vCISO scope definer
Security leadership, program delivery and hands-on technical work are three different jobs with three different price tags, and all three get quoted as fractional CISO. This works out which one your answers describe, and names the two you are not buying.
Ask three providers for a fractional CISO proposal and you can get three documents describing different work. One sells an executive who owns risk decisions and faces your board. One sells a project manager who runs the certification and writes the policies. One sells an engineer who will turn on multi-factor authentication and fix your logging. All three are legitimate pieces of work. Only one of them is the thing you are short of, and paying leadership rates for configuration is the most common way money disappears from this line item.
Six questions. The scope appears on this page with the reasoning, and nothing is emailed anywhere unless you ask for it at the end.
On its way
Check your inbox shortly. If you would rather talk it through, book a time.
The three things sold under one label
Security leadership and accountability. One senior person who owns the risk decisions, sits in front of the board and the customers, and carries the answer when somebody asks who is responsible. The output is judgement and a signature. It is measured in decisions made, not documents produced, and it is the smallest number of hours of the three.
Program delivery. Policies written, a certification driven to a date, questionnaires answered, vendor reviews run, evidence collected. The output is artefacts and a finished audit. This is where most of the hours go in a first year, and it is the part that a coordinator or an analyst can do under supervision at a fraction of an executive rate.
Hands-on technical work. Identity and access configuration, logging, endpoint tooling, backups, architecture and code review. The output is changed systems. It is engineering work, it is charged as engineering work by anyone honest, and it is the piece most often assumed into a leadership retainer and then quietly not done.
A proposal that does not say which of the three it is covering cannot be compared with another proposal, because the two may not be selling the same job. See vCISO engagement models for how the three get packaged, and what a vCISO does for the day to day.
How this decides
Each task you ticked carries a weight in one or two of the three lanes. The trigger adds weight, because a certification with a date is a delivery problem and a board asking who owns security is a leadership problem. Your internal capacity moves the technical lane, up when there is nobody to implement and down when there is a team that already can. Authority moves the leadership lane, because a person who only recommends is not accountable for anything, whatever the title on the contract says.
The winning lane is what you should be buying first. The other two are not wrong, they are simply a second purchase, and separating them is what lets you put a number on each.
Common questions
Can one person cover all three?
For a short period, in a small company, yes. What happens over a longer engagement is that the urgent work drives out the important work, so the hours drain into questionnaires and tool configuration and the risk decisions never get made. If you genuinely need all three, buy them as named lines with hours against each rather than as one number, so you can see when one is eating the others.
My answer came out as technical. Does that mean no vCISO at all?
It means the thing blocking you is engineering capacity, and a leadership retainer will not clear it. Buying a senior advisor to tell you that multi-factor authentication is not enabled everywhere is an expensive way to learn something you already know. Fix the systems first, then buy the leadership to keep them fixed.
How do I put this into a request for proposals?
Name the scope, list what is out of scope, state the hours and say who on your side will implement. The vCISO job description is the document to attach, and the hours calculator gives you the number to put beside it.
Does the scope change after the first quarter?
Usually. First engagements are delivery heavy because there is a backlog of things that were never written down, then the mix shifts toward leadership once the artefacts exist. Write the contract so the mix can change without renegotiating the whole agreement, and review it at ninety days. The first 90 days planner sets out what should exist by then.
Is this the same question as how many hours to buy?
No, and the order matters. Scope first, hours second. Hours bought against an undefined scope get spent on whatever arrives in the inbox, and at renewal nobody can say what the money produced.