The title sounds impressive. Fractional Chief Information Security Officer. But most founders and CEOs who are considering hiring one have the same question: what does this person actually do, day to day, week to week?
It's a fair question. The CISO title gets thrown around loosely in the industry, and "fractional" makes it even more ambiguous. Some fractional CISOs show up once a month and send a report. Some are deeply embedded in the business. The range is enormous, and the value you get depends entirely on what the engagement actually includes.
Here's what it should include.
The core responsibilities
Security strategy and program ownership. The fractional CISO owns your security program. Not advises on it. Not reviews it. Owns it. They define the strategy, build the roadmap, and drive execution week by week. If something isn't getting done, it's their responsibility to flag it, escalate it, or fix it.
This is the fundamental difference between a fractional CISO and a security consultant. The consultant gives you recommendations. The fractional CISO gives you results.
Compliance management. SOC 2, HIPAA, HITRUST, ISO 27001, ISO 42001. Whatever framework your customers require, the fractional CISO manages the program. That includes: setting up and maintaining the GRC platform, mapping controls to framework requirements, collecting and monitoring evidence, writing and updating policies, coordinating with auditors, preparing for and managing audits, and tracking remediation of any findings.
For most companies in our client base, compliance management consumes 30 to 40% of the fractional CISO's time. It's ongoing, not seasonal. The companies that treat compliance as a continuous operation have clean audits. The ones that sprint before audit season don't.
Risk management. Identifying, assessing, and treating risks. Maintaining the risk register. Conducting annual risk assessments. Advising leadership on risk acceptance decisions. Reviewing the risk posture when the business changes (new markets, new products, new vendors, acquisitions).
Risk management isn't a document exercise. A good fractional CISO connects risks to business outcomes. "If this vendor gets breached, we're required to notify 15,000 patients within 60 days and our cyber insurance deductible is $50,000" is a risk statement that drives decisions. "Medium risk, moderate impact" is not.
Security questionnaire response. Enterprise customers send security questionnaires. A lot of them. A fractional CISO maintains a response library built from your actual controls and can turn around a 200-question questionnaire in days, not weeks.
This is one of the most immediately valuable things a fractional CISO does. Every questionnaire that gets answered quickly and competently accelerates a deal. Every one that sits unanswered for 3 weeks slows one down.
Vendor risk management. Evaluating the security posture of your third-party vendors before onboarding. Reviewing vendor SOC 2 reports. Ensuring BAAs and DPAs are in place. Maintaining the vendor register. Conducting annual vendor reviews. Managing vendor incidents.
Your company's risk isn't limited to your own environment. Every vendor that touches your data is part of your risk surface. The fractional CISO keeps that surface managed.
Incident response. When something goes wrong, the fractional CISO is the first call. They coordinate containment, work with forensics, manage the cyber insurance claim, handle regulatory notifications if required, and communicate with affected parties.
Between incidents, they maintain the incident response plan, run tabletop exercises, and make sure the team knows what to do before they need to do it.
Access management oversight. Ensuring that access to systems is granted, reviewed, and revoked consistently. Overseeing quarterly access reviews. Making sure the offboarding process works. Reviewing privileged access. Identifying orphaned accounts and excessive permissions.
This is where most SOC 2 exceptions come from, and it's where a fractional CISO's operational discipline shows up most clearly.
Security tool oversight. Overseeing your EDR, MDM, email security, SIEM or logging, cloud security, and vulnerability management tools. Not necessarily configuring them (that might be your MSP or IT team), but ensuring they're properly tuned, monitored, and producing value. When alerts fire, someone needs to be responsible for triage and response. The fractional CISO ensures that happens.
Security awareness training. Managing the training program, selecting content, running phishing simulations, and tracking completion. Ensuring new hires are trained within 30 days. Updating training content when policies or tools change.
Board and investor reporting. Translating security posture into business language for leadership, the board, or investors. A one-page quarterly summary covering compliance status, key risks, incident summary, program progress, and investment needs.
A CEO who can confidently answer security questions during an investor meeting signals operational maturity. The fractional CISO gives them the material to do it.
Pen test coordination. Scoping, procuring, and coordinating annual penetration tests. Reviewing findings. Managing remediation. Verifying fixes. Integrating results into the risk assessment and compliance evidence.
AI governance. In 2026, this is no longer optional. Inventorying AI tools in use across the organization. Defining acceptable use policies for AI. Evaluating AI vendor security posture. Ensuring human oversight for AI-generated outputs. Monitoring for unapproved AI tool usage. Advising on AI-specific compliance requirements (EU AI Act, AIUC-1, ISO 42001).
What a week looks like
For a typical engagement (20 to 100 employee company, one or two compliance frameworks, 10 to 20 hours per week), here's a representative week:
Monday: Review GRC platform for failing monitors and overdue tasks. Triage any new findings. Check security tool alerts from the weekend. Update ticket tracking.
Tuesday: Weekly sync with the client's internal team. Review progress on the roadmap. Discuss any blockers or new requirements. Address open items from the previous week.
Wednesday: Respond to a customer security questionnaire. Review a vendor's SOC 2 report for a new tool the engineering team wants to adopt. Draft a vendor risk assessment.
Thursday: Prepare evidence for an upcoming audit. Update two policies that need annual review. Follow up on a pen test remediation item that's past due.
Friday: Review access review results from the quarter. Coordinate with the MDM provider on a new device enrollment policy. Update the board security summary for next week's meeting.
That's a real week. Not theoretical. That's what the engagement looks like when it's working.
The difference between good and bad
A good fractional CISO is proactive. They don't wait for you to ask. They identify gaps before they become problems, flag risks before they become incidents, and drive the program forward without being pushed.
A bad fractional CISO is reactive. They show up for monthly calls, answer questions when asked, and produce reports that nobody reads. The program doesn't move between meetings because nobody is driving it.
The test: if your fractional CISO disappeared for a month, would your security program keep running? If yes, they've built something sustainable. If no, they're a single point of failure. If nobody would notice they were gone, they're not doing enough.
What it costs
$3,000 to $8,000 per month for most engagements. The range depends on the company's size, complexity, number of frameworks, and how much of the operational work falls to the fractional CISO versus an internal team or MSP.
Compare that to a full-time CISO at $250,000 to $350,000+ in total compensation. For a company with 20 to 100 employees, the fractional model is 75 to 85% cheaper and provides the same strategic and operational leadership.
The fractional CISO also brings something a full-time hire often can't: breadth of experience across dozens of environments, industries, and company stages. They've seen the patterns. They know what works at your size. They're not learning on your dime.
When to transition to full-time
The fractional model works until it doesn't. The inflection point is usually when the company reaches 150 to 200 employees, has multiple compliance frameworks, handles highly regulated data at scale, or has security operations complex enough to require full-time dedicated leadership.
When that happens, the fractional CISO has already built the program, defined the role, and created the operating model that the full-time hire steps into. The transition is smooth because the foundation exists.
The bottom line
A fractional CISO owns your security program. Strategy, compliance, risk management, questionnaire response, vendor oversight, incident response, training, tool management, and leadership reporting. All of it. Week to week, not month to month.
If your current security leadership consists of "the CTO handles it when it comes up," you don't have security leadership. You have a gap. A fractional CISO fills it at a fraction of the cost of a full-time hire, with the experience of someone who's done this across dozens of companies.
Farbod Fakhrai is the founder of Com-Sec, a cybersecurity and compliance consulting firm supporting startups and growth-stage companies. com-sec.com