Introduction: Statement of Work for a Part-Time CISO
You need someone accountable for cybersecurity, board-ready reporting, and clearer risk decisions. You may not be ready to hire a full-time CISO. A part-time engagement can fill that gap, but only if the paperwork is precise.
Without a defined statement of work (SOW), "fractional CISO" becomes a broad promise. Nobody knows the hours, the authority, or what gets delivered.
Gartner's 2024 analysis notes that midsize organizations often lack dedicated security resources. Engaging a virtual CISO can improve practices and program maturity.
This guide gives you a copy-ready SOW structure covering scope, success measures, operating rules, legal guardrails, and transition terms.
Key Takeaways
- Write outcomes and deliverables, not a generic list of CISO duties.
- Separate CISO oversight from controls owned by IT, legal, HR, and business teams.
- Fix hours, cadence, escalation, access, exclusions, and acceptance criteria before day one.
- Cover confidentiality, ownership, insurance, termination, and handoff in writing.
What Is a Statement of Work for a Part-Time CISO?
A statement of work describes what will be delivered, by whom, when, under what assumptions, and how completion will be judged. Thomson Reuters adds that an SOW typically includes scope, timeline, cost, deliverables, milestones, and acceptance criteria.
How an SOW Differs From Related Documents
- Job description: describes a role. An SOW defines contracted services and outputs.
- Master services agreement (MSA): holds the broad legal and commercial terms. The SOW applies them to one engagement.
- Incident-response retainer or managed security agreement: a separate contract if you need continuous monitoring or guaranteed emergency response.
What a Part-Time CISO Contributes
Typical work includes:
- Security strategy
- Risk and compliance governance
- Executive and board communication
- Program prioritization
- Incident readiness
- Third-party risk oversight
This is strategy, advice, and coordination, not hands-on implementation. A fractional CISO is not an outsourced SOC, and does not replace monitoring, patching, or identity administration.
Why Part-Time Needs More Precision
Limited hours and competing commitments shape the model. ISACA's analysis of virtual CISOs notes that simultaneous incidents across clients can limit timely attention. The organization still needs an internal champion and remains accountable for security events.
Because of those constraints, tie the SOW to outcomes you can see:
- Fewer surprises
- Faster escalation
- Clearer board decisions
- A 90-day plan with owners
Essential Elements of a Part-Time CISO SOW
Business Context, Objectives, and Success Measures
Start with the situation: new leadership, an audit, an incident, M&A, a customer requirement, or an immature program. Then set two to five objectives written as outcomes, such as a risk register, board reporting, clarified decision rights, or a prioritized remediation plan.
Attach a success measure to each objective: the evidence of completion and the person who approves it. Contract success criteria tend to work best as 6 to 12 items, with the rest held as a backlog rather than promises.
Scope of Services and Deliverables
Organize scope into workstreams:
- Governance and policy
- Risk management
- Compliance
- Security operations oversight
- Third-party risk
- Awareness
- Incident readiness
- Executive and board reporting
Name the actual deliverable for each. "Improve security" is not one. Concrete examples include:
- Current-state assessment
- Risk register
- Control roadmap
- Incident playbook
- Tabletop exercise
- Board briefing
For each workstream, state what the CISO will lead, advise on, review, or coordinate, and what stays with internal teams or vendors.
Time Commitment, Cadence, and Availability
Specify hours or days per month, the term, recurring meetings, board participation, and reporting deadlines. As a reference point, one community college's 2025 RFP requested up to 20 hours weekly during business hours, with monthly dashboards and quarterly reports. That is one buyer's specification, not a benchmark.
Many teams begin with heavier support in month one, then settle into a weekly rhythm. Define ordinary response times separately from emergency escalation. Never imply 24/7 availability unless the contract says so. Also cover unused hours, extra hours, travel, and expenses.
