Marketing Agencies
A Security Leader to Answer the Questionnaire Your Biggest Client Just Sent.
Client security reviews are now part of winning and keeping accounts. A virtual CISO owns the answers, the policies behind them and the plan, part time, with our team behind them.
For agencies whose clients ask security questions that nobody on the creative or account team can answer.
Virtual CISO (vCISO) for Marketing Agencies
How Do We Handle Client Security Questionnaires?
Your vCISO answers them with you, from controls that are actually in place, and keeps the answers consistent from one client to the next. Because the same company runs your IT, the plan and the people carrying it out do not drift apart, and a yes on a questionnaire is a yes in practice.
Help with client, supplier and insurer security questionnaires is part of the service.
A Client Asked If We Have SOC 2. What Do We Say?
Say what is true. We do not perform SOC 2 audits: a SOC 2 report is issued after an examination by a CPA firm. We run the controls and write the policies and procedures that an examination asks about, and your vCISO helps you decide whether a report is worth pursuing or whether a clear questionnaire and a policy pack answer the client.
Are We a Processor Under State Privacy Laws?
When you handle personal data for a client, such as an email list or a customer database, you may be a processor. Under the Virginia Consumer Data Protection Act, a processor handles personal data on behalf of a controller, and the law sets duties including following the controller's instructions, helping with security and deleting or returning data when the work ends. Other states differ, and some businesses are exempt, so confirm with your counsel.
Your vCISO builds the practical side: who may touch client data, how long you keep it and how it is returned or deleted when a contract ends.
What Policies and Offboarding Process Do We Need?
A cybersecurity policy and the procedures under it: who gets access to which client account, how freelancers are onboarded and removed, what staff do when they suspect a bad login, and who calls the client. We also write the incident response plan and test it, so people know their part.
What Is Included
6 PARTSTechnology Roadmap
Your goals lined up with the right technology, in order.
Governance and Policy
A cybersecurity policy and the procedures under it.
Incident Response Planning
A written plan, tested so people know their part.
Program Oversight
Security program management and regulatory oversight.
Questionnaires and Reviews
Help with client, supplier and insurer security questionnaires.
Leadership Reporting
Risk explained in plain language to the people who decide.
Frequently Asked Questions
4 QUESTIONSCan you give us a SOC 2 report?
No. We do not perform SOC 2 audits. A SOC 2 report comes from an examination by a CPA firm. We run the controls and keep the documentation that an examination asks about.
Will you fill in our clients' security questionnaires?
Yes, your vCISO works through them with you, based on what is in place. We will not answer yes to a control you do not run.
Does a state privacy law apply to us as an agency?
It depends on your clients, your location and the data you process for them. Confirm with your counsel. We help with the technical safeguards and the records.
How much time does a vCISO spend with us?
It is scoped to what you need, from a regular cadence of meetings to deeper involvement during a client review or an incident. We set it on the call.
More for Marketing Agencies
Managed IT and Help Desk
Unlimited remote support, monitoring and maintenance at a fixed monthly cost.
Microsoft 365 and Email Security
Microsoft 365 set up, secured and run, with email protection against phishing and spoofing.
Managed Security Monitoring (MDR and SOC)
Round the clock monitoring, detection and response from a security operations center.
Managed Security Monitoring (MDR and SOC) for Marketing Agencies
Backup and Ransomware Recovery
Encrypted, off-site backups that are tested, and a plan to restore the business after an attack.
Marketing Agencies
Managed IT and security for digital, creative, PR and advertising agencies that hold their clients' logins and data.
Talk Through Security Leadership.
Pick a time. Tell us which client questionnaire is on your desk and who is answering it today.
Looking for CMMC? Our Compliance Division, Capital Cyber Compliance, delivers it.
Under 25 people? Apply for an in-kind cybersecurity grant from Cyber Grants Alliance, a nonprofit. No cost to you.