Are you making IT decisions alone, and hoping you got them right?
If you run a 20 to 200 staff business without an in-house IT manager, every technology decision eventually lands back on your desk. The Microsoft 365 renewal arrives without warning. A new SaaS tool appears on the credit card statement. Your insurer sends a four-page cyber questionnaire you cannot answer. A staff member asks whether they can start using ChatGPT at work. You need a strategy, not another quote.
Without someone owning your technology strategy, three things happen. Vendor costs creep. Cyber risk sits on one person’s shoulders. Growth decisions get made on gut feel. The business gets harder to run, harder to insure and harder to sell.
What does a virtual CIO actually do?
A virtual CIO gives you the strategic IT leadership of a Chief Information Officer without the salary, recruitment risk or delay of hiring one full-time. Your vCIO builds your technology roadmap, owns your cyber posture, manages your vendor stack, forecasts your IT budget and reports to your leadership team.
At OxygenIT, your vCIO delivers six specific outputs every year:
- A 12-month technology roadmap, refreshed quarterly.
- An annual IT budget forecast aligned to your financial year.
- A quarterly business review with your leadership team.
- A cyber posture assessment against the NCSC Critical Controls and NZISM.
- A Privacy Act 2020 breach readiness playbook and SMB1001:2026 pathway.
- A vendor and licence review across Microsoft 365, connectivity and security.
A vCIO is not a helpdesk, a salesperson, or a replacement for a full-time CIO at a 500-person firm. It is strategic IT leadership sized for an SMB.
When does a Christchurch or New Zealand SMB need a vCIO?
Most owners know the moment they need one. Here are the five clearest triggers:
- You have grown past 20 staff and technology decisions keep ending up on the owner’s desk.
- Your cyber insurer is asking questions you cannot answer with confidence.
- Vendor sprawl is eating your budget.You have inherited tools from three different eras and no one owns the stack.
- You are considering a big move (cloud migration, Microsoft 365, AI adoption, SMB1001 certification) and need a plan before you spend.
- You want the business to be sellable. You are aware that key-person risk on IT is a discount on your eventual valuation.
If two or more of these sound familiar, you need a vCIO.
How is a vCIO different from an IT manager, an MSP and a full-time CIO?
Most 20 to 200 staff NZ businesses do not need a full-time CIO. But they do need more than a helpdesk. The table below shows where a virtual CIO sits.
Business Process Automation Use Cases Powered by RPA
RPA turns slow, repetitive workflows into high‑velocity business engines. At OxygenIT, our automation specialists focus on measurable impact, such as quicker turnaround, cleaner data, and lower costs across everyday processes.
Wherever manual effort eats time, automation restores speed and precision.
|
Role |
Scope |
Cadence |
Cost signal |
Best fit for |
|
Break-fix IT |
Reactive only |
When things break |
Ad-hoc invoices |
Under 10 staff |
|
Managed IT (MSP) |
Operational delivery |
Daily support |
Monthly per-user fee |
10 to 200 staff |
|
Virtual CIO |
Strategy and governance |
Quarterly with monthly touchpoints |
Monthly retainer |
20 to 200 staff, no in-house IT manager |
|
Full-time IT manager |
Internal operations |
Daily, in-house |
Salary plus overhead |
100 plus staff with complex systems |
|
Full-time CIO |
Enterprise strategy |
Daily, in-house |
Senior executive salary |
500 plus staff |
A vCIO sits above your managed IT service and below a full-time executive. For most 20 to 200 staff NZ businesses, that is exactly the right altitude.
What is included in OxygenIT’s vCIO service?
We call it the Oxygen vCIO Cycle. It delivers six named outputs, packaged into a predictable quarterly rhythm.
12-month technology roadmap
A prioritised list of technology initiatives for the next four quarters, mapped to business outcomes, cost and risk. Refreshed every quarter so it never goes stale.
Annual IT budget forecast
A full-year view of operating and capital IT spend, aligned to your financial year, broken down by service, vendor and project. No more surprise renewals.
Quarterly business review
A 90-minute session with your leadership team each quarter. We present roadmap progress, budget variance, cyber posture and upcoming decisions. You leave with clear next actions.
Cyber posture assessment
An assessment of your current security posture against the defined standards like SMB1001 with a prioritised remediation plan and executive-ready reporting.
Privacy Act 2020 breach readiness playbook
A documented response plan for a notifiable privacy breach, matched to your industry and customer base. Tested annually* (external additional cost).
Vendor and licence review
A full audit of your Microsoft 365 licensing, connectivity contracts, security tools and SaaS subscriptions. We find the waste and the gaps.
How the Oxygen vCIO Cycle works: your first 30, 60 and 90 days
First 30 days: discovery and risk baseline
Systems inventory. Stakeholder interviews. Current-state snapshot. Risk register. You get a clear picture of what you actually have and where the exposure sits.
Days 30 to 60: roadmap, budget and quick wins
Draft roadmap. Draft 12-month budget. A quick-win remediation list so you see value inside the first quarter. We present a draft to your leadership team.
Days 60 to 90: board-ready sign-off and cadence
Final roadmap and budget signed off. Quarterly cadence locked in. Any Managed IT integration decisions made. From day 91 onwards, you have a predictable leadership rhythm.
