What do the terms virtual CISO and fractional CISO mean?
| Virtual CISO (vCISO) | Fractional CISO | |
|---|---|---|
| Emphasis | Remote-first senior leadership on retainer | A fixed fraction of time embedded on set days |
| Typical shape | Defined outcomes: maintain the ISMS, reporting, audit readiness | Days per week or month inside the leadership rhythm |
| Common buyers | SMEs needing governance without headcount | Scaling firms needing a seat at the table part-time |
| Core work | The same: risk ownership, policy and evidence discipline, audit preparation, customer assurance, board reporting | |
Many proposals use both terms interchangeably. The underlying role is the same either way, and my guide to what a virtual CISO does describes it.
ISO Security uses "virtual CISO" and "CISO services", because delivery is largely remote and the fraction is agreed per client.
Which questions separate a good offer from a bad one?
- Who, exactly? A named senior individual, or a rotating consultancy bench. Ask for the person and their audit-side experience.
- What will they own? "Advice" is cheap. Owning the risk register, the management review inputs and the audit calendar is the job.
- What evidence exists each month? Updated register, action tracker, board note. If nothing tangible accumulates, nothing is being maintained.
- Where does it stop? Operations, tooling and 24/7 response belong elsewhere; a credible provider says so. See what the role does not replace.
- How does it end? Knowledge should transfer into your documents and your people's habits over time.
What does a virtual or fractional CISO cost?
Either label is normally a monthly retainer set by days, seniority and whether hands-on delivery is included. Expect from around £1,250 a month for maintaining an established system to £3,600 or more where the CISO leads the programme, against £140,000-plus in salary alone for a full-time appointment.
My cost guide compares this properly, alongside implementation and audit fees.