Pricing a vCISO retainer

Price the hours first and the fee second. The other way round is how a $5,000 CAD retainer turns into a $244 an hour engagement you cannot afford to keep.

Last reviewed 2026-09-01Written by Jacob Masse, TrazTech Inc.

Canadian vCISO retainers run $3,000 to $12,000 CAD a month for 8 to 40 hours of senior attention, and $12,000 to $25,000 CAD for an embedded arrangement of two to three days a week. These are the same bands this site publishes for buyers on vCISO pricing. A firm quoting far outside them is arguing with the market, not with us. The effective hourly rate inside a retainer lands between $250 and $375 CAD, below the $200 to $400 CAD hourly band, and that discount is why a client prefers a retainer.

$250 to $375 Effective hourly rate inside a healthy retainer, CAD

Price the retainer so that effective rate is a number you would accept on month 24, not month one. Almost every retainer that goes bad went bad because the hours grew and the fee did not.

How many hours a month does a client actually need?

Size the hours from what is in flight, not from headcount alone. A 60 person company halfway through a first SOC 2 needs more of a security executive than a 300 person company with a mature program and an internal security manager.

Two things move a client up a band regardless of size. Large buyers: security questionnaires and customer security calls can consume half a retainer on their own. A board or an insurer that wants quarterly reporting: a board pack is 6 to 10 hours a quarter once the underlying reporting exists, and far more before it does.

Fixed monthly fee, banked hours, or hourly?

Fixed monthly fee

One number for a defined scope, with hours as an internal planning figure rather than a contractual one. Simplest to sell and the most exposed to scope creep, because nothing in the contract says when you have done enough.

Banked hours

A block of hours a month at a stated rate, with a defined policy on what happens to unused hours and what an overage hour costs. Harder to sell, because it makes the client count, and far easier to renegotiate honestly.

Hourly

Billed as used, no commitment either way. Correct for genuine advisory work with a client who has internal leadership, and wrong for anything where you are accountable for an outcome, because nobody drives a roadmap they can be switched off from at any moment.

Quote a fixed monthly fee with the hours written into the scope as a stated assumption, and a named review point when actual hours run 25 percent over that assumption for two consecutive months. The client gets the simplicity they want and you get a trigger to reprice without a fight. A pure fixed fee with no hours assumption turns every new client demand into free work.

Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.

What is inside the retainer and what is billed separately

Write the exclusions down before the first invoice. Every item below has caused an argument in somebody's engagement, and the argument is cheaper before the work starts.

0 of 0 written into the scope · Reset

• Hours assumption, how hours are counted, and whether preparation and reading count
• Overage rate, and the review trigger that changes the fee rather than just billing it
• Customer security questionnaires: how many a month before it becomes billable work
• Policy authoring against policy review. Authoring a first set is 30 to 60 hours, review is closer to five
• Who pays for the compliance platform subscription, and in whose account it lives
• Incident response: what is included and what is billed at an emergency rate
• Audit support hours, which spike for the two months around fieldwork
• Whether you are named in customer contracts, on a trust page or on an insurance application
• Travel and on-site attendance, particularly for quarterly board meetings
• Handover: what the client owns on exit, in what format, and how much notice each side gives

The platform line is the one most often left ambiguous and it carries the largest number. Paid compliance platforms run $8,000 to $30,000 CAD a year for a mid-market client, so a retainer quoted with the platform silently inside it is a different price. Decide which side of the line it sits on and say so in the proposal. TrazTech, which operates this directory, publishes a free compliance workspace covering 10 frameworks with an evidence register and 40 policy templates, which covers a client at the start of a first SOC 2 who cannot yet justify a paid platform. It checks seven systems daily, AWS, Okta, Google Workspace, GitHub, GitLab, Cloudflare and Jira, and describes anything else as a check. Vanta and Drata cover hundreds of systems including endpoints and HR, and a client with an estate that size should buy one of those.

What scope creep costs on an unbounded retainer

Scope creep on retainer work does not announce itself. The fee stays the same, the client is happy, and the effective rate falls a few dollars a month until the engagement is the worst-paid thing in the practice.

Nothing unreasonable happened in that table. Each addition was small and right for the client, and the practice ended the year earning $244 CAD an hour on work it priced at $313. Track hours per client monthly even on a fixed fee. The fixed fee is the structure that hides this.

If the retainer is replacing project work you already sell to the same client, price the switch deliberately rather than by discounting your project rate. The two rates should differ by about $50 to $75 CAD an hour and no more, a comparison set out in from project work to retainer.

When should you raise a retainer price?

1. At renewal, always, by an indexation figure written into the original contract. Three to five percent annually is unremarkable and a client who agreed to it a year ago does not argue about it.
2. When actual hours exceed the scope assumption by more than 25 percent for two consecutive months. Raise the fee or cut the scope, and let the client choose which.
3. When a framework is added. A second framework is not a marginal addition, it is a second evidence set, a second auditor relationship and a second set of policies to keep current.
4. When the client crosses a size band, which usually shows up as more people wanting your time rather than more work of the same kind.
5. When you take on named-officer exposure that was not in the original arrangement. Being named in customer contracts or on an insurance application is a real risk transfer and it is legitimate to price it.
6. Never mid-term without a scope change to point at. A price rise with no corresponding change is the single fastest route to a cancellation, and cancellations cost more than the increase was worth.

Raising the price on new clients while leaving existing ones alone is the usual compromise, and it works for about two years before your best clients are your worst-paid. Put the indexation clause in from the start instead.

Pricing before you have references

With no case studies the instinct is to discount the retainer. Do not. The retainer price is the one number you cannot move upward later without a renegotiation the client will resent. Discount the assessment instead, shorten the minimum term, or offer a 90 day initial engagement rather than a 12 month commitment. Each of those costs less than a permanently low monthly fee. The first year of a practice is covered in your first ten vCISO clients.

Common questions