vCISO & vCTO Services UAE
Discuss Your vCISO/vCTO Requirements
VARA Technology and Information Rulebook, Part I
I.I
Chief Information Security Officer and Management
Every VARA-licensed VASP must appoint a CISO
A dedicated role
The CISO must be a separate individual from the Compliance Officer, and is responsible for the VASP’s compliance with Parts I and III of the Rulebook (Rule I.I.1).
One appointment, two roles
The CISO may also take on the responsibilities of the Data Protection Officer (Rule I.I.1).
Standing and experience
The CISO must be of sufficiently good standing and appropriately experienced (Rule I.I.2).
ITSEC vCISOs currently serve in the CISO role for multiple VARA-licensed VASPs. The Rulebook does not address outsourced CISOs directly, so confirm your arrangement with VARA.
Read Rule I.I on rulebooks.vara.aeWhy Organizations Require a vCISO
"Security leadership is not optional for UAE-regulated entities. How you source it is a strategic decision."
What your vCISO owns
Six areas of accountability, each tied to something you can hand to your board or your regulator.
Area
What the vCISO does
What you receive
Strategy and governance
Sets a security roadmap aligned with business objectives and defines who owns what.
Security strategy and roadmap
Risk and controls
Identifies and prioritizes risk, aligns controls with recognized frameworks such as ISO 27001 and NIST, and tracks maturity.
Risk register and prioritization model
Regulatory alignment
Aligns you with your regulator’s requirements and structures the evidence, including VARA testing under Rules I.E.1 and I.E.5.
Policy, governance guidance and audit readiness support
Security operations oversight
Oversees internal and third-party security activity, incident readiness and vendor risk.
Incident governance and post-incident oversight
Board and regulator reporting
Represents security at executive and board level and answers regulator and investor questions.
Executive and board-level reports
Security culture
Leads executive and staff awareness and holds training to account.
Governance over training and accountability
How the engagement runs
1
Assess
Establish your baseline: risk, controls and maturity across the organization.
2
Plan
Define security priorities, milestones and ownership.
3
Lead
Act as your security leader in executive and operational settings.
4
Report and improve
Structured updates, metrics and improvement tracking for management and the board.
Engagement Models
Strategic guidance and periodic oversight for organizations with existing security capabilities seeking executive direction.
Active leadership with regular executive engagement, governance oversight, and structured reporting cadence.
Deep integration with management and delivery teams, functioning as a core member of the executive leadership structure.
Minimum engagement is 3 months. Typical engagements run 6–12 months, and ongoing programs are available. Structure is tailored to your maturity and risk exposure.
Case study
ITSEC in the CISO role at a VARA-licensed VASP
A VARA-licensed virtual asset service provider needed a CISO who meets the Rulebook’s requirements without a full-time C-suite hire. An ITSEC vCISO serves in that role.
Client
A VARA-licensed VASP, Dubai
ITSEC role
vCISO serving in the CISO role
Framework
VARA Technology and Information Rulebook
What the role carries under the Rulebook
Responsibility for the VASP’s compliance with Parts I and III of the Rulebook, as a separate individual from the Compliance Officer
Rule I.I.1
Review and update of the Cybersecurity Policy at least annually
Rule I.B.2
Independent vulnerability assessment and penetration testing at least annually and before new systems, applications or products go live, with results available to VARA on request
Rule I.E.1
Reporting of material cybersecurity events to VARA within 72 hours of detection
Rule I.K.1
Also engaged: a Dubai VASP applicant
A virtual asset firm preparing its VARA submission has signed ITSEC to provide its outsourced CISO and CTO, so both roles are in place for the application.
The client’s name and engagement details are confidential under NDA.
Why ITSEC for vCISO Services
Serving UAE regulated businesses since 2011 across VARA, DFSA, CBUAE, ADGM, CMA (formerly SCA), DESC, DHA, GCGRA, and ADHICS engagements.
ITSEC vCISOs currently serve in the CISO role for multiple VARA-licensed VASPs
Serving UAE regulated businesses since 2011 — VASPs, fintechs, banks, healthcare, and gaming operators
Integrated with ITSEC VAPT, smart contract audit, and SVG regulatory licensing — end-to-end from security posture to licensed operation