Fractional CISO: a security lead without a full-time hire
Accountability sits with management. We carry the file with them.
An SME or mid-cap needs a chief information security officer, but rarely needs a full-time role. A fractional CISO provides that function on a monthly rhythm, with a continuity that one-off missions cannot offer.
Security has become a matter for management. Article 20 of the NIS2 Directive makes management bodies accountable for approving security measures and overseeing them, and requires them to undergo training. The fractional CISO runs the file day to day and reports to management, which retains the decision.
In practice, the CISO maintains the risk register, tracks action plans, arbitrates priorities with IT and answers your customers' security questionnaires. They become the named point of contact for auditors, insurers and authorities.
What you get
- Up-to-date risk register and prioritised action plan
- Monthly security committee, with written minutes
- Periodic summary for the board or executive management
- Training for executives under Article 20 of NIS2
- Responses to customer security questionnaires and audit preparation
How it runs
Taking up the role
Review of the existing set-up, meetings with key contacts, and setup of the risk register and committee calendar.
Monthly management
Security committee, follow-up of action plans, trade-offs with IT and business teams. Decisions are recorded.
Reporting to management
A readable summary for executives: risk level, progress, decisions required. Accountability stays where the law places it.
Adjustment
The level of involvement is reviewed at regular intervals as the stakes evolve, upwards or downwards.
Frequently asked
How much of the CISO's time do we get?
The volume is set at scoping based on your size, exposure and obligations. It is written into the monthly commitment and can be adjusted later without a full renegotiation.
Does a fractional CISO replace our IT team?
No. The CISO steers security and sets priorities; operations stay with your team or your managed service provider. Part of the role is also to relieve them of compliance matters.
Can the CISO respond to authorities in case of an incident?
They prepare and coordinate exchanges, including the notifications required by Article 23 of NIS2. Signature and responsibility remain with your organisation.
In the same practice area : Security
- Posture assessment
Where you stand, and what is missing.
- Compliance programme
Measures deployed, documented, provable.
- Security tooling integration
A tool installed is not a tool in service.
- Penetration testing
Find the flaws before those who are looking for them.
- Preparation for ISO/IEC 27001 certification
From gap analysis to the certification audit.
- Awareness training and phishing simulations
The first attack vector is still people. They can be trained.
- Incident response retainer
When an incident happens, you know who to call.
Let us talk about your context.
Thirty minutes to qualify the need. The written scope follows within fourteen working days.
Request a call