vCISO & ISMS management

Your ISMS under control. Your security professionally led.

Norvault helps SME organizations with ISO 27001, ISMS management, risk management and security governance. You get structure, clear priorities and support when security work keeps slipping.

No hour bundle: you choose a level of continuity, expertise, direction and execution.

Plan an introduction View the packages

Prefer to email directly: office@norvaultsecurity.com

Compare vCISO, internal CISO and Security Officer

Recognizable?

Security work often slips beside day-to-day operations.

Many SME organizations know what needs to happen, but lack time, rhythm or clear ownership.

The ISMS mainly gets attention just before an audit.

Risks and improvement actions stay open too long.

Security tasks are spread across people without clear ownership.

Customer and compliance questions take more and more time.

New requirements such as NIS2, ISO 42001 or client frameworks add extra pressure.

Norvault brings structure, monitors the cycle and takes over work where that is needed.

vCISO subscriptions

Three levels of support, no hour bundles.

You choose the level of continuity, expertise, direction and execution that fits your organization.

The subscriptions have a minimum term of twelve months. Prices exclude VAT. Beforehand, we discuss scope, current setup and desired support to determine which subscription fits best.

Launch

from €695 per month

You execute, Norvault keeps rhythm and overview.

For organizations with an internal owner who carries out most operational security actions.

Working model

You carry out most operational actions yourself. Norvault monitors, advises and helps prioritize.

Key points

Monitoring the annual ISMS planning
Monthly ISMS meeting and concrete action list
Management of the risk and improvement register
Up to four limited risk analyses per year

Also included

Limited document reviews and small updates
Support with management review and audit preparation

Start by email about Launch

Most chosen

Elevate

from €1,250 per month

Norvault performs more work and coordinates follow-up.

For organizations that need active ISMS management and structural coordination with internal teams.

Working model

Norvault manages and coordinates more work together with your internal teams.

Key points

Active management of the ISMS annual calendar
Management and follow-up of risks and improvement actions
Regular risk analyses
Maintenance of policies, procedures and records

Also included

Management review and periodic reporting
Support with supplier and customer requirements

Start by email about Elevate

Ascend

from €1,995 per month

Norvault leads security as an external CISO.

For organizations that need ongoing senior security leadership from an external CISO.

Working model

Norvault provides structural security leadership as an external CISO and advises at management level.

Key points

Structural security strategy and direction
Security strategy and annual roadmap
Management reporting and executive advice
Direction over risks, crisis preparation and improvement programs

Also included

Support with complex customer and assurance questions
Coordination of internal and external security stakeholders

Start by email about Ascend

The final price depends on factors such as sector, risk profile, customer requirements, legal obligations, number of frameworks and the extent to which Norvault takes over work.

Package contents

What is actually included in each package?

A compact comparison of the most important parts. Elevate is deliberately the recommended middle model for organizations that want more rhythm, management and follow-up.

Compare Launch, Elevate and Ascend by item.
Part	Launch	ElevateMost chosen	Ascend
Main division	Self-execution with advice and monitoring	Active management and coordination	Ongoing security leadership
Monthly check-in	Yes	Yes	Yes
Risk and action register	Basic management	Active management	Strategic direction
Management reporting	Annual/light	Quarterly	Custom
Supplier assessments	Limited	Included	Extensive/custom
Security questionnaires	Limited	Included	Included/custom
Awareness	Advice	Planning and basic content	Custom program
NIS2	Signalling	Readiness check and follow-up	Governance and implementation direction
ISO 27001 audit preparation	Basic	Active	Extensive
Pentest discount	None	8%	10%
ISO 27001 implementation	Scoped separately	Scoped separately	Scoped separately

Scoped separately

Work that is usually outside the subscription

Audit preparation is provided within the selected support level. Formal audit work, external audit support and larger specialist engagements are scoped separately in advance.

Internal auditsExternal audit supportPenetration tests: Elevate 8% discount, Ascend 10% discountIncident preparation, crisis plans and tabletop exercisesLarge implementations and improvement projects

How we work

Pragmatic, sharp and without unnecessary bureaucracy.

Norvault combines fixed ways of working with senior security experience, keeping information security workable for busy teams.

Practical support for ISO 27001, ISMS management and security governance.

Clear priorities for management, IT, suppliers and customer questions.

Scalable support that can grow from structural advice to active execution and security strategy.

Efficiently organized with templates, automation and reusable working methods.

FAQ

Frequently asked questions

Which package fits my organization?

Launch fits when your team carries out most work while Norvault advises and monitors. Elevate fits when Norvault takes on more management and coordination. Ascend fits when you need ongoing security leadership from an external CISO.

Are internal and external audits included?

Audits and external audit support are scoped separately. We can support audit preparation within the subscription, but formal audit days are planned separately.

Can I switch to another package later?

Yes. When your organization grows, receives more customer requirements or manages multiple frameworks, we can adjust the service level.

Does the price depend on employee count?

Not as a hard boundary. Sector, risk profile, customer requirements, legal obligations, number of frameworks and the amount of work Norvault takes over matter more.

Can Norvault help with multiple frameworks?

Yes. We support ISO 27001, ISO 42001, NIS2 and the Dutch Cybersecurity Act and other client or sector-specific requirements where they fit your context.

vCISO

Not sure which level fits your organization?

In a short conversation we determine what support is needed and which package matches it.

Plan an introduction