If you run a small business, I’ve got some news for you.
You may already have an IT Support Manager, CIO, IT Director and CISO.
Unfortunately, they’re probably all you! 
You just haven’t put the job titles on your email signature.
One minute you’re asking why somebody can’t print.
The next you’re deciding whether to renew Microsoft 365 licences.
Then you’re looking at a quote for a new phone system.
Someone asks whether the business should be using AI.
Your cyber insurer wants to know whether you have MFA, tested backups and endpoint protection, and before you’ve finished answering that, someone wants approval for a new CRM.
Congratulations – you appear to have joined the IT department.
The problem isn’t necessarily that small businesses don’t have people doing these jobs.
It’s that the jobs often become mixed together and that’s where terms such as IT support, MSP, MSSP, Fractional IT Director, vCISO and CIO start becoming confusing.
So let’s untangle them.
First: you probably don’t need six different companies
This isn’t a guide designed to convince you that your ten-person business needs an entire C-suite of outsourced technology people.
Quite the opposite – Some of these roles overlap.
One company may provide several of them, and in a small organisation, one experienced person may wear more than one hat.
The important thing is understanding which job needs doing.
Because fixing today’s IT problem and deciding where your technology should be in three years are not the same job.
Neither is monitoring a cyber security alert at 2:13am and deciding what level of cyber risk the business should accept.
Here’s the simple version.
| Role | Main question |
|---|---|
| IT Support | How do we fix this IT problem? |
| MSP | How do we keep our IT systems running and managed? |
| MSSP | How do we monitor and manage our cyber security? |
| Fractional IT Director | Are we making the right technology decisions? |
| vCISO | Are we managing cyber risk properly? |
| CIO | Is our technology strategy helping deliver the business strategy? |
There is overlap, but those questions are very different.
What does IT Support do?
IT support is usually closest to the day-to-day user.
Laptop won’t start.
Outlook isn’t behaving.
Someone needs access to a folder.
The printer has apparently entered into a personal dispute with Accounts.
A new employee needs setting up.
Someone has forgotten their password (again).
IT support is about keeping people productive and solving technical problems.
For many small businesses, good IT support is essential.
But good IT support doesn’t automatically mean someone is looking after your wider IT strategy.
That’s an important distinction.
You can have excellent people fixing today’s problems while nobody is asking what problems the business is likely to face next year.
What is an MSP?
MSP stands for Managed Service Provider.
An MSP normally takes responsibility for managing some or all of your IT environment on an ongoing basis.
That could include:
user support
computers and servers
Microsoft 365
networks
patching
backups
monitoring
licensing
connectivity
device management
IT projects
The exact service varies enormously between providers.
Some MSPs provide little more than outsourced helpdesk support.
Others effectively operate as the customer’s entire IT department.
That’s why the letters MSP alone don’t tell you very much.
The important questions are:
What are they actually responsible for?
What aren’t they responsible for?
And:
Who is checking that what they’re doing still matches what the business needs?
That last question becomes important as a company grows.
What is an MSSP?
MSSP stands for Managed Security Service Provider.
Think of this as the cyber security specialist.
Rather than managing all of your IT, an MSSP focuses on security.
Depending on the service, that might include:
endpoint detection and response
managed detection and response
security monitoring
threat detection
email security
identity monitoring
vulnerability management
security incident support
SIEM
SOC services
cyber security tooling
An MSSP may be watching for suspicious activity while everyone else is asleep.
That’s very different from somebody helping Janet in Finance reconnect her second monitor.
Some MSPs also provide managed security services.
Some partner with specialist MSSPs.
Again, the label matters less than understanding who is doing what.
An MSSP isn’t necessarily your vCISO
This is another important distinction.
Your security provider may be excellent at detecting threats.
That doesn’t automatically mean they’re responsible for deciding:
what cyber risks the business should prioritise
how much risk is acceptable
whether your cyber insurance controls are adequate
what should be reported to the board
what your cyber security roadmap should look like
how standards such as Cyber Essentials fit into the wider business
whether your incident response plans are good enough
That moves us from security operations into security leadership.
And that’s where the vCISO comes in.
What is a vCISO?
vCISO means Virtual Chief Information Security Officer.
A vCISO provides senior cyber security leadership without the organisation employing a full-time CISO.
