---
title: "Virtual CISO vs Fractional CISO: Is There a Difference?"
description: "Virtual CISO or fractional CISO? The labels overlap almost completely - the questions that actually separate a good service from a bad one, and what to ask."
canonical: https://www.isosecurity.co.uk/resources/virtual-ciso-vs-fractional-ciso
updated: 2026-11-10
---

# Virtual CISO vs fractional CISO: mostly the same job, two labels

Providers use both terms for part-time senior security leadership: 'virtual' stresses remote delivery, and 'fractional' stresses a defined share of an experienced person's time inside your organisation. What you are buying in either case is judgement, ownership and governance, so buy the person and the scope.

## What do the terms virtual CISO and fractional CISO mean?

|               | Virtual CISO (vCISO)                                                                                             | Fractional CISO                                     |
| ------------- | ---------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- |
| Emphasis      | Remote-first senior leadership on retainer                                                                       | A fixed fraction of time embedded on set days       |
| Typical shape | Defined outcomes: maintain the ISMS, reporting, audit readiness                                                  | Days per week or month inside the leadership rhythm |
| Common buyers | SMEs needing governance without headcount                                                                        | Scaling firms needing a seat at the table part-time |
| Core work     | The same: risk ownership, policy and evidence discipline, audit preparation, customer assurance, board reporting |                                                     |

Many proposals use both terms interchangeably. The underlying role is the same either way, and my guide to [what a virtual CISO does](/resources/what-is-a-virtual-ciso) describes it.

ISO Security uses "virtual CISO" and "CISO services", because delivery is largely remote and the fraction is agreed per client.

## Which questions separate a good offer from a bad one?

- **Who, exactly?** A named senior individual, or a rotating consultancy bench. Ask for the person and their audit-side experience.
- **What will they own?** "Advice" is cheap. Owning the risk register, the [management review](/resources/iso-27001-management-review) inputs and the audit calendar is the job.
- **What evidence exists each month?** Updated register, action tracker, board note. If nothing tangible accumulates, nothing is being maintained.
- **Where does it stop?** Operations, tooling and 24/7 response belong elsewhere; a credible provider says so. See [what the role does not replace](/virtual-ciso-services).
- **How does it end?** Knowledge should transfer into your documents and your people's habits over time.

## What does a virtual or fractional CISO cost?

Either label is normally a monthly retainer set by days, seniority and whether hands-on delivery is included. Expect from around £1,250 a month for maintaining an established system to £3,600 or more where the CISO leads the programme, against £140,000-plus in salary alone for a full-time appointment.

My [cost guide](/resources/iso-27001-cost-uk) compares this properly, alongside implementation and audit fees.

## Frequently asked questions about virtual and fractional CISOs

### What is the difference between a virtual CISO and a fractional CISO?

In practice, very little, and providers use the terms loosely: 'virtual' usually emphasises remote delivery of senior security leadership on a retainer, while 'fractional' emphasises a defined slice of a senior person's time inside your organisation on set days. Judge any offer on who the individual is, what they will own, and how evidence and reporting work.

### Which do we need, a vCISO or a full-time CISO?

If security decisions arise every day at board level, you operate in a heavily regulated environment, or you are building a security function with staff to lead, employ a full-time CISO. A fractional arrangement gives you a more experienced person than the same budget would hire for a few days a month, and many organisations keep that support for independent challenge even after they appoint.

## Contact

Call it either: what matters is who turns up. Arrange a readiness discussion: [contact ISO Security](/contact) or email info@isosecurity.co.uk.