Introduction: Why a Part-Time CISO Agreement Matters
A part-time CISO gives you senior cybersecurity leadership without a full-time executive salary. But the value depends on what the agreement says, and "responsibilities" alone won't carry it.
Vague contracts cause predictable damage:
- Unclear authority and slow access
- Duplicated work and remediation nobody owns
- Surprise fees and confusion mid-incident
IANS describes fractional leadership as executive direction on a retainer, not daily technical operations. Hours are limited, so scope has to be agreed up front.
This article covers scope, decision rights, access, availability, reporting, commercial protections, incident coverage, and transition planning.
Key Takeaways
- Define the problem, outcomes, exclusions, and "done" before signing.
- Give the CISO authority, a sponsor, access, and meeting visibility.
- Separate strategic accountability from technical execution, and name who owns remediation and budget.
- Write down availability, incident duties, confidentiality, fees, termination, and handoff.
Before You Sign: Confirm the Engagement Model and Business Need
Pick the Right Model
A part-time or fractional CISO fits when you need to:
- Build a security program from scratch
- Prepare for an audit or certification such as SOC 2, ISO 27001, HIPAA, or PCI
- Improve board oversight
- Cover a leadership transition
An interim CISO suits a leadership gap, failed audit, or post-incident stabilization, usually at higher intensity for a shorter window.
A full-time CISO fits when you need daily executive presence and long-term organizational design, though hiring and ramp time are the trade-off.
Decide What You Are Buying
Be specific about scope. Common needs include:
- Strategic advice
- Program ownership
- Team management
- Hands-on implementation
- Incident leadership
Many engagements combine several of these. Then say which work stays with IT, engineering, legal, compliance, or an outside provider.
A fractional CISO does not replace IT operations or create engineering bandwidth. Most drive execution through an existing CIO, head of IT, or compliance owner.
Vet the Candidate
Check these before signing:
- Executive and sector experience
- Board communication skills
- Credentials and references
- Real availability
- Conflicts of interest
- Continuity coverage if the individual is unavailable
ISACA flags a loyalty risk when a virtual CISO pushes unnecessary products or services, so ask about vendor relationships directly.
Tyson Martin offers fractional CISO and board advisory support for organizations that need help defining scope, decision rights, and an executable 90-day plan.
Key Terms to Include in a Part-Time CISO Agreement
Define the Engagement Scope and Deliverables
The agreement or attached statement of work should state:
- The business trigger and the security problems to address
- Frameworks or regulatory obligations involved (NIST CSF, ISO 27001, SOC 2)
- Expected deliverables and explicit exclusions
Name concrete outputs, such as:
- Current-state risk view and prioritized risk register
- Security roadmap and policy improvements
- Incident response plan
- Vendor risk process
- Board reporting pack
- Tabletop exercise
- Documented handoff
Add acceptance criteria, milestones, and dependencies. Also say what happens when the organization doesn't supply the people, information, systems, or budget the work requires. Otherwise the clock runs while the CISO waits.
Establish Reporting Lines, Authority, and Access
Name these roles and channels up front:
- Executive sponsor (often the CEO, COO, or CIO)
- Day-to-day reporting line
- Board or audit committee access
- Standing meetings and the escalation route
Identify who can formally accept, transfer, or acknowledge cyber risk.
Then spell out authority. Can the CISO convene stakeholders, request evidence, recommend controls, pause a risky launch, or approve exceptions? Without clear decision rights for incidents, access changes, and risk escalation, an interim or part-time CISO can only advise.
IANS also notes that personnel decisions and budget or signature authority are hard boundaries for a non-employee advisor, so address them separately.
A tiered risk-acceptance model helps:
- Management accepts low risk
- Executives approve medium risk
- High risk goes to the CEO and board committee chair
Every exception needs an expiry date, compensating controls, and a named owner.
Attach an access schedule covering:
- Identity and cloud environments
- Security tools and audit reports
- Incident history and cyber insurance
- Critical vendors and key people
Use least-privilege onboarding and revoke access at exit. NIST SP 800-53 supports task-based access and signed access agreements, not unrestricted admin rights.
Set Time, Availability, and Service Expectations
State expectations for:
- Hours and meeting cadence
- Response times for routine and urgent matters
- Travel, time zones, and after-hours support
Many teams use heavier support in month one, then settle into a weekly rhythm.
Fractional does not mean 40 hours a week on demand. Define backup coverage, escalation contacts, and how to request work outside the schedule.
Best Practices for Making the Agreement Executable
Convert the Contract Into a Phased Plan
Translate the engagement into three phases: discovery and triage, prioritization and governance, then execution or handoff. A 30-60-90 structure works only if it matches your real capacity and urgency.
Tie each phase to owners, decisions, evidence, and measurable outcomes. Don't reward activity like writing policies or buying tools. Give each major deliverable a definition of done, so work is clearly complete, deferred, blocked, or transferred.