Roles, Decision Rights, and Dependencies
Name the key contacts: executive sponsor, board or committee contact, security and IT owners, legal and privacy, HR, procurement, and business owners.
Use a RACI matrix (responsible, accountable, consulted, informed) for:
- Patching
- Access management
- Incident response
- Vendor approval
- Risk acceptance
- Regulatory communications
List what the CISO cannot control:
- System access and staff availability
- Accurate asset inventories
- Vendor cooperation
- Budget approvals
- Timely executive decisions
Acceptance Criteria, Reporting, and Change Control
Define who reviews and accepts deliverables, how corrections work, and what happens when priorities shift. Use one consistent report in plain business language covering:
- Current posture
- What changed
- Top risks
- Decisions needed
- Overdue actions
- Trends
Add change control for new deliverables, scope shifts, more hours, or a major incident. New work should require a written impact on timeline, cost, and success criteria, with approval before it starts.
Part-Time CISO SOW Template
Copy the text below and replace bracketed items. Have legal counsel review the contractual, regulatory, employment, privacy, liability, and insurance language before signing.
Engagement Header and Purpose
Statement of Work No. [#] under the [Master Services Agreement dated ___] Client: [Name] | Provider: [Name] | Effective date: [Date] | Term: [Months] Executive sponsor: [Name, title] Organization description: [Brief] Business drivers: [Audit / M&A / new leadership / customer requirement / other] Governing documents: [MSA, NDA, policies]
Purpose. Provider will deliver part-time CISO leadership to help Client govern cybersecurity risk, improve reporting and decision-making, and prioritize remediation. Provider does not promise absolute security or elimination of cyber risk.
Scope, Workstreams, and Deliverables
Services (select all that apply): ☐ Security strategy ☐ Governance and policy ☐ Risk management ☐ Compliance ☐ Incident readiness ☐ Third-party risk ☐ Security awareness ☐ Executive reporting ☐ Board support
Phase 1 (Days 1-30): Current-state assessment and a prioritized 30/60/90-day plan with owners and dates. Phase 2 (Days 31-90): Execution of the approved plan.
Add a deliverables schedule:
| Deliverable | Description | Owner | Due date | Review party | Acceptance criteria | Dependencies |
|---|---|---|---|---|---|---|
| [Risk register] | [Ranked, business language] | [Name] | [Date] | [Name] | [Approved by sponsor] | [Asset inventory] |
Operating Model and Availability
Time commitment: [__ hours/month] Meetings: [Weekly check-in; monthly executive review; quarterly board] Channels: [Email, chat, video] Ordinary response time: [__ business hours] Emergency escalation: [Contact method, response target] After-hours support: [Excluded / limited to __] Backup coverage: [Approved substitute], subject to the same access, confidentiality, and authorization requirements. Subcontractors, automated tools, and AI tools: [Prohibited / permitted with written approval and data-handling conditions].
If AI tools are permitted, NIST AI 600-1 recommends covering content ownership, usage, security, and provenance in the contract.
Accountability, Access, and Boundaries
Access. Client will provide [systems, documents, staff] and accurate information. Access is limited to what is required; privileged access requires written approval; data is minimized.
Responsibility. Provider advises, coordinates, measures, and escalates risk. Named Client owners remain responsible for implementing controls unless this SOW expressly assigns the work.
Exclusions (unless separately contracted): penetration testing, 24/7 monitoring, legal advice, audit attestation, technical implementation, breach response leadership.
Commercial, Confidentiality, and Transition Terms
Fees: [Amount, fixed or hourly] | Invoicing: [Schedule] | Expenses: [Policy] | Taxes: [Treatment] Additional work: [Approved in writing via change control] Confidentiality: [Reference NDA]; data retention and deletion: [Terms] Work product: Client owns risk registers, roadmaps, board materials, and customized policies. Provider retains reusable methods, templates, and general know-how. Conflicts of interest: [Disclosure and conflict-check terms] Insurance: [Professional liability / cyber limits] | Indemnification: [Terms] Termination: [__ days' written notice] | Disputes: [Process]
Transition. On termination or when Client hires a full-time leader, Provider will give reasonable handoff support, document open risks and decisions, transfer accounts and access, and return credentials, configurations, and evidence files.
