Virtual CISO: getting started

This guide explains how to start using the services in the Aegister Virtual CISO plan. It covers how to create or access your account, verify your license, and navigate the vCISO section of the side menu.

1. Create or Access Your Account

To get started:

Create an account: If you don’t have one, follow the account creation and first login guide.
Log in: If you already have an account, sign in at app.aegister.com.

2. Verify Your Virtual CISO License

After logging in, check that the Virtual CISO license is active for your Organization: open Organizations, click your organization and look at the Licenses tab. You need an active license to access the Virtual CISO services.

To request a license, an Owner clicks Acquire licenses on that tab, picks the products and clicks Request licenses: this opens an email to Aegister.

3. Navigating the vCISO Section

Once your license is confirmed, open vCISO in the side menu. It has four pages:

Cyber Posture: shows where your organization stands on each framework. The Summary tab gathers posture, controls, the tasks due next and progress over time; the Documents and Tasks tabs follow the documents and the remediation tasks; each framework (for example ISO 27001 or NIS 2) has its own tab with its categories and controls. Open it here.
Evaluations: shows one card per framework associated with your organization, with its score, how many controls are answered and its trend. From here you evaluate a framework. Open it here.
CSIRT bulletins: checks every CSIRT Italia vulnerability bulletin against your hardware and software inventories. See the guide.
Incident Notifications: prepares the NIS 2 notifications of an incident for the ACN portal. See the guide.

4. Structure of the vCISO Section

4.1 Cyber Posture

Audience: all users within an organization.
Functionality: shows the implementation status of the controls, tasks and documents of the frameworks associated with your organization.

4.2 Evaluations

Audience: security officers and owners.
Functionality:
- Shows the frameworks associated with your organization, one card each, with Evaluate and Open dashboard.
- Manage frameworks, in a card’s menu, opens the organization’s Compliance tab, where the organization’s frameworks are chosen (see below).

4.3 Choosing your frameworks

Audience: security officers and owners.
Functionality: the frameworks your organization follows (for example NIS 2 or ISO 27001) are set on the organization’s Compliance tab: open the organization from Organizations. Switch a framework on and Save: it appears in vCISO with its own card. Switch it off and the console asks first, showing how many evaluations leave with it; switching it on again brings them back.

5. Task Management

Tasks fall into two types:

Automated: scheduled scripts defined in the security framework that run periodically, with a log of past executions.
Self: tasks that require manual work.

Filling a Task

Open it: on Cyber Posture, open the Tasks tab, click a task and then Complete task. A table task opens its table, where Add row adds an entry; a question task opens its questions.
Actions, at the top right, holds the other ways to fill it:
- Import → Excel (tables only): download the template, fill it in Excel or Google Sheets, upload it and check every row before you confirm. The rows replace the table, or join it if you keep the rows the file does not mention.
- Import → From your documents (AI): add up to 5 documents you already have (PDF, Word, Excel, CSV, text or images, 10 MB each). The AI reads them and proposes the answers, each with its confidence and the document it came from. Nothing is saved until you check the answers and save. It is not offered on a table built from another one, such as the risk treatment.
- Import → Automatically, via API: shows how a script or your own agent can keep the task up to date through the API (see Guide: the spec-driven V-CISO API in the API Reference tab).
- Export → Excel (tables only) and Delete → Clear all answers.
A framework control and a document have the same Actions menu, with Automatically, via API only.
Only Security Officers and Owners see Actions.
A saved evaluation counts only if it holds at least one answer: until then the framework shows “no evaluation yet”.

Evaluating a Framework

Evaluate: on vCISO → Evaluations, click Evaluate on a framework’s card. The framework opens as a list of steps, one per category (for NIS 2, categories such as Asset Management or Supply Chain Management), each with its score and how many controls are answered.
Answer the controls: pick a category to answer its controls one at a time. For each control, choose how far it is in place (from Not Existent to Optimized, or Not Applicable), write a justification and add evidence (PDF, Office documents or images, up to 10 MB). Move with Next and Previous, then click Save step to save the category.
Evaluation history: on Cyber Posture, open a framework’s tab and click a control. The control opens with its status, score and last change. How it got here shows each level the control reached and when, with the number of evaluations. Answer shows who gave the current answer, when, the maturity and the justification; below are the description, the linked task and the evidence. Evaluate reopens the control to answer it again.