Senior security leadership, sized to your company
Start with a fixed-fee assessment, stay for a month-to-month retainer, or bring us in for a single project. Every engagement is led by a certified CISO, not handed to a junior analyst.
What’s included
1 · Risk Assessment & Roadmap
We measure where you stand against CIS Controls and the NIST Cybersecurity Framework, in plain language, then hand you a prioritized, budget-aware plan.
- Executive interviews and technical review
- Risk register ranked by business impact
- 12-month roadmap with cost ranges
- Board-ready summary you can share
2 · Compliance & Audit Readiness
We get you ready for the frameworks your customers, regulators, and insurers expect, and we stay with you through the audit.
- SOC 2 Type I & II · ISO 27001 · ISO 42001 (AI)
- HIPAA Security Rule · CMMC / NIST 800-171
- PCI DSS · NIST CSF · GDPR
- Cyber-insurance applications and questionnaires
3 · Third-Party & Vendor Risk
Many of the largest breaches started at a smaller supplier. We vet the vendors, SaaS tools, and partners that touch your data, and help you answer your own customers’ questionnaires.
- Vendor inventory and risk tiering
- Security reviews for new tools and contracts
- Questionnaire and RFP response support
- Contract security language
4 · Strategy, Governance & Policy
The written program that proves you take security seriously, and the leadership reporting that keeps it alive after the auditor leaves.
- Right-sized policy set (not 300 pages of boilerplate)
- Security & AI-use governance
- Quarterly leadership / board reporting
- Security awareness for the human layer
5 · Incident Response & Continuity
A simple, tested plan for “what do we do if…”, so a bad day stays contained and short. When something does happen, we lead the response.
- Incident response plan and call tree
- Tabletop exercises with after-action reports
- Business-email-compromise and ransomware playbooks
- Hands-on incident leadership and forensic reporting
Specialty · OT / ICS & AI Security
Two areas most fractional firms avoid. We teach OT/ICS security at the college level and build AI governance programs aligned to ISO 42001 and the EU AI Act.
- IT/OT segmentation and plant-floor risk
- Safe adoption of ChatGPT, Copilot, and Claude
- AI vendor and data-use reviews
Three ways to work together
Month-to-month. No multi-year lock-ins. Pricing depends on your size and scope; we’ll give you a firm number after the free consultation.
Security Assessment
- Full risk assessment against CIS / NIST
- Prioritized 12-month roadmap
- Executive readout meeting
- The plan is yours to keep, whatever you decide next
Fractional CISO Retainer
- Your named CISO, with set monthly hours
- Roadmap execution and IT-provider oversight
- Compliance program management
- Vendor reviews and customer questionnaires
- Quarterly leadership / board reporting
- Priority incident response
Project Engagements
- SOC 2 / ISO 27001 / CMMC readiness sprint
- Tabletop exercise package
- Incident investigation and report
- M&A cyber due diligence
- Vendor-risk program build
You’ll know exactly where you stand within a month
Every retainer starts the same way, so there’s no mystery about what you’re paying for.
Why fractional makes sense at your size
A full-time CISO is one of the hardest and most expensive executive hires to make, and at $5M–$400M in revenue you usually don’t need 40 hours a week of one. You need the right decisions made, the right standards set, and someone accountable when customers, auditors, or insurers come asking.
- No recruiting, salary, equity, or benefits for a senior executive
- Experience across 100+ organizations, not just one company’s view of risk
- Start in weeks, not the months a senior search takes
- Scale up or down as audits, deals, and incidents come and go
Independent by design
We sell judgment, never products. We take no commissions or referral fees on any tool, vendor, or MSP we recommend, so the only reason we recommend anything is that it’s right for you.
That includes telling you when you don’t need to buy something.
Not sure where to start?
Take the free 5-minute Risk Scorecard, or book 30 minutes and we’ll tell you honestly what you need (and don’t).