compliance responsibility stays with the institution. The Safeguards count is of consumers, not employees or loans.
This firm builds the program and the evidence to the shape the instrument requires. Counsel confirms the legal reading for your state.
Six artifacts.
| Artifact | What it holds | Period |
|---|---|---|
| Policy Inventory | Each policy's owner and dates, and a gap list of what no policy covers | Continuous, with review dates |
| Risk Register | Risks as consequences, each with owner, rating, decision and review date | Continuous, with review dates |
| Prioritized Roadmap | Order of work and basis, phased to your budget | Reissued on change, reviewed each board cycle |
| Board Reporting Pack | What changed, is open, is accepted, and the one approval asked | Annual, for the board cycle |
| Exception and Risk Acceptance Register | What is not fixed, who accepted it, why, until when; examiners ask for it by name | Continuous, with review dates |
| Maturity Baseline | Readings on a stated basis, so yearly change is the program, not the method | Annual, on the same basis |
What the program does across a year.
- Set the maturity baseline on a written basis.
- Build or repair the policy set, each policy with an owner.
- Stand up the risk register, so accepting a risk is a recorded act, not a silence.
- Produce the roadmap, with budget phasing.
- Run the board cycle in one structure, so directors see movement.
- Own the exception register and run one tabletop to rehearse notification decisions with those who make them.
From you: the current program signer and what the board has seen; a committee or senior officer to accept risks on the record, because an acceptance nobody signs is not one; staff time for the registers you will own.
The firewall between owning a program and judging it.
Our advice is not tied to product sales. If Red Stick Solutions ever holds a commercial relationship with a product or platform it discusses with you, that relationship is disclosed to you in writing before it can affect the advice.
Red Stick Solutions will not assess or test a security program it owns as virtual CISO for the same client in the same period. Where a client wants both, the assessment or the test goes to a third party and this firm helps select one.
A firm that assesses a program it owns judges its own work. A client who hands a carrier, a partner bank or an examiner an assessment by its own virtual CISO will be asked who performed it, and that question costs them the report. Referral policy: Partners. Our answers: Trust and Assurance.
What the role is, and what it is not.
The title vCISO does not make this firm an officer of your institution. Management authority, risk acceptance and legal duties stay with you unless a contract expressly and lawfully assigns them.
We do not represent you to a regulator, negotiate with an examiner or attest that a finding is closed. We set out what an examination asks for, the evidence that answers it and who owns each part.
When the registers hold and the board cycle runs without prompting, the honest recommendation is a smaller engagement, and we will make it.
| Before | After |
|---|---|
| Decisions by whoever is in the room | A named owner and a documented basis |
| Template policies never applied | Policies that match practice |
| A risk register of worries | Owners, dates, an exception record |
| A board told of incidents only | A board told position, direction and what it accepts |
| Question | Answer |
|---|---|
| Proof of compliance | No. It gives an examiner or counterparty dated evidence to reach their own conclusion. No report from this firm is represented as proof that an environment is secure or compliant. |
| Something urgent | We stop and tell you the same working day, by the escalation path and to the named person agreed in writing before the work began. |
| Retest | This program owns the security program rather than testing it. A test goes to a third party under the independence policy, and that proposal states its own verification round. |
For your AI systems the same question, who is accountable when a model shapes a decision, is the AI Governance Program.
An accountable owner, and the program stays yours.
Which row is yours, and who signs the program today?
- Unit
- A monthly engagement, or hours drawn against an agreed block
- Fee
- For each month or block of hours, in writing once the written shape of the work is agreed, before you sign.
- Term and hours
- The term and your team's hours, in writing, with the fee.
- A changed scope
- Requoted, showing which change moved the number.
- A number that proves wrong
- You hear the day we know.
The commitment in full is on Trust and Assurance.