What does a fractional CISO do?

Setting the strategy, not just running the tools

The most common misunderstanding is treating a fractional CISO as a more senior version of IT support. IT keeps systems running. A fractional CISO decides what your security program should look like in the first place and what risks matter most to your business.

In practice, that means:

• Assessing your current risk posture and figuring out where the real gaps are, as opposed to the gaps a vendor's marketing wants you to worry about.
• Setting a security roadmap tied to your business, not a generic framework checklist – for example, a healthcare company and a fintech startup shouldn't have the same priorities in month one.
• Deciding what to build in-house versus what to buy, delegate, or outsource.
• Revisiting that roadmap on a regular cadence as the business changes, instead of writing it once and filing it away.

This is the part of the job that's hardest to see from the outside, and it's also the part that determines whether everything else – compliance, tooling, vendor management – adds up to something coherent.

Owning compliance readiness, start to finish

If your company is pursuing SOC 2, ISO 27001, HIPAA, or CMMC, someone has to translate a dense framework document into a list of things your team needs to build, document, and prove. That's usually the single biggest reason companies bring in a fractional CISO in the first place.

The work looks like:

• Running a gap assessment against the specific framework you're targeting.
• Writing or overhauling the policies auditors expect to see like access control, incident response, vendor management, and the rest.
• Coordinating with engineering to close technical gaps (logging, encryption, access reviews) before the audit clock starts.
• Managing the actual audit relationship, so your team isn't fielding auditor questions cold.
• Keeping the program alive after certification, because SOC 2 and ISO 27001 both require ongoing evidence, not a one-time push.

Companies that treat compliance as a document exercise usually end up scrambling every renewal cycle. Companies that build a real program the first time don't.

Managing vendor and third-party risk

Every SaaS company runs on other companies' infrastructure – cloud providers, payment processors, HR platforms, analytics tools. Each one is a door into your data that you don't fully control. A fractional CISO is the person who can help track that exposure instead of letting it accumulate silently.

That includes reviewing new vendors before contracts get signed, not after; maintaining a real inventory of what data goes where; and following up when a vendor has its own breach or compliance lapse, since that becomes your problem too. It sounds administrative until the vendor in question turns out to be the one holding your customer data during an incident.

Governing how the company uses AI

This has become its own pillar of the job rather than a footnote under vendor risk. Employees are pasting client data into ChatGPT, engineering teams are adopting Copilot, and SaaS vendors are quietly shipping AI features that weren't there when the contract was signed – usually well before anyone in security has reviewed any of it. A fractional CISO today needs to be AI-forward: treating AI adoption as its own risk category with its own inventory, not something that gets swept into the general vendor list and forgotten.

In practice, that means running a shadow AI discovery to find out what tools are in use, writing an acceptable use policy employees can follow, and reviewing new AI vendors for data handling and training practices before they're approved. For companies further along, it also means aligning the program with frameworks like ISO 42001 or the NIST AI RMF, which are quickly becoming what customers and boards expect to see. Our AI governance services page goes deeper on what that work involves.

Answering the questions your customers are already asking

If you sell to other businesses, security questionnaires and SOC 2 report requests aren't optional paperwork – they’re part of the sales process now, and a slow or inconsistent answer can stall a deal. A fractional CISO builds a standard, defensible way to answer these instead of your sales team improvising a new answer every time.

That usually means maintaining a security questionnaire response library, keeping a trust page or security overview current, and briefing sales or customer success on how to talk about your posture without overpromising. Deals move faster once this exists. It's a small thing until it's the thing holding up a signature.

Reporting to the board and to leadership

Security must be explainable to people who aren't security people. A fractional CISO's job includes translating technical risk into language a CEO, a board member, or an investor can act on, like what's the risk, what does it cost to fix, and what happens if you don't.

That usually shows up as quarterly board updates, ad hoc briefings when something changes (a new regulation, an industry breach that raises questions, a funding round that triggers new diligence), and straight answers when leadership asks, "are we okay?".

Getting ready for the incident before it happens

Most companies think about incident response for the first time during an incident, which is exactly the wrong moment to be figuring out who calls the lawyer. A fractional CISO builds the plan in advance: who's on the response team, what the notification obligations are in each state or jurisdiction you operate in, who talks to customers, and who talks to the press if it comes to that.

Some engagements include running a tabletop exercise, which is a simulated incident, usually a couple of hours, where the team walks through a scenario and finds the gaps in the plan while the stakes are still zero. It's one of the highest-value, lowest-cost things a company can do, and almost nobody does it until they've already had a scare.

What this looks like week to week

None of this is a single big project with a finish line. A fractional CISO's calendar in a typical month might include a policy review, a vendor security review for a new tool the team wants to adopt, a look at whether a new AI feature someone signed up for needs an acceptable use update, a working session with engineering on an access control gap, prep for a customer's security questionnaire, and a short board update. The mix shifts depending on where you are – heavier on gap assessment and policy-writing in the first few months of an engagement, heavier on monitoring and questionnaire response once the program is running.

That's really the distinction worth remembering: a full-time security hire is a headcount decision. A fractional CISO is a way to get that judgment and that ongoing attention without making the headcount decision before you're ready to.