Cyber assurance · A named owner every month
vSCARO: a virtual security and assurance office run for you monthly
Everything a mid-size firm is asked to prove about its security, owned by a named senior lead: the certification calendar across Cyber Essentials, CE Plus and ISO 27001, customer security questionnaires answered in days, the supplier register, the evidence base behind all of it, insurer and regulator demands, and one page a month for the board. Broader than a vCISO, and built for the workload that consumes firms of 20 to 500 people. From £7,500 + VAT per month, fixed by scope.
The vSCARO at a glance
Definition
What is a vSCARO?
A vSCARO, a virtual Security, Compliance and Assurance Risk Office, is the retained function that owns everything mid-size organisations are asked to prove about their security but rarely have anyone to own: the certification calendar across Cyber Essentials, CE Plus and ISO 27001, the customer security questionnaires that arrive weekly, the supplier register, the evidence base behind all of it, insurer and regulator demands, and a monthly security position for the board. It is broader than a vCISO, which leans technical: the vSCARO owns the compliance and assurance workload that consumes mid-size firms.
Intelance runs the vSCARO, your virtual security and assurance office, from £7,500 + VAT per month with a named senior owner, working alongside your IT team or MSP, and documented throughout so you can take the function in-house whenever you choose. Where only the supplier work needs running, the Supplier Assurance Office covers that slice from £3,500 + VAT per month.
The certificates themselves sit underneath: Cyber Essentials and CE Plus for the baseline, the ISO 27001 ladder when customers want the management system, and the wider practice is described under cyber assurance.
Nothing lapses
Certification dates tracked and renewals prepared early.
Answers in days
Questionnaires answered from a maintained evidence base.
One source of truth
Policies, certificates and records kept current.
A single page each month
The board question answered from evidence.
The monthly work
What the vSCARO owns month by month
Six jobs, one named owner, each leaving evidence behind it. Every card says what lands each month.
The certification calendar
Cyber Essentials, CE Plus and ISO 27001 dates tracked, renewals prepared early, surveillance visits hosted.
Monthly outputNothing lapses, ever.Customer questionnaires
Security questionnaires answered from a maintained evidence base: accurately, consistently, in days.
Monthly outputNo deal waits on a security answer.The supplier register
Vendors tiered on arrival, certificates verified at renewal, the register kept honest month by month.
Monthly outputThird party risk with a current answer.The evidence base
Policies, certificates, test results and records in one maintained source of truth, always current.
Monthly outputAny question answerable the same day.Insurer and regulator demands
Renewal questionnaires and information requests answered with evidence rather than adjectives.
Monthly outputPremiums negotiated from proof.Board reporting
A single page each month: security status, certificates, suppliers, incidents and what needs a decision.
Monthly outputThe answer to “are we OK?”, always current.How it works
How the vSCARO runs around your renewal calendar
A published rhythm from the first month, renewal season handled early, and a same-day owner when the big ask arrives.
Take-on
Certificates, suppliers, policies and the questionnaire backlog mapped honestly, the renewal calendar rebuilt and the evidence base set up. The backlog is priced into take-on rather than discovered after.
The rhythm
The calendar run, questionnaires answered as they land, suppliers verified, evidence maintained and the board page delivered.
Certificates and insurance
Renewals prepared weeks early from a current evidence base: no rebuild, no panic, no lapse.
The big ask
An enterprise customer’s 300 question due diligence, an incident or a regulator letter: a named person picks it up the same day. This is what the evidence base was built for.
Scale or take back
Grow into your own security team with everything documented, or carry on. No lock-in by design.
Larger estates carry a larger office, and we say how much at take-on. Running a certified ISMS already? The Managed ISMS can run inside the vSCARO or on its own, from £2,500 + VAT per month.
Published fees
The services around the vSCARO
Each route is priced before you choose it, and each stands alone.
Supplier Assurance Office
Only the supplier slice run monthly: the front door, renewals, certificate re-verification and the register.Best whenSuppliers are the only gap. FeeFrom £3,500 + VAT / month 02Supplier AI & Cyber Risk Assessment
The evidence based supplier baseline the vSCARO then runs monthly: critical suppliers checked and ranked in ten working days.Best whenThe register should start from measured fact. FeeFrom £8,500 + VAT10 working days 03
Cyber Essentials & CE Plus
The certificates the vSCARO keeps current: prepared, passed and renewed without panic.Best whenCertification is the immediate ask. FeeCE Plus from £1,150 + VAT 04ISO 27001
The ladder from gap assessment to a managed ISMS, which can run inside the vSCARO or on its own.Best whenCustomers want the management system. FeeGap from £8,500 + VATThe alternatives
How the vSCARO compares with the alternatives
Three ways firms handle the prove-it workload. The difference is whether anyone owns it.
Questionnaires with sales, certificates with IT, suppliers with procurement, evidence with nobody
Deals cooling while answers are hunted, renewals discovered late
Free, until the tender asks for the lapsed certificate
Falls through the gaps
A dedicated manager carrying certifications, questionnaires and suppliers alongside operations
Depth in one person: strong until they are on leave, stretched or gone
A full time salary plus recruitment, for a workload that arrives in bursts
Months to recruit
One senior owner running the whole prove-it workload on a monthly rhythm, from £7,500 + VAT per month
Questionnaires answered in days, certificates never lapsing, one page to the board monthly
A fixed monthly fee, with the backlog priced in the open at take-on
Take-on inside a month
Scope
Inside the scope and outside it
You get
A named senior owner for the whole prove-it workload: certificates, questionnaires, suppliers, evidence and reporting.
