vCISO pricing in Canada: rates and models
Canadian vCISO retainers run about $3,000 to $12,000 CAD a month, and hourly work about $200 to $400 CAD. The number matters less than the structure around it, which is where two proposals at the same price stop being the same purchase.
A vCISO in Canada is priced one of four ways: an hourly rate of $200 to $400 CAD, a monthly retainer of $3,000 to $12,000 CAD depending on hours, an embedded arrangement at $12,000 to $25,000 CAD a month, or a fixed-scope project at $15,000 to $60,000 CAD. Those bands are narrow and have held for several years. The work is priced on one person's senior attention.
What varies more than the headline number is what surrounds it: whether there is a setup fee, whether unused hours survive to next month, what an overage hour costs, how long you are committed for, and whether the person named in your customer contracts is the person who shows up. Two proposals at $8,000 a month can differ by $30,000 a year once those terms are priced in. The full first-year budget and the comparison against hiring are on fractional CISO cost.
Rate benchmarks by engagement model
Every figure below is Canadian dollars. They are the bands a first engagement typically lands in, drawn from what Canadian providers quote for mid-market work. They are ranges rather than a rate card, because no published rate card for this role exists in Canada.
| Model | Rate | Effective hourly | What the fee buys |
|---|---|---|---|
| Hourly advisory | $200 to $400 per hour | $200 to $400 | Answers to questions. No ownership of anything |
| Advisory retainer, 8 to 16 hours | $3,000 to $6,000 per month | $275 to $375 | A standing owner for an existing program |
| Program leadership, 20 to 40 hours | $6,000 to $12,000 per month | $250 to $325 | Someone driving a certification or a remediation plan to a date |
| Embedded, 2 to 3 days a week | $12,000 to $25,000 per month | $175 to $275 | Presence, not just decisions. Post-incident and team building |
| Fixed-scope project | $15,000 to $60,000 total | Priced on outcome | A named deliverable with an acceptance test |
| Initial assessment | $5,000 to $20,000 one time | Priced on outcome | Gap analysis and roadmap, usually before a retainer starts |
The effective hourly column is the commercial logic of the model. The rate falls as commitment rises, which is why every provider steers you toward a retainer. The discount is real, and it is a saving only if you consume the hours. Plenty of companies buy twenty hours a month and use eight.
A test for the hours number
Ask the provider how many hours they billed against their last three retainers of your size, not how many were contracted. A provider who has never looked at that difference is not managing the engagement, and a provider who has will usually tell you to buy fewer hours than you asked for.
What the rate says about who is showing up
The same $8,000 a month buys a different person depending on who you buy it from.
| Provider type | Typical retainer | What you get and what you risk |
|---|---|---|
| Independent operator | $3,000 to $9,000 | The person you interviewed is the person you get. Single point of failure on holidays, illness and their next full-time offer |
| Boutique security firm | $5,000 to $15,000 | A named lead with cover behind them and specialists to pull in. Ask whether the lead named in the proposal is contractually yours |
| Managed security provider with a vCISO add-on | $2,500 to $7,000 | Cheapest, and the least independent. They are advising you on tooling they also sell you |
| National or global advisory practice | $15,000 to $40,000 | Depth, a brand a board recognises, and a real chance the day to day work is done by someone junior |
A vCISO attached to a managed security provider is paid to lead your security program by a company whose revenue depends on selling you more security product. The conflict is manageable if you know it exists and the recommendations come with alternatives. It is not manageable if the retainer is priced below cost as a route into the tooling contract. If a vCISO retainer is quoted at $2,500 a month, ask what else is in the master services agreement.
Comparing firms for this? Tell us what you need and it goes to the ones in the directory that do this work. No charge, and no phone number required.
The parts of the fee that are not the fee
Six terms move the real annual cost more than the monthly number does. Get all six in writing.
- Setup or assessment fee. $5,000 to $20,000 CAD is normal, since the first month is the heaviest. Ask whether it is credited against the retainer, and whether you own the output outright so it stays useful if you change providers.
- Minimum term. Three to six months is reasonable and matches how long an assessment and roadmap take. Twelve months is not: the value is front-loaded and the lock-in transfers all the risk of a bad fit onto you.
- Rollover of unused hours. Monthly expiry, quarterly rollover and capped rollover are all common. On a $10,000 retainer where you routinely use 70 percent, quarterly rollover is worth roughly $36,000 a year against monthly expiry.
- Overage rate. Programs run hot for the two months around an audit. Ask what hour 41 costs. A premium overage rate on a retainer sized deliberately small is how a $6,000 engagement becomes a $9,000 one for a quarter.
- Named-officer exposure. If the vCISO is named in your customer contracts, on your trust page and on your insurance application, they are accepting reputational and sometimes contractual exposure, and they will price for it. That premium is legitimate. What is not legitimate is being named without knowing it.
- Expenses and travel. Mostly irrelevant for remote work, and material if you want someone in the room for quarterly board meetings in a city they do not live in.
