Renting a Security Chief: Is Fractional CISO Leadership Right for Your Board?

A listed bank can justify a chief information security officer on the executive committee, backed by a function of a hundred specialists. A £40 million manufacturer in the Midlands, a regional professional services partnership, a scaling software business in Leeds — these organisations face the same regulatory expectations and the same insurer questionnaires, yet they cannot build that apparatus. The distance between what is asked of them and what they can afford to employ is where the fractional CISO has taken root.

The arithmetic behind the model

A permanent CISO with genuine depth now commands a substantial package, and the recruitment process can run for months. Even when the hire succeeds, one person carrying the whole security portfolio becomes a single point of failure; when they leave, institutional memory leaves with them. A mid-market board weighing a six-figure salary against a well-documented skills shortage often concludes, sensibly, that it cannot fill the seat properly. What it can do is buy a defined slice of experienced judgement.

That distinction matters. A fractional CISO is not a cheaper version of a permanent one. It is a different instrument, with a different shape and different limits.

What the engagement should actually contain

Boards get into difficulty when they treat the arrangement as a warm body hired to satisfy an underwriter. A well-constructed engagement is specific about outputs. In practice that usually means a named individual attending board or risk committee meetings on a set cadence, owning the security risk register alongside an internal counterpart, maintaining the policy and control framework, running the incident response plan and its rehearsals, and providing a written opinion that directors can actually rely on. Two to six days a month is a common envelope, depending on regulatory exposure and the maturity of the estate.

Scope should be described in deliverables rather than hours: a control maturity assessment in the first ninety days, an assurance plan for the year ahead, quarterly reporting against agreed metrics, and a defined escalation route when something goes wrong. The contract should settle the awkward questions in advance — who else the provider advises, how conflicts are managed, what happens when a serious incident lands outside contracted days, and how knowledge is documented so the organisation is not wholly dependent on the relationship.

Authority, not just advice

The most common structural weakness is a fractional CISO holding accountability without authority. If the individual cannot escalate directly to the board, cannot challenge a business unit's decision to accept risk, and has no standing to pause a risky deployment, the role becomes advisory decoration. Directors should confirm the reporting line — ideally to the chief executive or the board risk committee rather than to the IT director whose work is being assured — and should see the mandate written down.

There is a parallel obligation on the board. A shared security leader can inform a risk decision; they cannot make it. Under UK GDPR accountability principles, and in the eyes of the regulator, responsibility for protecting personal data and for the organisation's overall resilience sits with the directors. Delegation of activity is normal. Delegation of liability is not possible.

Where shared leadership genuinely fits

The model tends to work well in four situations: when the organisation has regulatory or contractual obligations it cannot yet staff for; when a cyber insurance renewal has produced conditions the board does not know how to meet; when an incident or near miss has exposed gaps in governance; and when an internal security manager needs senior cover and mentoring rather than a competitor for the same seat. It suits organisations that can absorb advice and act on it.

It tends to work badly when the underlying problem is execution capacity. A fractional CISO can design a control framework, but somebody has to implement it. Buying leadership without buying the hands to deliver usually produces a well-written plan and very little change.

The box-ticking warning signs

Several patterns are worth watching for. The first is a report that could have been written for any client — generic maturity scores, no reference to the organisation's actual systems, suppliers or critical assets. The second is rotation: the person who won the work disappears and is replaced by a succession of juniors. The third is absence from the uncomfortable rooms — no attendance at the risk committee, no involvement in major change programmes, no visibility of the incident log. The fourth is a stream of recommendations with no owners, dates or follow-up, so the same findings reappear each quarter. The fifth is an arrangement whose only measurable output is a certificate or a completed questionnaire for an insurer.

Any of these suggests the organisation is buying the appearance of security leadership rather than the substance of it.

Questions worth asking before signing

Boards should ask who exactly will do the work and how often they will be on site or in the room; what the first ninety days will produce; how success will be measured at twelve months; who owns the risk register between engagements; how incidents are handled out of hours; what the exit looks like and how documentation will be handed over; and what the provider's other clients in the same sector mean for independence. The answers will separate a genuine partnership from a retainer with a logo.

The fractional CISO is a sound answer to a real problem. It is not a substitute for the board's own attention. Treated as a defined, measured and properly authorised relationship, it can give a mid-market organisation something it has rarely had: a security voice in the room that speaks the language of risk rather than the language of tools.