The certification calendar run early, with renewals prepared from a current evidence base.
Customer, insurer and regulator questionnaires answered in days, from evidence.
The supplier register kept current, with vendors tiered on arrival.
A single page each month for the board, and everything documented for in-house takeover.
This is not
A technical vCISO retainer. The vSCARO covers the compliance and assurance workload that consumes mid-size firms, working alongside your IT team or MSP.
A 24/7 SOC. Monitoring and incident response stay with your IT team or MSP. The vSCARO owns what you are asked to prove.
A certification body. Certificates come from the accredited bodies. The vSCARO gets you through them and keeps them current.
A lock-in. Everything is documented so your own team can take the function over whenever you choose.
Where to start
Where this usually starts
Four situations we are usually called into. If none of them fit, speak to us and we will point you at the right first step.
Why Intelance
The rules we work to
One named owner
The person who runs your calendar, answers your questionnaires and faces your board is named before the retainer starts.
Fixed by scope
From £7,500 + VAT per month, in writing. The questionnaire and certificate backlog is priced into take-on.
Evidence behind every answer
Every response to a customer, insurer or regulator is drawn from a maintained evidence base, so it survives being checked.
We sell advice and nothing else
No platform, no licences, no vendor commission.
Documented for takeover
Everything the vSCARO builds is yours, kept so your own team can take the function in-house whenever you choose.
Who runs the work
Every vSCARO is led by a senior security lead, supported by senior consultants and established delivery partners.
Security assurance guides
All insights
Cyber EssentialsCyber Essentials vs ISO 27001 vs IASME Cyber Assurance: which do you need?
The three UK security certifications compared, including the one most guides skip: what each covers, what each costs, and the ladder order that means no money is wasted, from a certification body that holds two of them itself.
9 July 2026 · 6 min read Read the guide
Cyber EssentialsCyber Essentials vs ISO 27001: when you need one, both, and in what order
23 March 2026 · 10 min read
Cyber EssentialsCyber Essentials cost UK: full pricing breakdown (2026 guide)
23 March 2026 · 10 min read
CybersecurityISO 27001 readiness assessment checklist (UK)
8 December 2025 · 11 min readReady to talk?
Tell us what you keep being asked to prove
Thirty minutes with the person who would run it: which certificates you hold, what the questionnaire backlog looks like and when the next renewal lands. If the answer involves a spreadsheet nobody quite trusts, that is the usual starting point.
FAQs
Questions about the vSCARO
What is a vSCARO?
A virtual Security, Compliance and Assurance Risk Office: the retained function that owns everything a mid-size organisation is asked to prove about its security. It runs the certification calendar, answers customer security questionnaires from a maintained evidence base, keeps the supplier register current, handles insurer and regulator demands, and gives the board one page a month.
How much does a vSCARO cost?
From £7,500 + VAT per month with Intelance, fixed by scope in writing, with the questionnaire and certificate backlog priced into take-on. For context, a full time security manager is a salary plus recruitment for a workload that arrives in bursts, and where only the supplier slice needs running, the Supplier Assurance Office covers it from £3,500 + VAT per month.
How is a vSCARO different from a vCISO?
A vCISO leans technical and strategic: architecture opinions, risk appetite, tooling. The vSCARO is the practical alternative for mid-size firms: it owns the compliance and assurance workload that consumes them, certificates, questionnaires, suppliers, evidence and board reporting, working alongside the IT team or MSP that runs the technology.
Does a vSCARO include 24/7 security monitoring?
No. Monitoring, detection and incident response remain with your IT team or MSP, and the vSCARO works alongside them. What the vSCARO owns is the layer above: the certificates, the evidence, the questionnaires and the reporting that prove your security to whoever asks.
What happens to customer security questionnaires under a vSCARO?
They stop being a crisis. Each one is answered from a maintained evidence base, accurately and consistently, in days. When the big ask arrives, an enterprise customer’s 300 question due diligence or a regulator letter, a named person picks it up the same day, because the evidence base was built for exactly that moment.
Can the vSCARO run our ISO 27001 ISMS?
Yes. The Managed ISMS from £2,500 + VAT per month can run inside the vSCARO or on its own, keeping the management system audit-ready between certification visits. Where you are not certified yet, the ISO 27001 ladder starts with a gap assessment from £8,500 + VAT.
What does outsourced security compliance mean in practice?
The workload runs without you carrying it: the calendar tracked, the evidence maintained, the questionnaires answered, the suppliers verified and the board informed. The decisions stay yours, the artefacts stay yours, and the function is documented so your own team can take it over whenever you choose.
How does a vSCARO engagement end?
By takeover, by design: everything is documented so your own security hire or team inherits a running calendar, a current evidence base and a live register rather than a blank page. There is no lock-in, and the function scales down or hands over whenever you choose.