A fractional or virtual Chief Information Security Officer (CISO) is an executive who fills the CISO role on a part-time or interim basis. Companies typically hire a fractional CISO for situations like these:

• Goals & Projects
• Compliance Efforts – Achieve / Maintain
• Interim CISO
• Supplement existing CISO / CIO
• Novice CISO
• Company Growth
• Timely Advice

A fractional CISO can be engaged on a short-term basis to help the company achieve a specific goal, such as: an assessment of your security posture, implementation of a security program, development of policies & procedures, remediation of issues after a data loss or after an audit, installation of a particular solution or product, provide security training, and other privacy or security related projects.

In today’s world, companies are governed more and more by legal requirements, industry mandates and security frameworks, such as: PCI-DSS, HIPAA, GDPR, CCPA, NIST, ISO 27000, Sarbanes-Oxley, and more.  Whether it’s your first time achieving compliance or an annual re-certification, a fractional CISO provides experienced leadership to help your company attain the required certification.

From time to time, companies may find themselves without a security executive, due to relocation, turnover, or other reasons. A fractional CISO can step in to fill the role through this period, keeping existing programs and projects running and on track, maintaining compliance with legal and industry requirements, providing leadership to staff, and even assisting with the search for a replacement CISO.

CISOs and other technology executives often have more on their plate than can be accomplished by one person. A fractional CISO provides additional executive bandwidth, allowing the existing CISO / CIO to share some of his / her load with a trusted partner, enabling the company to meet its security & privacy needs.

In situations where a less-experienced professional may be carrying the full weight of a security program, engaging a fractional CISO provides seasoned expertise and input for senior leadership, while also providing mentoring and advice for the junior CISO to help them grow into the role.

Prior to reaching the point of hiring a full-time CISO, companies still have security & privacy needs & requirements. During that growth period, these responsibilities are often assigned to existing employees who have other duties and other skill sets. Engaging a fractional CISO as a part-time security executive provides the expertise & advice the company needs to ensure security needs are met, as well as guidance & oversight to ensure the employees tasked with security responsibilities remain on the right path.

Engaging a fractional CISO as an advisor early in the life of a company, and periodically as it grows, provides expert guidance at critical times, allowing companies to factor security considerations into key decisions, preventing significant headaches & costs down the road and avoiding issues before they occur.