What a Fractional CISO Actually Does

The title sounds straightforward. A fractional CISO is a Chief Information Security Officer who works with your organization part-time or on a contract basis. But the title obscures more than it reveals. What does the engagement actually look like? What does a fractional CISO own, and what do they hand off? How do you know if it is the right model for where your company is today?

This guide answers those questions directly, based on how GRC2 structures fractional CISO engagements and what we have seen work — and not work — across dozens of small and mid-sized companies.

The Core Mandate: Strategy, Not Operations

A fractional CISO is a strategic and advisory role. They are not a managed security service provider, a penetration tester, or a 24/7 SOC analyst. They do not replace your security operations team — they lead it, or help you build one.

The core mandate is translating business risk into a security program. That means understanding what your organization does, what data and systems matter most, what threats are relevant to your industry, and what controls are proportionate to your risk profile. It means building a roadmap that makes sense for your budget and your maturity level — not a copy of what a Fortune 500 company does.

What a Fractional CISO Owns

In a typical GRC2 fractional CISO engagement, the CISO owns or directly drives: security strategy and program roadmap; board and executive reporting; compliance program management (SOC 2, ISO 27001, HIPAA, CMMC, or whatever frameworks apply); incident response planning and tabletop exercises; vendor and third-party risk oversight; and security team mentorship and direction.

What they do not own: day-to-day security operations, ticket resolution, or infrastructure management. Those stay with your internal team or your managed service provider. The fractional CISO sets the direction and holds the program accountable — they do not run the help desk.

Engagement Structures

Fractional CISO engagements come in several shapes. The most common is an ongoing retainer — typically 10 to 20 hours per week — where the CISO provides continuous strategic leadership, attends key meetings, and drives the security program forward over time. This model works well for organizations that need sustained leadership but cannot justify a full-time hire.

A second model is project-based: a defined-scope engagement tied to a specific outcome, such as achieving SOC 2 Type II, preparing for a CMMC assessment, or rebuilding a security program after an incident. These engagements are more intensive and time-bounded, with a clear deliverable at the end.

A third model is interim CISO coverage — stepping in to fill a gap while a full-time hire is in progress. This is common after a CISO departure and ensures continuity of the security program during the transition.

The Signals That Indicate It Is the Right Model

The fractional model is the right fit when your organization needs executive-level security leadership but cannot yet justify the cost of a full-time CISO — typically $250,000 to $400,000 in total compensation. It is also the right fit when you have a specific compliance deadline driving urgency, when you have experienced a security incident and need experienced leadership to rebuild, or when you are preparing for M&A due diligence and need your security program to survive a buyer's scrutiny.

It is not the right fit when you need someone in the building every day, when your security program is mature enough to require full-time operational leadership, or when your regulatory environment requires a dedicated, named CISO on staff. Those situations call for a full-time hire.

What to Expect in the First 90 Days

In a well-structured fractional CISO engagement, the first 90 days follow a consistent pattern. The first 30 days are discovery: understanding the business, the technology environment, the existing security controls, the compliance obligations, and the risk profile. The output is an honest assessment of where the program stands today.

Days 30 to 60 are planning: building the security roadmap, prioritizing initiatives, and establishing the governance cadence — board reporting schedule, risk review frequency, policy review cycle. Days 60 to 90 are execution: beginning the highest-priority initiatives, establishing metrics, and building the reporting structures that will sustain the program.

By the end of 90 days, the organization should have a clear picture of its risk posture, a prioritized roadmap, and a governance structure that gives leadership visibility into the program. That foundation is what everything else is built on.