vCISO Mastery: Assess, Advise, Lead

The analyst built the program. The manager ran it. The CISO led it at board level. The vCISO does that work for several organizations at once while running a practice. vCISO Mastery: Assess, Advise, Lead is Level III, the top rung of the Cover6 vCISO Pathway.

In a six-month case, you run your own vCISO practice with four clients: a public college with an incident nobody has assessed, a physician-owned clinic group that relies on its MSP, a freight company with a private equity sponsor and an insurance renewal due, and a startup that needs SOC 2 to close a deal. Then a fifth, unseen client asks you to take them on.

What you’ll be able to do

• Run a client security assessment end to end, with limited access and the clocks already running.
• Turn findings into a prioritized roadmap the client owns, with risks in ranges and a budget that adds up.
• Report to boards and executives: college trustees, physician partners, a private equity sponsor and startup founders.
• Scope, price and deliver vCISO engagements: proposals, statements of work, retainers, change orders, renewals and clean exits.
• Carry several clients at once with capacity planning, scheduling, earned value and change control.
• Hold the ethical line on conflicts, confidentiality between clients and clients who ask you to hide something.

Every engagement follows the six public phases of the Cover6 Framework: Discovery & Assessment, Policy & Governance, Technical Assessment, Operations & Procedures, Monitoring & Resilience, and Stewardship & Renewal.

What you build

Your Practice Book: ten client-ready deliverables, from a practice charter and a statement of work to a SOC 2 readiness plan, an incident decision memo, board reports, a pricing model and three ethics decisions. The capstone is a complete Practice Book for the new client: proposal, assessment, 12-month roadmap and budget, first report to the partners, and a memo showing the work fits your practice.

How it works

Every exercise runs on the case packet, the workbook and the document templates. Every deliverable gets AI-assisted feedback against a published rubric, and each model answer unlocks after you submit your own. The capstone, scored against its published rubric, decides the level. Pass the capstone and the final assessment, complete every lesson, and you earn vCISO III.

Who it’s for

Graduates of CISO Prep (vCISO II), and security leaders already working at board level who pass the placement check.

PMP exam prep included

Enrollment includes Cover6’s PMP exam prep; you’re enrolled automatically. Much of a vCISO practice is project and portfolio management; use the prep alongside Topics 8 and 9. PMI sets the PMP’s eligibility rules, including what counts toward its 35 contact hours; check pmi.org. The course prepares you for the exam. It does not guarantee a pass, a job, clients or income.

Certificate, CPE and DoD 8140

Your certificate shows the course name, your level, your completion date, 30 CPE hours, a certificate ID and a QR code that opens cover6solutions.com/verify, where an employer or client can confirm it. CPE hours may be submitted to your certifying body (CompTIA, ISC2, ISACA, PMI and others) according to its rules. Each body decides what it accepts. The course is aligned with DoD 8140 work role 722, Information Systems Security Manager, at the Advanced level. Alignment is not approval.

What’s next

The Cover6 vCISO Challenge is a separate product with no prerequisite and an elite title of its own. You don’t need it to earn vCISO III, and you don’t need vCISO III to attempt it. PECB CISO and PECB ISO/TS 31050 Emerging Risk are listed separately on the vCISO track.