Build the vCISO contract terms before you sign
Most of what goes wrong in a fractional security engagement was decided by a clause that was never written. Tick what your draft already covers and this returns the missing terms in the order they will cost you, with the wording each one needs.
A fractional security agreement is unusual among professional services contracts because the thing you are buying is a specific person's judgement, and almost nothing in a standard services template protects that. The contract that matters is the one that says who, how often, what they can stop, what happens to the work when it ends, and what happens when the person you met in the sales meeting is assigned elsewhere in month four.
Tick what your draft already covers. The missing terms appear on this page ranked, with what each clause has to say, and nothing is emailed anywhere unless you ask for it at the end.
On its way
Check your inbox shortly. If you would rather talk it through, book a time.
How the missing terms are ranked
Each clause carries a weight for how much it costs you when it is absent and something goes wrong. The named individual sits at the top because every other protection in the agreement depends on knowing who the agreement is about. Key person terms follow, because the most common disappointment in this market is an engagement sold by one practitioner and delivered by somebody more junior. Hours treatment, out of scope and handover follow those, since each one turns into an invoice argument or a lost quarter at exactly the moment you have the least room to negotiate.
Who you are contracting with moves the order. Contracting with a firm raises the weight on the named individual, the key person clause and subcontracting, because all three are firm-shaped problems. Contracting with an individual lowers those and raises the weight on unavailability, since one person can be ill. What they will have access to moves ownership, confidentiality and handover up, because the more they can reach, the more there is to return and to keep quiet about.
The narrative version of each clause, with what tends to be missing from supplied drafts, is on what a vCISO contract should include, and the questions to ask before the contract stage are on how to vet a firm.
Common questions
Is a supplied template really a problem?
Not in itself. A provider who does this work often has a better first draft than a general commercial template, because it at least contemplates security work. What supplied drafts consistently leave out are the terms that only protect you: key person, handover format, and a right to refuse a substitute. Asking for those three is normal and a reasonable provider agrees to all three.
How long should the notice period be?
Long enough to find a replacement and short enough that you are not trapped, which in practice means thirty to sixty days on both sides for an ongoing retainer. What matters more than the length is that it is symmetrical. A ninety day notice on you and thirty days on them is the clause to push back on, and it is common in supplied drafts.
What should handover actually include?
Everything produced, in an editable format, in a system you already own, delivered within a stated number of days. The failure mode is a register, a roadmap and a policy set living in the provider's platform, which leaves with them and has to be rebuilt. Ask for the artefacts to be created in your systems from day one rather than migrated at the end.
Do we need a separate confidentiality agreement?
Usually the clause inside the services agreement is enough, provided it survives termination and covers the incident information they will see. If they will touch personal information, you also need the data handling terms your privacy obligations require, and those are a separate conversation from confidentiality. Both belong in the document before access is granted, not after.
What if they will not accept a key person clause?
That is information, and it is the most useful answer you will get during a negotiation. A provider confident in the person they are proposing will name them and agree that a substitution needs your written consent. One that resists is telling you the assignment may change, which is fine if it is priced accordingly and disclosed now rather than in month four.