Virtual CISO Platform: Security Program Management Features

• Onboarding Consultant

  A guided intake that asks a few questions about your business and builds the security profile the rest of the platform uses for its recommendations.

• Virtual CISO

  An AI security advisor that answers security questions in plain language, at any time, inside the app.

• Decision Modes

  Works through one security decision at a time with one of seven structured methods, such as First Principles, Inversion, 5 Whys and Pre-Mortem, and closes with a summary of where the decision landed.

• Compliance framework assessments

  Short and comprehensive self-assessments for 22 frameworks, including SOC 2, ISO/IEC 27001, NIST CSF, HIPAA, PCI DSS, CMMC, GDPR and CIS Controls, grouped by how strongly each framework applies to your profile.

• Compliance dashboard and task tracking

  Turns assessment results into compliance tasks and saves each task as open, in progress or resolved, so status carries across sessions and devices.

• GRC readiness report

  Builds a questionnaire for the frameworks you select, accepts supporting documents, and generates a report with an executive summary, framework coverage, control gap analysis, evidence matrix, risk register and remediation roadmap.

• Assessments library

  Every assessment in the app in one place, from core cyber and physical security posture to identity, cloud and governance, with your posture score.

• Threats and Insights

  Explains the threats aimed at a business like yours in everyday language and turns your data into ranked recommendations for the next step.

• Security Roadmap

  A plan board with three horizons (now, 3 to 6 months, and 6 to 12 months) that you edit in place, seeded from the security needs you select.

• Security Progress

  Tracks your maturity score over time, improvement by category, progress on compliance gaps, and your assessment history.

• Board-ready PDF export

  Generates a board-ready PDF of your security progress, keeps past exports in a library, and creates a share link that expires after seven days.

• Report templates

  Five report templates: Executive Summary, Full CISO Report, Standard Breach Report, Technical Analysis, and GRC / Compliance Readiness, with options to customize and export.

• Client Portfolio

  For consultants: one view of the client organizations you assess, with each organization's physical security score, completion and status.

• Report Branding

  Puts your firm name and accent color on the PDF reports you deliver to clients, so each report shows you as the preparer.

• Watchtower

  Watches the published terms and policies of the third-party tools in your inventory and alerts you when one changes, with next steps to discuss the change with the AI advisor, map it to GRC controls, or find alternatives.

• Watchtower Risk Score

  A composite risk score across legal, cyber, financial, operational and compliance exposure, with a 90-day trend, the tools driving the score, and a plain-language summary. Part of Watchtower Advanced.

Side-by-side comparison

Compliance automation

The GRC module turns a questionnaire and your supporting documents into a readiness report: where you stand against each selected framework, which controls are missing or partial, what evidence maps to which control, a prioritized risk register, and a sequenced remediation roadmap.

The compliance dashboard turns assessment results into tasks and saves the status of each one, so a program owner can see what is open, in progress and resolved without keeping a separate tracker.

Framework coverage

Compliance self-assessments cover 22 frameworks: Basel III, CCPA, CIS Controls, CMMC, COBIT, Essential Eight, FDA, FERPA, FISMA, GDPR, GLBA and DORA, HIPAA, HITRUST, ISA/IEC 62443, ISO/IEC 27001, NERC CIP, NIST CSF, NYDFS, OWASP, PCI DSS, SOC 2 and StateRAMP (Texas). Each has a short and a comprehensive version.

The GRC readiness report supports SOC 2, ISO 27001, NIST CSF, HIPAA, PCI DSS, GDPR and CMMC.

Reporting

Security Progress charts how your maturity score and compliance gaps change between assessments. Board-ready PDF exports, the report templates and Report Branding turn the same data into documents for a board, a client, an insurer or a partner.

Multi-client management

Consultants who assess several client organizations see them together in the Client Portfolio, which lists each organization's physical security score, completion and status. Report Branding puts the consultant's firm name and accent color on the reports they deliver.

How this list is kept current

A feature appears here only when it is live in the app, and the table shows its status. The change log at the end of the page records what changed and why.

Frequently asked questions

Change log

1. October 12, 2026

   Published.

   Why: Published for plan action S5.3 (vCISO platform depth).

2. October 4, 2026

   Created the page with 16 live program-management features.

   Why: To list the platform's program-management features, each checked against the product code.