vCIO & vCISO

Executive IT leadership without the executive salary

A full-time CIO costs $250,000-$400,000 per year in the NYC/NJ market. A full-time CISO costs $250,000-$500,000. Most 10-to-200-employee businesses cannot justify those salaries — but they are making CIO-level and CISO-level decisions every quarter without the expertise those roles provide. Bad vendor contracts, unplanned capital expenditure, security gaps, failed audits, and compliance penalties are the cost of winging it.

Sage provides the same strategic output — written roadmaps, scored assessments, IT budgets, security policies, compliance documentation, and board reporting — at $22,000-$48,000 per year.

What the vCIO delivers

Technology roadmap — A written 3-to-5-year plan for your IT environment, updated quarterly. What to keep, what to replace, when to replace it, and what it will cost. Scored against a digital maturity index so you can see progress over time.

IT budget and forecasting — An annual IT budget built from the roadmap, with monthly variance tracking. Capital expenditure planned and smoothed so there are no $80,000 surprises in Q3. Hardware lifecycle management included — we track warranty expirations, end-of-life dates, and replacement windows.

Vendor management — ISP contracts, SaaS renewals, phone systems, line-of-business applications. We evaluate alternatives, negotiate pricing, and manage the relationship. Clients save an average of 20-40% on vendor consolidation in the first year.

Quarterly Business Reviews — A structured 60-to-90-minute session every quarter with a written report: environment health scorecard, ticket trends, security posture, roadmap progress, budget variance, renewal calendar, and a prioritized recommendation list.

What the vCISO delivers

Security risk assessment — A formal assessment of your security posture against NIST CSF 2.0 or the framework your industry requires. Identifies gaps, quantifies risk, and produces a remediation roadmap with timelines and costs.

Security policy development — Acceptable use, incident response, access control, data classification, remote work, BYOD, and vendor risk management policies. Written, reviewed annually, and mapped to the compliance framework you need.

Compliance strategy — Framework-specific mapping for HIPAA, PCI DSS 4.0, NY SHIELD Act, SOC 2, NIST, or CMMC. We identify which controls you satisfy, which have gaps, and what remediation costs and looks like. For audit prep, we produce the documentation package your auditor or assessor needs.

Board and executive reporting — Quarterly security posture reports written for a non-technical audience. Risk rating, incident summary, compliance status, and recommended actions. Your board gets the information they need without translating from technical jargon.

Incident response planning — A written IR plan tailored to your environment, your threat profile, and your regulatory obligations. Annual tabletop exercises to test it. Coordination with your cyber insurance carrier and breach counsel.

What this costs

• vCIO Advisory — $1,800 per month. Approximately 8 hours per month: quarterly roadmap updates, monthly budget tracking, vendor management, and QBRs.
• vCISO Advisory — $2,700 per month. Approximately 10 hours per month: risk assessments, policy development, compliance mapping, board reporting, and IR planning.
• Combined vCIO + vCISO — $4,000 per month. Full strategic IT and security leadership under one engagement.
• Sovereign managed clients — 4 hours per month of vCIO advisory included in the Sovereign tier ($225/workstation/month). Full vCIO, vCISO, or combined engagement available at 10% off standalone pricing.

For context: a full-time CIO plus a full-time CISO in the NYC/NJ market costs $500,000-$900,000 per year fully loaded. Sage delivers the strategic output of both roles for $48,000 per year combined.

How the engagement works

Month 1-2 (assessment): We audit the current environment, interview stakeholders, review existing documentation, evaluate vendor contracts, and assess security posture. Output: initial roadmap, budget model, risk assessment, and gap analysis.

Month 3+ (steady state): Quarterly roadmap and policy reviews. Monthly budget variance tracking. Ongoing vendor management. QBRs every 90 days. Annual tabletop exercise and policy refresh. Board reports as needed.

What you get in writing: Every deliverable is documented — roadmaps, budgets, scorecards, policies, QBR decks, board reports. If you change providers, the next team inherits a documented strategy, not tribal knowledge.

Who this is for

• SMBs with 10-200 employees making technology and security decisions without dedicated leadership
• Businesses approaching a compliance audit (HIPAA, PCI, SOC 2) that need a strategy, not just tools
• Companies whose cyber insurance renewal questionnaire exposed gaps they cannot fill internally
• Organizations with an internal IT person who is strong operationally but needs strategic backup
• Businesses spending $15,000+ per month on IT without a documented plan for what that money buys