vCISO additional revenue: refer clients, keep security decisions with them

Why a vCISO sees fit before anyone else

A vCISO already holds the map most companies lack: which systems store which records, how long each record class is kept, who owns it and how it is classified. That knowledge makes you well placed to spot clients whose operating history may interest AI developers, and to introduce the owner to SourceX, which handles every step of a license from rights review through payment.

The work you do every month surfaces it. Data inventories built for a risk assessment, classification schemes, retention schedules, asset registers, vendor risk reviews and decommissioning approvals all tell you whether a company has years of connected records or a thin, fragmented estate. The catch is your role. Clients trust you to reduce data risk, so any referral has to leave every security and privacy decision exactly where it belongs: with the company.

The three-lane rule: who decides what

Keep three lanes separate and say so out loud when you make the introduction.

The fourth row is where conflicts arise. If the client asks you to review the security of a delivery while you stand to earn a referral reward, disclose that interest in writing and let the client decide whether a separate reviewer is needed.

Which clients in a vCISO book fit

If you also act as a client's Qualified Individual under the FTC Safeguards Rule, take extra care. The rule (16 CFR Part 314) requires covered financial institutions to maintain a written information security program with a designated Qualified Individual. Customer information at those clients is regulated and would need counsel's review before anything else happens; operational records about the business may still be worth assessing.

The 4C check before you raise it

Answer these from what you already know, without asking the client for anything new.

• Created: did the company produce these records about its own operations?
• Classified: are personal, financial and health data identified well enough to be scoped out or de-identified?
• Contracted: do customer contracts, employee notices and privacy policies leave room for licensing?
• Capable: can someone at the company still export complete history from current and archived systems?

Pair the 4C check with the baseline: a US company, 50+ full-time employees at peak, several years of documented operations and a sponsor with signing authority, such as the owner, CEO or CFO. The company fit checker offers a quick preliminary screen that is non-binding and asks for no contact details, and who qualifies lists the full criteria.

Check the privacy promises first

Before any client gets excited, someone should read what it has already promised. FTC staff have stated (January 2024) that companies' promises not to use customer data for undisclosed purposes, such as training or updating models, are enforceable whether made in privacy policies, terms of service or promotional materials. That is staff guidance, not a rule, but it is a good reason to suggest the client's counsel reviews existing commitments before customer data is considered for any license.

This is general information, not legal, tax or financial advice. Confirm with your own counsel before acting.

When to raise it in the vCISO calendar

How the introduction works

1. Mention the idea to the CEO or owner and confirm they want to explore it.
2. Sign up as a partner, then pass your referral link to the CEO or enter the company in the referral form, limiting yourself to basic fit details.
3. When the company applies through that link, your referral code is attached to its application.
4. SourceX talks to the sponsor about headcount, years of operation, the spread of record-holding systems and who owns the data.
5. The company completes a data inventory and agrees de-identification and redaction requirements before any work begins.
6. SourceX and the company agree price and terms; AI labs and data buyers review; nothing binds the company until it signs.
7. Delivery waits for two things, a signed agreement and the company's go-ahead; payment to the company follows.

At no step do you export records, share your data map or describe the client's systems to SourceX.

What to say to the CEO

How rewards work for vCISOs

Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company. The reward becomes payable only after the buyer pays and SourceX receives its fee; an introduction, meeting or signed agreement alone does not trigger payment, and no reward is guaranteed.

Your client's payment is unaffected, since the reward is carved from SourceX's fee. It suits vCISOs as occasional, event-driven income rather than a retainer line. If you work inside an MSP or MSSP, the guide to additional revenue streams for MSPs shows where introductions fit next to managed services, and fractional technology leaders can use the vCIO and fractional CIO page. Compliance advisers who run SOC 2 or ISO programs have their own page, with extra independence checks.

When not to raise it

• Headcount at peak was below the baseline of 50+ full-time employees (contractors excluded).
• Most records are consumer personal data, protected health information or regulated customer financial data.
• The company holds the data on behalf of its own customers.
• Archives were destroyed under policy, or nobody can export them.
• Someone already licensed the same records for AI training.
• Leadership would not consider an exclusive license for an agreed term.

Next step

At your next risk assessment, run the 4C check on one client with deep retention. If it passes, register as a partner and give the CEO your link to sourcex.si/apply.