How Many Days a Month? Sizing a Fractional CISO Engagement

The first commercial question about a fractional CISO is usually the wrong one: what is the day rate? The question that determines whether the engagement works is how many days a month the job actually takes.

Too few days and the fractional leader becomes an expensive advisor who attends meetings but moves nothing. Too many and you are paying executive rates for work a manager should own.

Size the engagement from the decisions and deliverables that need security leadership, then buy exactly that many days.

TLDR

• Count the recurring decisions and deliverables first; days follow from them.

• Separate steering work, which needs the fractional leader, from production work, which needs staff or a provider.

• Expect a heavier first 60 to 90 days, then a steady state.

• Put the day count in writing with what it buys, and revisit it quarterly.

• If every question waits for the fractional CISO's day on site, the model is under-sized or mis-scoped.

Start from the decisions, not the calendar

List what actually needs security leadership in a typical month: the risk decisions that need a recommendation, the board or executive reporting, the vendor and architecture reviews, the incident escalations, and the program deliverables like assessments and policy updates.

NIST's work on integrating cybersecurity and enterprise risk management treats risk ownership and accountability as explicit assignments. A fractional engagement works the same way: the leader's days should map to named accountabilities, not a vague retainer.

Separate steering from production

A fractional CISO steers: setting risk direction, advising executives, reviewing the exceptions that matter, and representing security in board and customer conversations. Production work - running scans, maintaining the ticket queue, chasing evidence - belongs to internal staff or a managed provider.

Engagements fail when the day count silently includes production. Either the senior person burns expensive days on junior work, or the production work simply does not happen and the program quietly rots.

A fictional sizing example

This fictional example sizes a steady-state engagement for a mid-market company with a small internal IT team and a managed detection provider. It is an illustration, not a quote.

Activity	Days per month
Executive and board reporting, risk decisions	2
Program steering: assessments, exceptions, roadmap	2
Vendor, customer and audit security requests	1
Incident readiness and escalation availability	1
Total steady state	6

The first 60 to 90 days usually run heavier, often double, while the leader baselines the program, closes urgent gaps, and sets the operating rhythm. Plan and price that surge explicitly.

Review the sizing quarterly

The right day count moves. A funding round, an acquisition, a big customer audit, or an incident all change the load. Put the day count and what it buys in the engagement letter, and review it quarterly against what actually got consumed.

The tell for a mis-sized engagement is queueing: if vendor reviews, exception decisions, and board answers all wait for the two days a month the CISO is in, the business has already decided to accept the delay. It just has not admitted it.

The related discussion of signs you need fractional CISO services is worth your time alongside this one.

Frequently asked questions

Is there a typical number of days?

For a mid-market company with basic hygiene in place, steady-state engagements commonly land in the four-to-eight-days-a-month range, with a heavier first quarter. The spread is wide because the deciding factors are decision load and internal capacity, not company size alone.

Can a fractional CISO own incident response?

They can lead it, but availability has to be contractual and tested. If the engagement is two scheduled days a week, define how escalation reaches them at 2 a.m. on an off day, and who holds interim authority.

When should a fractional role become a full-time hire?

When the steady-state day count keeps climbing past roughly half time, when decisions queue for the leader's days, or when the program's production work has no home. Those are signs the job has outgrown the model.

A Defensible Next Step

Write down the decisions and deliverables that need security leadership next quarter, and count the days they honestly take. That number is the engagement. Book a Decision-Clarity Call if you want a second pair of eyes on the sizing.