A Fractional CISO, for when someone else starts asking
Security owned as a governed risk rather than as a property of the IT estate: the obligation, the evidence, the build pipeline and the accountability. Deliberately distinct from the Fractional CIO, who runs the estate and keeps it secure day to day. One senior operator accountable for it, with our delivery teams behind them.
Not a second CIO, and not a larger IT budget
A Fractional CISO owns security as something the board is accountable for. That means four things. The obligation: what you are required to do and by when. The assurance: what you can evidence to a customer, an insurer or an acquirer. The pipeline: whether security is a property of how you build or a gate in front of release. And the accountability: who decides during an incident, and who notifies whom.
The Fractional CIO also owns security, and this does not replace that. The CIO owns the operational half: access, patching, backups, the MSP relationship, the posture that keeps the estate standing. The split is not subtle once you say it out loud. The CIO answers "is it secure?". The CISO answers "can we prove it, to whom, by when, and what happens when we cannot?".
Most businesses need the CIO first and are right to. They discover they need this one in the week a customer's security review lands, an insurer asks a question nobody can answer, or a regulator's letter arrives.
If more than two of these are true, the cost is already being paid
A customer security questionnaire takes a fortnight of senior time, every time one arrives.
A deal has slowed or stalled in the buyer's security review, and nobody is sure which answer did it.
The incident plan exists, and the people named in it have never been in a room together about it.
Security scanning runs in the pipeline and the findings are routinely ignored, by agreement.
Nobody can say which of the incoming obligations actually apply to you: the UK Bill, NIS2, DORA.
Your answer to "who is accountable if we are breached" names a supplier rather than a person.
Four areas of ownership, not a compliance retainer
Regulatory Obligation & Board Reporting
Which regimes actually bind you, what each one requires and by when, and a board report that shows position and direction rather than a colour-coded summary of activity.
Assurance & the Evidence Position
Owns what you can demonstrate to customers, insurers and acquirers, and the standing answer set behind it, so responding to a review is a day rather than a fortnight.
Secure Delivery & the Pipeline
Sets how security works inside engineering: what runs, what blocks, what is ranked before it reaches a developer, and who owns a finding once it exists.
Incident Accountability
Decision rights during an incident, notification inside the regulatory window, and the rehearsal that establishes whether any of it works before it has to.
When the position needs closing
The CISO sets the obligation and the standard of evidence. Where that turns into defined work, whether a certification programme, a pipeline rebuilt around ranked findings, a third-party assurance review or an incident rehearsal with the board in the room, we take it on through our delivery partners, manage the suppliers you already have, or run a vendor selection on your behalf. Leadership and delivery are quoted separately, because a blended rate is a quiet incentive to recommend more delivery. If we run the selection, neither we nor our partners can win it. See how we run a selection.
Before you take this to the board
The CIO runs the estate and keeps it secure operationally: access, patching, backups, the MSP. This role owns security as a governed risk: what you are obliged to do, what you can evidence, how security works inside delivery, and who is accountable when something happens. Plenty of businesses need only the CIO. The ones that need both usually know it because somebody outside the business has started asking for proof.
Those are controls and a check on controls. Neither is accountability, and neither produces the evidence position a customer or an insurer is asking for. An MSP is also not well placed to mark its own work: the review of whether the arrangement is adequate has to sit outside the contract being reviewed.
Often the pressure arrives commercially rather than legally, through customers' security reviews, insurance renewals and diligence, and that reaches businesses no regulator has written to. Worth checking regardless: the UK Cyber Security and Resilience Bill extends to managed service providers, data centre operators and designated critical suppliers, and firms selling into the EU can sit inside NIS2 or DORA whatever the UK requires.
Done badly, certainly. That is the standard failure and it is well documented. Most shift-left programmes push a high-volume, low-context alert backlog into a delivery team, which then agrees to ignore it. The work here runs fewer checks, ranked before they reach anyone, placed where a developer can act. That is harder to build and it is the only version that lasts.
The evidence behind this work
The practice behind this role
The commercial argument, the DevSecOps evidence, and the constraint we put on our own scope.
See Cyber Security & DevSecOpsSee CIO leadership
Where IT operations, infrastructure and the estate sit: the operational half of this, and a separate remit.
See how we lead thisProblem before platform
Buying the platform before owning the problem: the pattern underneath most stalled security programmes.
Read the articleTake the Security Assurance Assessment
Not whether you are secure, but whether you could show it. Seven areas, and secure delivery comes unticked if you build no software.
Start the assessmentTalk to us about what you can evidence
A questionnaire, a renewal, a diligence process or a regulator. A direct conversation about the obligation and the gap, not a sales script.