Comparing two proposals fairly
Proposals for this work are not written to a common template. Force the comparison by sending every provider the same scope: put a monthly hour figure beside each line of the job description and ask them to price that document rather than their own reading of your situation. Then normalise on the points below before you look at price.
| Question | Why it changes the price you are comparing |
|---|---|
| Who is the named individual, and what is their commitment? | A proposal naming a principal but staffing a consultant is a different product at the same price |
| How many hours, and measured how? | Some providers count only client-facing time, some count preparation and reading |
| Is the compliance platform subscription inside or outside? | $8,000 to $30,000 CAD a year sitting in the wrong column |
| Does it include policy authoring or policy review? | Authoring a first policy set is 30 to 60 hours of work. Review is five |
| Who answers customer security questionnaires? | For a company with large buyers this alone can consume half a retainer |
| What happens at the end? | A handover package you own, or a program that only runs while you keep paying |
What is genuinely negotiable
The hourly rate usually is not. Senior security people in Canada have alternatives, the pool is small, and a provider discounting their rate materially is telling you something about their pipeline. What moves is everything else: the setup fee credited rather than charged, the minimum term cut from six months to three, rollover extended to a quarter, a ramp where you buy 30 hours for the first two months and 12 thereafter, and ownership of the work product written in plainly.
The largest saving is not a discount. It is buying fewer hours than the provider proposes and having internal people do the parts that do not need a security executive. Work out the hours first, with the hours calculator or by hand: a provider sizing the retainer for you has an interest in the answer. Evidence collection, ticket chasing and policy formatting can be done by a competent operations person at a fraction of $300 an hour.
How TrazTech prices this, since it operates this site
TrazTech sells advisory retainers, program leadership through a certification, and fixed-scope projects, which are the shapes priced above. The compliance workspace it runs is free, and it stays at $0 when you hire the firm, so the platform subscription is not a number folded into a retainer. That is the buried line item this page warns about, and it is the reason to ask every provider where theirs sits.
Two cases where it is the wrong purchase. Under about 25 people there is usually not enough to lead, and hours bought at that stage produce documents nobody reads. And where a regulator drives the mandate, a provider working in that regime every week is worth more than a generalist at the same rate.
Why American rate cards mislead here
Most published vCISO pricing is American, quoted in US dollars, and lands in Canadian search results without a currency note. A US rate card at $250 to $400 an hour is not the Canadian band it looks like. The conversion adds a material amount before you have compared anything. Check the rate on the day and the currency in the contract, particularly with a cross-border provider who bills in USD while quoting a number that looks familiar.
The second difference is what the work covers. American material is written around SOC 2, HIPAA and state privacy law. A Canadian engagement has to account for PIPEDA, which requires a named individual accountable for personal information and keeps a breach record obligation running for 24 months, and for Quebec's Law 25 where you have Quebec customers or staff. A provider whose templates do not mention either is charging you Canadian dollars for American work.
If you are the provider rather than the buyer, the same structure priced from your side is in pricing a vCISO retainer, including what scope creep does to the effective rate over a year.
Compare vCISO quotes in Canada
Tell us the trigger, the hours you think you need and what your team can do internally. We put the same scope in front of Canadian providers, so the numbers you get back are comparable.
Get matchedCommon questions
What is a normal vCISO hourly rate in Canada?
Between $200 and $400 CAD an hour for genuinely senior people, with most mid-market work quoted between $250 and $325. Below $200 you are usually buying a security analyst with a better title, and above $400 you are usually buying a national advisory brand. The rate falls to an effective $175 to $275 an hour inside a large retainer, which is the whole reason retainers exist.
Why do vCISO providers quote a range instead of a price?
Because the price is set by how many hours the work needs, and nobody knows that until they have seen your environment. The honest version of this is a paid initial assessment that produces a scoped retainer number. The dishonest version is a low retainer quoted to win the work, followed by overage. Ask any provider quoting a range what would put you at the top of it and what would put you at the bottom.
Is a cheaper vCISO from a managed service provider a bad idea?
Not automatically, but treat the independence question seriously. A provider who advises on your security program and also sells you the tooling has an interest in the recommendation. If you go this route, ask for recommendations to be written with at least one alternative and a stated reason for the choice, and keep the decision to buy with you rather than delegating it.
Should the initial assessment fee be credited against the retainer?
Often it is, and asking costs nothing. A more useful thing to negotiate is ownership: the assessment, risk register and roadmap should be yours outright, in an editable format, with no restriction on showing them to another provider. A provider who will not agree to that is pricing in your switching cost, which tells you what the renewal conversation will look like.
Do vCISO rates differ across Canadian cities?
Barely. The work is remote by default and the market is national, so a Halifax company and a Toronto company get quoted much the same band. What differs is availability of sector experience, particularly in financial services and health, and how easily you can get someone in the room for a board meeting. See vCISO services across Canada for the provincial detail.