The role isn’t primarily about sitting watching security alerts.
It’s about making sure somebody is taking responsibility for the bigger cyber risk picture.
A vCISO might help with:
cyber security strategy
risk management
security policies
Cyber Essentials
cyber insurance requirements
incident response planning
business continuity
supplier risk
security investment
board or management reporting
compliance
security roadmaps
reviewing whether existing controls are proportionate
Put simply:
An MSSP helps operate your security.
A vCISO helps decide what your security should achieve.
You may need both. You may not.
For a small business, the answer should be proportionate to the actual risk.
What is a Fractional IT Director?
Now we’re moving beyond cyber security.
A Fractional IT Director, sometimes called a Virtual IT Director, provides senior IT leadership without becoming a full-time employee.
This is the person looking across the whole technology picture.
Not just:
“Is the server working?”
But:
“Do we still need the server?”
Not just:
“The Microsoft renewal is due.”
But:
“Are we paying for the right Microsoft licences?”
Not just:
“We’ve had a quote from our IT supplier.”
But:
“Does this proposal actually solve the problem we’re trying to fix?”
A Fractional IT Director may get involved with:
IT strategy
technology roadmaps
supplier management
IT budgets
hardware replacement planning
Microsoft 365
cloud strategy
major projects
procurement
connectivity
business continuity
AI adoption
software selection
IT policies
cyber security oversight
One of the biggest benefits can be having someone sitting on your side of the table.
Your IT provider may be excellent.
Your broadband provider may be excellent.
Your software supplier may be excellent.
Your cyber security company may be excellent.
But each naturally sees the world through the part they provide.
Someone still needs to look across everything.
So what’s the difference between a Fractional IT Director and a vCISO?
There’s definitely crossover.
But the simplest distinction is:
Fractional IT Director = wider technology leadership.
vCISO = cyber security and risk leadership.
For example, you’re considering replacing an ageing server.
The Fractional IT Director might ask:
Do we need another server?
Would cloud be more appropriate?
What applications depend on it?
What’s the budget?
What does the business expect to look like in three years?
Which suppliers should be involved?
How do we migrate with minimal disruption?
The vCISO might ask:
What sensitive information is held there?
Who can access it?
How is it backed up?
Is the replacement appropriately secured?
Does it affect our cyber insurance position?
What happens if it’s compromised?
Are recovery plans tested?
Same project. Different lens.
For many SMEs, one experienced person may be able to provide both perspectives.
That’s why the job title is less important than making sure the questions are actually being asked.
And what does a CIO do?
CIO means Chief Information Officer.
This is usually the most senior role we’re discussing.
In a larger organisation, the CIO connects technology with the strategy of the organisation itself.
The conversation isn’t just:
“What laptops should we buy?”
It is:
“Where is this business going and what technology, information, people and investment will help us get there?”
A CIO may be involved in:
business strategy
technology strategy
transformation
budgets and investment
data
AI
major programmes
organisational change
governance
technology teams
suppliers
resilience
executive decision-making
The modern CIO role is increasingly commercial.
Technology now affects almost everything a company does: sales, finance, customer experience, communication, operations, resilience and increasingly AI.
For a large organisation, a full-time CIO makes perfect sense.
For a twelve-person engineering company in Chesterfield? Probably not.
But that doesn’t mean the CIO questions disappear.
Someone still needs to ask them.
The small business owner wearing six hats
Imagine a small business with 15 employees.
We’ll call the owner Debbie.
Debbie has an outsourced IT company, so, thankfully, she’s not fixing laptops. Mostly.
But let’s look at her week.
Monday
The Operations Manager can’t access a shared folder.
The IT support team fixes it.
IT Support hat: covered.
Tuesday
The business receives its Microsoft 365 renewal and a recommendation to replace several laptops.
The MSP explains what it recommends.
Debbie needs to decide whether to approve it.
Suddenly she’s wearing the IT Director hat.
Wednesday
Security software detects suspicious activity on an employee’s computer.
The managed security provider investigates it.
MSSP hat: covered.
But then somebody asks:
“Do we need to tell our insurer?”
And:
“Could they have accessed customer information?”
And:
“Should we change anything as a result?”
Debbie has unexpectedly acquired the CISO hat.
Thursday
A supplier demonstrates an AI system that could save the business several hours a week.
Is it secure?
