Cyberprotech

CISOaaS · Ongoing capability

Cybersecurity leadership supported by a team, method and continuity.

CISOaaS is an ongoing service model combining cybersecurity leadership, a supporting team, method, working cadence, deliverables and continuity arrangements. It may include a vCISO of reference, but it is not limited to one person’s availability.

Understand the approachTalk to us
CISOaaS connecting management, risk, team, roadmap and evidence

The problem

The organization needs sustained capability, not only isolated interventions.

Decisions, risk, suppliers, implementation and evidence evolve in parallel. Without an ongoing model, context is lost between meetings, people and providers. CISOaaS establishes governance, cadence, accountability and continuity to keep the programme active and verifiable.

Service architecture

Two layers operating as one CISOaaS capability.

The service combines leadership close to management with a structure able to sustain delivery, evidence and continuity.

01 · Direction and decisions

Leadership and governance

Context, risk and priorities

A leadership reference supports management, translates risk into decisions and keeps accountability, priorities and the roadmap coherent.

When it may be appropriate

Organizations requiring regular direction, executive coordination and control over a cross-functional cybersecurity programme.

What distinguishes this model
  • Leadership reference
  • Risk and priorities
  • Roadmap and decisions
  • Management reporting
Essential boundary

External leadership supports and coordinates; it does not transfer the legal or governance responsibilities of the entity’s governing bodies.

02 · Delivery and resilience

Team and continuity

Method, deliverables and substitution

The capability is not dependent on a single person: it combines complementary skills, cadence, records and continuity arrangements.

When it may be appropriate

Organizations requiring recurring support across internal teams, suppliers, technical delivery, compliance and audit.

What distinguishes this model
  • Multidisciplinary team
  • Substitution arrangements
  • Recurring deliverables
  • Evidence and follow-up
Essential boundary

Scope, availability and service levels are defined contractually; CISOaaS does not presume 24/7 operations.

Regulated roles

The contracted service must remain separate from the formal appointment.

After choosing the leadership model, the entity must separately address the formally appointed individual, the permanent operational contact and the responsibilities that remain with the competent governing bodies.

Legal role

Cybersecurity Officer (RCS)

A person within the entity’s own staff appointed under Article 31, who is a member of the management, executive or administrative bodies or reports organically and directly to them. The external CISOaaS/vCISO provider supports that person without taking over the statutory role.

Operational role

Permanent Point of Contact (PCP)

A person, team or third-party entity communicated to assure operational and technical flows, primary and alternative contacts and availability during the activation periods established in Article 32.

Organizational examples

Three possible models with different boundaries.

These examples help structure the decision; they do not replace analysis of the framework, the appointment instrument or the entity's actual circumstances.

01

Internal model

Internal RCS + internal PCP or internal team

The entity concentrates governance and operational contact within its own structures and may contract specialist support for assessment, implementation, exercises or review.

Requires authority, competence, availability, substitution and genuine internal capability.
02

Externally assisted model

Internal RCS + vCISO/CISOaaS + internal or third-party PCP

Appointment and reporting remain clearly internal while the external service reinforces method, risk, documentation, reporting and coordination of delivery.

The contract must distinguish advice, performance, decision-making, availability and responsibility.
03

Specific statutory arrangements

Coordination within direct state administration or a corporate group

Article 31(6) and (7) provide specific arrangements for a shared officer within direct state administration and common coordination within a corporate group. These arrangements do not constitute general authorization to outsource the RCS role.

Confirm the applicable statutory arrangement and document officers, contacts and reporting; keep external support separate.
Primary sourcesArticles 31 and 32 of the RJCS (PT) ↗Articles 14 and 15 of the Regulation (PT) ↗

What we structure

An approach connected to the organization's reality.

01

Governance and decisions

Define accountability, priorities, decision criteria and management reporting.

02

Risk and roadmap

Maintain risks, dependencies, commitments and initiatives within an actively managed plan.

03

Cross-functional coordination

Coordinate internal teams, suppliers, technical delivery, compliance and response to deviations.

04

Reporting and evidence

Record decisions, indicators, reviews and evidence suitable for management and audit.

05

Service continuity

Reduce individual dependency through a team, documentation, substitution and preserved context.

Method

From context to ongoing support.

The specific scope is adjusted to the organization's size, maturity, risk and internal capability.

  1. 01Understand the organization
  2. 02Define responsibilities
  3. 03Establish priorities and cadence
  4. 04Monitor delivery and risk
  5. 05Report to and review with management

Expected outcomes

What should improve after the intervention.

  • Clearly defined CISOaaS model and liaison
  • Documented accountability and boundaries
  • Traceable decisions and priorities
  • A roadmap managed to an agreed cadence
  • Continuity beyond a single individual

Clear boundaries

What the intervention neither assumes nor transfers.

  • According to the clarification provided by CNCS to Cyberprotech, the Cybersecurity Officer (RCS) must be part of the entity’s own staff. CISOaaS/vCISO supports the internal RCS and governing bodies without replacing the statutory appointment.
  • Management retains the responsibilities assigned by law and the entity’s governance arrangements.
  • Authority, availability, service levels, conflicts and substitution must be formally defined.

Possible connections

These links help continue the pathway; they do not represent mandatory dependencies or a closed package.

vCISO: person and mandateExplore →Implementation CenterExplore →Regulation No. 756/2026Explore →

Next step by maturity

Move forward from where you are.

Choose the action that matches the organization's current clarity and capability.

01 · Understand

I am still framing the subject.

Begin with related information and validate assumptions before selecting an intervention.

Explore knowledge → 02 · Structure

I already recognize the problem.

Review the intervention, method, deliverables and boundaries to organize internal priorities.

Review the approach → 03 · Act

I need to move forward with context.

We begin with context, accountability, cadence, team and expected outcomes before defining the service.

Assess the CISOaaS model →

Next step

Do you need to establish an ongoing CISO capability?

We begin with context, accountability, cadence, team and expected outcomes before defining the service.

Assess the CISOaaS model