A Day 30 package might include:
- Risk register ranked by business impact
- Tabletop summary
- Access-cleanup report with before-and-after counts
Create a Reporting and Governance Rhythm
Use separate cadences:
- Weekly 30-minute security execution check-in
- Monthly risk or executive review
- Quarterly board or committee update
Board reporting works best with 5 to 7 stable metrics, defined consistently. Each update should show:
- What changed since last time
- Trend direction
- Overdue decisions and accepted exceptions
- Next priorities
NACD guidance says cyber reporting should be business-aligned, translating technical metrics into financial terms. Tie risks to service availability, customer trust, regulatory exposure, and critical suppliers.
Separate Strategy From Technical Execution
The CISO owns risk escalation, strategy, board communication, and operating cadence. Tool administration, alert triage, and vulnerability remediation belong to others.
Require a written responsibility matrix covering the CISO, IT, engineering, legal, compliance, HR, finance, managed service providers, and executives. Assign one accountable person per initiative, not "the team." Also state how you'll handle recommendations needing new staff, tools, penetration tests, or legal advice.
Pressure-Test Before a Crisis
Run a tabletop to see whether named people can reach systems, escalate decisions, call counsel, and coordinate with insurers, vendors, and the board. CISA offers free tabletop packages with scenarios and After Action Report templates.
Log every gap as an action with an owner and date. Then update the agreement, incident plan, access list, or escalation path.
Incident, Confidentiality, Liability, and Exit Planning
Define Incident Response and Crisis Authority
State whether the CISO is incident commander, strategic advisor, coordinator, or supporting executive. Then name who can:
- Isolate systems
- Approve downtime
- Engage forensics
- Contact outside counsel
- Notify insurers
- Authorize external communications
NIST SP 800-61 Rev. 3 says third-party incident responsibilities, including authority to act for the organization, should be defined by contract. A fractional leadership retainer is not operational response capacity.
Also define severity levels, response windows, after-hours expectations, and documentation duties. For public companies, SEC Item 1.05's four-business-day clock starts at the materiality determination, not discovery. The CISO's escalation speed matters.
Protect Confidential Information and Work Product
Cover:
- Confidentiality and permitted access
- Secure devices, communications, and authentication
- Storage locations, subcontractor access, and retention
- Return or deletion at exit
- Handling of sensitive incident records
Clarify who owns reports, policies, risk registers, dashboards, and evidence, and how you get usable copies when the contract ends.
Address Liability, Insurance, and Contracting Structure
Have counsel review:
- Contractor versus employee status (the IRS weighs the actual relationship, so contract wording alone doesn't settle it)
- Professional liability and cyber insurance
- Indemnification, liability limits, and governing law
- Background checks and subcontracting limits
Require disclosure of other client or vendor ties that could affect independence. No single liability clause fits everyone.
Plan Termination and Handoff
Define termination for convenience and for cause, notice periods, renewal terms, and transition support. Build an exit checklist:
- Access revocation and data return or deletion
- Account and asset inventory
- Open incidents, accepted risks, and unresolved findings
- Vendor contacts and reporting history
- Successor briefings
A good handoff supports a permanent CISO, continued fractional coverage, an interim leader, or an internal IT owner, without losing momentum.
Conclusion: Use a Pre-Sign Checklist
Before signing, confirm you have:
- A defined mission and exclusions
- A named sponsor and reporting line
- Decision rights and required access
- Deliverables and success measures
- Availability and fees
- Incident duties and confidentiality terms
- Liability review and handoff requirements
Have the CEO, board or audit committee, legal counsel, IT leadership, and the prospective CISO review the draft together. A strong agreement reduces surprises, speeds escalation, sharpens reporting, and sets executable priorities with clear ownership.
Frequently Asked Questions
Is a CISO part of the C-suite?
Often, but not always. Title, reporting line, board access, and authority vary, so define them explicitly in a part-time agreement.
Can a CISO work from home?
Yes, if secure access, communication cadence, availability, incident procedures, and any in-person requirements are documented.
What should be included in a part-time CISO agreement?
Scope, deliverables, reporting, authority, access, availability, fees, confidentiality, incident response, termination, and handoff.
How many hours does a part-time CISO work?
It depends on risk, program maturity, and goals. Define expected time, meetings, response windows, and out-of-scope work instead of assuming a generic number.
What is the difference between a fractional CISO and a part-time CISO?
The terms overlap. "Fractional" often implies an ongoing executive role shared across clients; "part-time" describes reduced hours. Judge actual scope and authority, not the label.
How do you measure a part-time CISO's success?
Look for reduced uncertainty, clearer ownership, prioritized risk reduction, faster decisions, dependable reporting, and progress against agreed outcomes.