Ownership deserves explicit language. Under 17 USC 201 and 204, copyright initially vests in the author, and transfers generally require a signed writing. Do not assume you own the work product.
Also check worker classification with counsel. The IRS weighs behavioral control, financial control, and relationship type when deciding whether the part-time CISO is an employee or an independent contractor.
Set Accountability, Reporting, and Escalation Rules
Choose the Reporting Line
Pick the reporting line based on access, independence, authority, and reach to decision-makers. Do not choose one because it looks senior. In IANS's 2026 report of 662 CISOs, 64% reported into IT leadership and 36% into business leadership. That describes common arrangements, not what works best for fractional roles.
Define Escalation Thresholds
Write thresholds into the SOW for:
- Material incidents
- Overdue remediation
- Risk acceptance
- Regulatory notifications
- Customer commitments
- Decisions beyond the CISO's authority
Use a tiered model:
- Low risk can be accepted by management within policy
- Medium risk needs time-limited executive approval
- High risk (material outage, regulated exposure, brand damage) goes quickly to the CEO and board committee chair
Every exception needs a time limit, compensating controls, and a named owner.
For SEC registrants, Form 8-K disclosure is generally due four business days after a company determines an incident is material, and that determination must happen without unreasonable delay. Say who makes that call.
Standardize Board Reporting
Use a one-page format that separates risk ownership from risk oversight. Show:
- What changed
- What needs a decision
- Who owns the action
- When it will be revisited
Include 5 to 7 stable measures with trends.
How to Approve, Review, and Improve the SOW
Before Signing
Confirm that these are complete and internally approved:
- Objectives, deliverables, owners, and dates
- Hours and response expectations
- Exclusions and access
- Fees, confidentiality, insurance, and termination
Ask the proposed CISO to state assumptions, dependencies, conflicts, subcontractors, backup coverage, and the circumstances that would require extra work or a full-time hire.
During the Engagement
Hold formal reviews to compare delivered work against the SOW, reassess risks, and approve scope changes in writing. Review after the first phase, then on a regular cadence.
Track a short, stable set of indicators:
- Open high-priority risks
- Overdue decisions
- Remediation progress
- Incident-readiness actions
- Board and executive actions
Consider a full-time hire when you need daily executive presence, constant cross-team coordination, or support for heavy regulatory demand.
If your board or executive team needs help establishing fractional CISO accountability, talk with Tyson Martin, a CISSP-certified board advisor and interim or fractional executive, about a practical SOW and 90-day plan.
Frequently Asked Questions
What is the job description of a CISO?
A CISO leads cybersecurity strategy, governance, risk oversight, compliance coordination, incident readiness, and executive communication. A job description is broader and less deliverable-specific than an SOW.
What is a statement of work (SOW)?
An SOW is a document that specifies contracted services, deliverables, timelines, responsibilities, assumptions, acceptance criteria, and commercial or operational boundaries.
Who is responsible for information security: only IT, only the CISO, or every employee?
Every employee. The CISO provides leadership and oversight, but specific control responsibilities still need named owners.
What should be included in a statement of work for a part-time CISO?
Objectives, scope, deliverables, success measures, hours, availability, decision rights, and reporting. Add exclusions, confidentiality, ownership, fees, termination, and handoff.
How is a part-time CISO different from a full-time CISO?
The difference is mainly time and engagement structure, not strategic responsibility. The SOW must define availability, backup coverage, and the work that stays with internal teams.
How often should a part-time CISO SOW be reviewed?
Review after the first delivery phase, then on a recurring schedule. Make written changes whenever priorities, risk, regulations, incidents, staffing, or scope materially change.
