vCISO engagement models and hours by size
There are five ways to buy security leadership and they are not interchangeable. The choice follows from one thing: whether you are running a program to a date, keeping an existing one honest, or recovering from something.
A company keeping a running program honest needs an advisory retainer of 8 to 16 hours a month, about $3,000 to $6,000 CAD. A company driving a first SOC 2 or ISO 27001 to a date needs program leadership at 20 to 40 hours a month, about $6,000 to $12,000 CAD. A company recovering from an incident or standing up a team needs someone embedded two or three days a week at $12,000 to $25,000 CAD a month until the emergency is over. Buying the light version of a heavy problem is the most common and most expensive mistake in this market.
How many hours a month by company size
| Staff | Steady state | Running a certification | Monthly cost, steady state |
|---|---|---|---|
| Under 50 | 6 hours | 18 hours | $2,000 to $3,500 |
| 50 to 100 | 12 hours | 30 hours | $3,500 to $5,500 |
| 100 to 250 | 18 hours | 42 hours | $5,000 to $8,000 |
| 250 to 500 | 24 hours | 48 hours | $7,000 to $12,000 |
These are the bands Canadian providers quote for mid-market work, not a rate card. The right number depends more on your internal capacity than on headcount. The hours calculator sizes it from your own answers in a minute.
The five models
- Advisory retainer
- A standing owner for a program that already exists. Monthly call, decision support, questionnaire and insurance answers, quarterly board paper. Wrong if nothing is running yet, because there is nothing to advise on.
- Program leadership retainer
- Someone driving a certification, a remediation plan or a customer commitment to a date. Weekly cadence, holds internal people to commitments. This is what most first engagements should be.
- Embedded
- Two to three days a week, effectively an interim executive. Post-incident, or building a team. Expensive, and correct for a quarter rather than a year. Step it down deliberately or it becomes the default.
- Fixed-scope project
- A gap assessment, an ISMS build, a diligence response, a policy set. $15,000 to $60,000 CAD and a defined end. Buy this when you want one deliverable and not a relationship.
- Fractional to hire
- A retainer that explicitly plans for the vCISO to specify, recruit and hand over to a permanent hire. Rare, valuable, and it must be written into the agreement at the start because it changes what the vCISO documents from day one. Covered on moving from a vCISO to a full-time CISO.
The model to be sceptical of
A retainer with a low headline number and an hours cap that everybody knows will be exceeded. The overage rate is where the margin is, and you cannot predict the annual figure. Ask for the last twelve months of overage on a comparable client, and price the proposal at the hours you will use, not the ones in the contract. How to normalise two proposals is on vCISO pricing.
Choosing between them
- Is there a date attached to somebody else's request? If yes, you need program leadership, not advisory.
- Is there a program already running that just needs an owner? Advisory retainer, and resist the upsell.
- Has something already happened? Embedded for a quarter, then reassess. See bringing in a vCISO after a breach.
- Do you want one artifact and no ongoing relationship? Fixed-scope project. This is a legitimate purchase and providers who refuse it are selling a retainer, not solving your problem.
- Do you already know you will hire within eighteen months? Say so at the start and buy fractional to hire.
Get the model and the hours priced for your size
The right number of hours depends on your headcount, your frameworks and your deal pressure. Send your situation and compare how providers scope it.
Get matchedCommon questions
Can we start with a project and move to a retainer?
Yes, and it is the lowest risk way to buy. A gap assessment at $15,000 to $25,000 CAD tells you whether the provider is any good and gives you the document you need either way. Ask for the project fee to be credited against the first two months of a retainer if you continue, which most providers will agree to.
Do unused retainer hours roll over?
Sometimes, usually capped at one month, and it is worth negotiating. A retainer with no rollover and a hard cap on overage is the structure most favourable to the provider. A quarterly hours pool is the fairest common arrangement, because security work is lumpy and an audit month is not like a quiet one.
Is a cheaper retainer with more hours better value?
Only if the person delivering the hours is the same. A $3,000 CAD retainer at 20 hours means someone is billing at $150 an hour, which is not an experienced security executive's rate in Canada. It is usually a junior analyst working from a template with a senior name on the contract. Ask who attends the monthly call and put the name in the agreement.