Question 1

What does a fractional CISO cost in the UK?

Accepted Answer

Fractional CISO day rates sit in two bands. SME and mid-market engagements sit in the standard band: £1,100 to £1,400 per day, approximately £4,750 to £6,000 per month at one day per week. Regulated sector and PE-backed mandates sit in the complex band: £1,500 to £2,000 per day, approximately £6,500 to £8,500 per month at one day per week. Both bands are significantly less than the all-in cost of a permanent CISO hire, which typically runs at £150,000 or more per year before on-costs and search fees.

Question 2

What is the difference between a fractional CISO and a virtual CISO?

Accepted Answer

The terms are used interchangeably in the market, but they describe different arrangements. A fractional CISO is a named individual who sits on your leadership team and is personally accountable to your board for the security agenda. A virtual CISO is typically a service sold by a managed security provider, often delivered by a team rather than a named individual, with accountability sitting with the supplier rather than with an executive on your side of the table.

Question 3

When should a business hire a fractional CISO?

Accepted Answer

Common triggers include: cyber risk reaching the board agenda and nobody in the room able to answer with authority; an ISO 27001, SOC 2 or Cyber Essentials Plus certification required by a regulator or a customer; NIS2 or DORA obligations applying to the business or its supply chain; a cyber incident or near-miss that has exposed gaps in governance; a PE acquisition or exit where the security posture needs to be credible under due diligence; or an insurer requiring evidence of board-level cyber ownership.

Question 4

Can a fractional CISO deliver ISO 27001 certification?

Accepted Answer

Yes. ISO 27001 has been achieved in nine months from a standing start for a regulated FinTech. A fractional CISO leads the certification programme end-to-end: gap analysis, risk register, ISMS documentation, controls implementation, internal audit and stage 1 and stage 2 audits with the certification body. The CISO relationship continues post-certification for surveillance audits and ongoing ISMS governance.

Fractional CISO for UK Businesses and PE-Backed Portfolios