A three-month vCISO trial that started with 13 policies became a two-year security program
A utility-sector engineering consulting firm. Outcome verified
The problem
A utility-sector engineering consulting firm of about 200 people had a capable IT team but no security leader and no formal program. A posture assessment had produced a report, but policies were outdated and nobody owned turning the findings into a plan. The firm could not justify a full-time CISO.
Why it mattered
Utility clients increasingly ask for a written security plan and SOC 2 evidence, so the gaps were becoming a sales and trust problem, not only a risk problem.
What we did
Vizius proposed a three-month vCISO trial with one focus: rewrite the policy set so it could serve as the program roadmap. Once the policies and a review calendar existed, each policy became an operating priority. Vizius produced the processes and project plans; the firm's own staff implemented them.
What changed
Within the first months, 13 policies were drafted and reviewed and the board approved two follow-on projects. The program has run for more than two years, producing an incident response plan, tabletop exercises and a SOC 2 Type II readiness plan.
- Construction and engineering
- Midsize company
- SOC 2