Cybersecurity advisory services give an organisation senior security leadership, a strategy and board-level reporting without hiring a full-time chief information security officer (CISO). Arke Technologies, in Johannesburg, provides a virtual CISO (vCISO) to organisations, public bodies and schools across South Africa, covering risk, policy, compliance and plain-language reporting.
A virtual CISO, or vCISO, provides the chief information security officer function part-time, as a service. The role sets security strategy, owns the cyber risk register, writes and maintains policy, oversees incident readiness and reports to the executive and board. It suits organisations that need that judgement but not a full-time executive: mid-sized companies, municipalities and public entities, universities and TVET colleges, and school groups.
Cyber security advisory is different from security operations. The vCISO recommends what should be done, in what order and at what cost; your executive decides, and engineers and managed services carry it out. Our CISO advisory services sit above our cybersecurity services and work equally well when your own team, or another provider, runs day-to-day security. For technology leadership beyond security, see IT consulting and virtual CIO.
A few pages that name the risks that matter, your risk appetite, the controls to fund and the measures that show progress. National documents such as South Africa's National Cybersecurity Policy Framework, the US Department of Homeland Security (DHS) cybersecurity strategy and the US defence department's (DoD) cyber strategy show the shape at national scale; yours should be shorter and tied to your budget.
The strategy turned into annual cyber security plans: projects, owners, budgets and dates, aligned to your budget cycle (the MTEF for departments, the MFMA budget process for municipalities).
Who decides, who is accountable and how risk is escalated, set out against King IV Principle 12 (King V Principle 10), the Govern function of the NIST Cybersecurity Framework and clause 5 of ISO/IEC 27001.
A living risk register, reviewed monthly, with every risk owned, rated and treated.
An information security policy set your people can follow, not a shelf of templates.
POPIA compliance and ISO 27001 readiness, led end to end.
Security terms and reviews for the suppliers who hold your data or reach your systems.
The incident response plan, the contact tree and an annual tabletop exercise; see incident response.
Information security governance and risk management are two halves of one duty. Governance sets direction: the board or council approves the strategy and the risk appetite, and a committee oversees delivery. Risk management does the work: identify, rate, treat and monitor each risk, and escalate those that exceed the appetite.
IT security governance fails in two familiar ways. Either security is left entirely to the IT manager, who carries the risk without the authority, or the board receives technical reports it cannot act on. The vCISO sits between the two, turning risks into decisions a board can take and decisions into work the IT team can do. In the public sector, the PFMA and MFMA duty to maintain effective risk management and internal control extends to information security, and the Auditor-General tests it; see cybersecurity for government and IT governance, risk and compliance.
Cyber security reporting should answer three questions: are we more or less exposed than last quarter, what is being done, and what must the board decide? Our board report covers:
If we also run your IT or security operations, the vCISO reports to your executive, not to our service desk, and findings about our own service are reported like any other. Where you need a formal independent opinion, we say so and recommend an independent reviewer.
Our cybersecurity advisory rests on operating work. Our team runs managed IT and cybersecurity for client organisations in South Africa: Microsoft 365 hardening, Microsoft Sentinel SIEM deployment, Entra ID governance, Linux server administration and POPIA compliance management; see managed security operations. The controls a vCISO recommends are ones our team deploys and runs.
Last reviewed: September 2026.
A virtual CISO is priced by the time the role needs each month and the deliverables in scope: a monthly review and a quarterly board report cost less than a year that also leads ISO 27001 certification and a POPIA overhaul. The role can sit inside a managed agreement or run on its own, quoted in writing against a defined scope and cadence after a discovery conversation. For context, published South African rates for IT project work run from about R550 to R750 an hour ex VAT (matnet.co.za, September 2026).