Can employees put customer information into it?
Does it integrate with existing systems?
Will it genuinely save money?
Who owns the data?
Debbie is now somewhere between IT Director, CIO and CISO.
Friday
The broadband contract is due for renewal.
The CRM is becoming too restrictive.
Two old servers need replacing.
Employees want better remote working.
The cyber insurer has sent a security questionnaire and Microsoft Copilot has appeared on somebody’s expenses.
Debbie was hoping to spend Friday winning some new business.
Instead, she’s become Chief Information Officer.
Without the salary.
That’s the real problem
Small businesses don’t usually wake up one morning and announce:
“Today, we’re appointing Kevin as our Chief Information Officer.”
The responsibilities creep in.
Technology becomes more important.
More suppliers appear.
More subscriptions arrive.
More data gets stored.
Cyber security becomes more complicated.
AI introduces another set of questions.
But nobody formally takes ownership.
So the Managing Director, Finance Director, Operations Manager or Office Manager gradually becomes responsible for IT strategy by default.
That’s not necessarily a disaster.
Plenty of business owners make very sensible technology decisions.
The question is whether that’s really where their time is best spent and whether they have enough independent information to challenge the advice they’re receiving.
“But we’ve already got an IT company”
Good.
A Fractional IT Director shouldn’t automatically mean replacing them.
In fact, having a capable MSP can make the arrangement work better.
Your MSP can concentrate on delivering the technical service.
Your Fractional IT Director can concentrate on questions such as:
Where are we going?
What should we prioritise?
What needs replacing?
Which proposals make sense?
Where are we duplicating services?
What risks aren’t being addressed?
Are suppliers doing what we need them to do?
What should we budget for next year?
They’re different jobs.
It’s a bit like having an accountant and a Finance Director.
Both work with the finances.
They don’t necessarily do the same thing.
“But our MSP does strategy meetings”
It might.
Some MSPs provide excellent strategic account management or virtual CIO services.
If yours does, use it.
Ask what is included.
Ask who provides the advice.
Ask how often you meet.
Ask whether they look beyond the products and services their company provides.
And ask yourself a simple question:
Do I feel somebody is genuinely taking ownership of our technology direction?
If the answer is yes, you may already have what you need.
You don’t need another consultant simply because somebody invented another acronym.
Which one does my business need?
Start with the problem rather than the job title.
You probably need IT support if…
People regularly need help using or fixing technology.
You may need an MSP if…
You want an external company to take ongoing responsibility for managing your IT environment rather than simply responding when things break.
You may need an MSSP if…
You need specialist security monitoring, detection and response that goes beyond ordinary IT management.
You may need a Fractional IT Director if…
You have IT support and several technology suppliers, but nobody internally owns the wider IT strategy, roadmap, budgets and supplier relationships.
You may need a vCISO if…
Cyber security has become a management issue rather than just a technical one — perhaps because of customer requirements, cyber insurance, compliance, growth or increased risk.
You may need a CIO if…
Technology is central enough to the organisation that it needs permanent executive-level ownership.
And you might need a mixture.
There is no universal org chart for an SME.
The question isn’t “Which acronym do I need?”
It’s:
Who’s doing the job?
Who fixes today’s problems?
Who manages the systems?
Who watches for cyber threats?
Who manages cyber risk?
Who challenges suppliers?
Who decides what gets replaced?
Who creates the technology roadmap?
Who decides where AI fits?
Who looks at the budget?
Who asks whether all this technology is actually helping the business?
If you’ve got good answers to those questions, the job titles matter far less.
If most of the answers are:
“Erm… me.”
Then you may have found the problem.
You don’t necessarily need another IT supplier
Sometimes you just need someone to look at the bigger picture.
At Black Swan Cyber Security Solutions, we can work alongside existing IT providers, MSPs and other technology suppliers rather than automatically replacing them.
Our Fractional IT Director / Virtual IT Director service provides wider technology leadership around strategy, suppliers, projects, budgets, resilience and future planning.
Our vCISO service provides more focused leadership around cyber security, risk, governance, compliance and incident readiness.
For smaller organisations where separating the two makes little sense, those conversations can be joined up.
Because your business probably doesn’t need six people with six impressive job titles.
It just needs to make sure the six jobs aren’t all quietly sitting on the owner’s desk.
