The published Dyasol options
The external roles page publishes three monthly capacity levels: €1,400 for one day, €2,600 for two days and €4,900 for four days. An expert day is eight hours and can be used in parts. An additional agreed senior day is €1,300. These are Dyasol's published options, not market averages or a promise of an unrestricted security function.
Preparation, analysis, meetings, written responses and agreed coordination consume that capacity. The final scope and price are confirmed in writing. The scope and working terms also explain carry-forward: up to half the monthly allowance can be used in the next month, after which it expires. Confirm those terms in the engagement rather than budgeting as though all unused time accumulates indefinitely.
Decide which responsibility you are buying
An external CISO can help management set priorities, interpret evidence, coordinate owners and make security decisions explicit. A person hired to advise does not automatically become the administrator implementing every configuration change. Likewise, a monthly advisory arrangement does not establish a 24-hour incident response service.
Write down which decisions remain with your management, which tasks stay with IT and which work the external lead owns. For example, the lead might review access exceptions and report unresolved risk; the internal administrator might implement approved changes; the business owner might accept the remaining exposure. Our CISO, vCISO and IT manager comparison helps resolve the organisational boundary first.
Plan one month before choosing a tier
Start with the work due, its dependencies and an estimate of effort. A short meeting may require substantial preparation if nobody has reconciled the evidence. A bank's questionnaire may involve legal commitments and supplier input as well as technical answers. Naming these dependencies makes the estimate useful.
A fictional eight-hour allocation might use two hours reviewing evidence, two coordinating actions, two preparing a management discussion, one in that discussion and one updating the decision log. It illustrates capacity arithmetic only. It is not a standard package, a service-level commitment or a guarantee that your review fits in a day.
Now add an unexpected customer request. Decide in advance whether it displaces scheduled work, uses separately agreed capacity or waits. Without that decision, the monthly report can look complete while the most urgent business question remains unanswered.
Compare proposals on the same basis
| Buying question | What the proposal should make explicit |
|---|---|
| Who does the work? | Engagement lead, participating specialists and replacement arrangements |
| What consumes time? | Preparation, calls, review, written work and coordination |
| What happens urgently? | Contact route, response arrangements and exclusions |
| What remains after a month? | Decisions, evidence references, actions, owners and review dates |
| What needs another budget? | Implementation, licences, specialist testing or separately scoped projects |
Request a first-month priority list and acceptance criteria. “Improve security maturity” is too broad to check against an invoice. “Review the agreed identity exceptions, document the unresolved decisions and assign remediation owners” is assessable, provided the systems and evidence are defined.
When a project is the better starting point
If the immediate need is a bounded answer, a separate assessment may be more useful than an open monthly commitment. Examples include determining regulatory applicability, preparing one questionnaire or investigating a defined email problem. If the organisation has no reliable baseline, agree how establishing it affects the monthly capacity.
If recurring work requires more capacity than the proposed arrangement provides, address that openly. An inexpensive retainer that leaves ownership unclear can create more coordination work for the client. A larger allowance is only useful when there is an agreed queue of work and people available to act on its results.
A buying worksheet and the next conversation
Use the vCISO scope comparison worksheet to record the monthly decisions, deliverables, hours, availability and exclusions for each proposal. Leave unknown terms marked as questions. Do not score an unanswered commitment as included.
For a useful first conversation, bring the reason you need leadership now, the most important deadline and the people already handling IT and security. Dyasol can then propose an appropriate external role and capacity. Management retains its responsibilities; the engagement should make them easier to exercise with evidence.