Why Christchurch businesses choose OxygenIT for vCIO
20 years on the ground in Canterbury
Founded in Christchurch in 2005. Our Horner Street team knows the local sector mix, the local talent pool and the local cost pressures. We are not a remote agency.
Certified where it matters
Independently certified to ISO 27001 for information security and ISO 42001 for AI management. SMB1001:2026 assessor capability. We apply the same standards internally that we advise on externally.
Right-sized for 20 to 200 staff firms
Big enough to back you with a 20-person team across strategy, engineering, security and projects. Small enough that you will know the people working on your business by name.
A named vCIO, not a rotating account manager
Your vCIO is a named individual with accountability for your roadmap, your risk register and your quarterly reviews. Continuity over churn.
Vendor neutral, with an upgrade path
You can start with vCIO advisory only. Graduate to our Managed IT service when (and if) it makes sense. We never push the upgrade.
How much does a virtual CIO cost in New Zealand?
A virtual CIO in New Zealand is typically delivered as a monthly retainer that scales with the size and complexity of the business. At OxygenIT we offer three tiers, sized for 20 to 200 staff firms. We do not publish hourly rates because every engagement is scoped to outcomes, not hours.
Oxygen vCIO Essential
For 20 to 50 staff firms. Annual roadmap and budget and cyber posture baseline. Priced from a one off fee.
Oxygen vCIO Advisory
For 50 to 100 staff firms. Monthly leadership touchpoint, quarterly roadmap refresh, active vendor management, SMB1001:2026 certification pathway. Part of selected agreements.
Oxygen vCIO Partner
For 100 to 200 staff firms or regulated industries. Embedded vCIO, fortnightly cadence, full compliance and AI governance oversight. Priced from a monthly retainer.
Frequently asked questions about virtual CIO services
01. What is a virtual CIO?
A virtual CIO (vCIO) is an outsourced senior IT leader who sets your technology strategy, owns your cyber risk posture, builds your IT roadmap and reports to your leadership team. A vCIO delivers the strategic value of a Chief Information Officer without the salary or recruitment delay of hiring one full-time. It is the right level of IT leadership for 20 to 200 staff NZ businesses without an in-house CIO.
02. Do I need a virtual CIO?
You likely need a virtual CIO if you have grown past 20 staff, have no in-house IT manager (or have one who is stretched), are facing cyber insurance questions you cannot confidently answer, are considering a major cloud or AI move, or want to reduce owner dependency and make the business easier to sell. Most Canterbury SMBs reach this point between 20 and 50 staff.
03. What is the difference between a vCIO and an MSP?
An MSP (managed IT services provider) delivers day-to-day IT operations: helpdesk, patching, backups, monitoring. A vCIO sits above those operations and owns strategy: roadmap, budget, risk, vendor management, governance. At OxygenIT you can engage the vCIO service on its own or alongside our managed IT service.
04. What is the difference between a vCIO and an IT manager?
An in-house IT manager typically runs internal operations day-to-day. A vCIO focuses on strategy, governance and leadership-level decisions, usually one or two days per month rather than five days a week. For most 20 to 100 staff NZ firms a vCIO is the right leadership layer. A full-time IT manager becomes cost-effective around 100 plus staff with complex systems.
05. How much does a virtual CIO cost in New Zealand?
Virtual CIO services in NZ are typically delivered as a monthly retainer that scales with the size and complexity of the business. OxygenIT offers three packages (Essential, Advisory, Partner) sized for 20 to 200 staff firms. We do not quote hourly rates because every engagement is scoped to outcomes. Ask for indicative monthly pricing for your business size, industry and compliance requirements.
06. How often will I meet with my vCIO?
At a minimum, once per quarter for a 90-minute business review with your leadership team. Most clients also have a monthly touchpoint for roadmap progress and emerging decisions. Higher-tier engagements include fortnightly cadence for regulated or high-growth firms.
07. Can a vCIO help with Privacy Act 2020 and SMB1001:2026 compliance?
Yes. Both are core to the OxygenIT vCIO service. We build a Privacy Act 2020 breach readiness playbook in the first quarter and maintain it annually. For SMB1001:2026 we deliver a full certification pathway from Bronze through Diamond, matched to your cyber insurance and customer contract requirements.
08. Can a vCIO help with AI adoption and ISO 42001 governance?
Yes. OxygenIT is independently certified to ISO 42001, the international standard for AI management. Your vCIO will assess your AI readiness, build a governance framework for tools like Microsoft 365 Copilot, manage shadow AI risk and align your adoption with ISO 42001 controls. You get the productivity upside without carrying the governance risk.
09. Can we start with vCIO only and add Managed IT later?
Yes. Many of our clients start with vCIO advisory only, keep their existing IT arrangement, and only graduate to our full managed IT service if and when it makes commercial sense. There is no pressure and no bundling. You get independent strategic advice either way.
10. Do you only serve Christchurch, or all of New Zealand?
OxygenIT is based in Christchurch but serves clients across New Zealand. Discovery, quarterly reviews and roadmap work are delivered in person where practical and online where efficient. Our Canterbury presence matters because it puts a local team behind you, not because it limits who we work with.
