A virtual CIO provides technology strategy without the cost of a full-time executive. The idea is straightforward: most businesses under a few hundred people cannot justify a chief information officer, but they still face decisions that need one.
The term is also used loosely, and in a fair number of cases the vCIO meeting is a sales meeting with a different name. Here is what the role should actually deliver and how to tell the difference.
What the role covers
A vCIO works on the questions that sit above day-to-day support:
- Technology roadmap — what needs replacing, upgrading or retiring, and in what order
- Budget planning, with multi-year capital forecasting rather than annual guesswork
- Risk assessment and the case for addressing specific risks
- Vendor strategy and contract negotiation
- Aligning technology decisions with where the business is actually going
- Compliance posture and what will be required as obligations grow
- Translating technical reality into terms a board or owner can act on
The last of these is often the most valuable and the least discussed. Businesses rarely make bad technology decisions because the technical facts were unavailable. They make them because nobody translated those facts into business consequences in time.
How it differs from support and account management
Three roles are frequently conflated.
Your helpdesk resolves issues. Your account manager owns the commercial relationship and, generally, has a target. Your vCIO advises on direction, and should be capable of recommending something that reduces your spending with their own employer.
That last point is the honest test of the role. A vCIO who has never advised you to cancel something, delay a purchase, or keep hardware another year is probably not operating as an advisor.
What a real engagement looks like
Typically quarterly, structured, and documented. A substantive session covers:
- Review of the period — incidents, trends, anything recurring
- Current state of the asset estate and what is approaching end of life
- Progress against the roadmap agreed last time
- Risks that have changed, appeared, or been closed
- Budget position against forecast
- Business changes ahead — hiring, locations, new systems, new clients with requirements
- Agreed actions with owners and dates
You should leave with a written record and a small number of decisions. A meeting that produces neither is a status update.
Do you need one?
The case is strong when several of these apply:
- Above roughly 25 employees, where informal decision-making starts to break down
- Growing or changing shape — new locations, acquisitions, a shift in operating model
- Compliance obligations, current or approaching
- Nobody internally who can evaluate a technology proposal critically
- Recent technology decisions that turned out badly, or spending that has crept without anyone owning it
- Board or investor reporting that includes technology risk
It matters less for very small businesses with simple environments, and for organisations that already have a capable internal IT manager — though even then a periodic outside view has value, precisely because it is outside.
How it is usually priced
Three common structures: included within a managed services agreement, usually at a defined cadence; a separate retainer, typically monthly; or engaged by the day for specific pieces of work such as budget planning or a system selection.
Included is the most common and the most variable in quality, because when it costs nothing separately it is easy for it to become nominal. Ask what the cadence is, whether it is contractual, and what the deliverable looks like.
Telling strategy from a sales meeting
Questions that reveal which you have:
- What did you recommend last year that we did not do, and what happened?
- What are we currently spending that we should stop?
- What is the biggest technology risk to this business, and is it being addressed?
- Where should we not spend money this year?
- What would you do differently if you were not our provider?
A genuine advisor answers all five. If every recommendation you have ever received involves buying something additional from the same provider, that is the answer to your question, and it may be worth engaging strategy separately from delivery.