A fractional CISO, often sold as a virtual CISO or vCISO, is a senior security leader who owns a company’s information security program for 2 to 4 days a month. The role is shared across several clients and paid by retainer. It is sometimes called a part-time CISO. An interim CISO is a full-time leader placed for a few months, usually after a departure or a breach.
The typical buyer is a growing company that has started selling to larger customers and discovered that its security has to be proven on paper.
What a fractional CISO owns
At a $1M to $100M company, the role has six parts.
Risk assessment. A list of what could go wrong, how likely it is and what it would cost, used to decide where to spend.
Policies. The written security program: access control, acceptable use, data classification, vendor management, change management, business continuity. Auditors and customers ask for these first.
Compliance frameworks. Getting the company ready for the framework its customers or regulators require. SOC 2 is the common ask from US enterprise buyers. ISO 27001 is more common in Europe and with international customers. HIPAA applies to health data in the US, PCI DSS to card payments, CMMC to US defense contractors, and ISO 42001 to AI management systems. The CISO picks the framework, runs the gap assessment and manages the path to the audit.
Incident response. A written plan for what happens when something goes wrong: who is called, who decides, who talks to customers and regulators. A good fractional CISO also runs a tabletop exercise so the plan has been tested before it is needed.
Vendor risk. Reviewing the security of the software and service providers that hold your data.
Customer assurance. Answering security questionnaires, joining calls with customers’ security teams and maintaining a trust page or security documentation.
What it does not cover
A fractional CISO is a leadership role. Running firewalls, monitoring alerts and patching systems usually sits with an IT provider, a managed security provider or internal engineers. Many vCISO firms pair the senior CISO with an analyst who collects evidence and maintains documentation.
Hours and fees
Most engagements run 2 to 4 days a month, more during an audit or after an incident. vCISO firms rarely publish prices. Typical retainers run $4,000 to $15,000 a month, with auditor fees and compliance software on top. The cost guide covers the details.
When to hire one
The trigger is usually external. An enterprise customer sends a 200-question security questionnaire or asks for a SOC 2 report, and the deal stalls. A cyber insurance renewal asks questions the company cannot answer. The company starts handling health, payment or government data. A board or investor asks about security. Or an incident has happened.
Who it is not for
A company with a handful of employees and no sensitive customer data usually needs good IT hygiene and a managed IT provider more than a security leader. A large company with a security team of five or more needs a full-time CISO. And a company that needs someone to configure tools needs a security engineer.
What to check
Ask which frameworks the candidate has taken companies through, how many audits passed on the first attempt, and who on their team does the evidence work.