The Fractional CISO Checkup: Is the Engagement Earning Its Keep?

The fractional CISO started in the spring with a scope, a day count and a list of outcomes. It is now November. The invoices have been paid on time, which is the one thing the company can say for certain about the engagement.

Fractional leadership works when it is steered. An engagement nobody reviews drifts toward whatever is easiest to deliver, and the board finds out at renewal time that a year of meetings produced a year of meetings.

Key takeaways

• An unreviewed fractional engagement quietly becomes a subscription.

• Compare the evidence to the outcomes named at the start, not to activity.

• Day count is a budget line, not a result. Ask what changed because the days were spent.

• The checkup has three honest outcomes: confirm, correct or conclude.

• Both sides should want this conversation. A good fractional leader brings the evidence first.

Step 1: Reopen the original expectations

Find the scope document or the email that started the engagement. What was supposed to be true by now: the risk register built, the response plan tested, the board reporting running, the vendor reviews done?

That list is the measuring stick. Without it, the checkup becomes a mood, and moods favor whoever is in the room.

Step 2: Lay evidence next to each expectation

For every promised outcome, ask for the artifact: the register, the test record, the briefing that went to the board. Evidence either exists or it does not. "We talked about it" is not the same as "here it is."

This fictional example shows the scorecard. It is an illustration, not a prescription.

The verdict column stays honest by staying boring: met, partial, not met.

Step 3: Ask what the days bought

The day count is the engagement's budget. Eight days a month should leave visible tracks: documents, decisions, meetings that changed something. Where the tracks are thin, either the days went to the wrong work or the work did not need doing. Both are checkup findings.

Step 4: Decide: confirm, correct or conclude

Confirm means the scope still fits and the evidence supports it. Correct means the work or the working relationship needs a specific change, recorded with a date. Conclude means the company has outgrown the arrangement or never fit it, and the honest move is a clean handover.

All three are good outcomes. The bad outcome is a fourth year of unexamined renewal.

If you are earlier in the journey, sizing the engagement in the first place is the companion piece to this one.

Frequently asked questions

Isn't this the fractional CISO's own job to report?

Reporting yes, judging no. Someone on the company side, the CEO or a director, has to compare the evidence to the original expectations. A vendor grading its own engagement is a conflict the checkup exists to avoid.

What if the evidence is genuinely thin?

Thin evidence is a finding, not an insult. The correction might be scope, cadence or fit. What matters is that the conversation happens now, in writing, rather than at an awkward renewal.

How is this different from a performance review?

It reviews the engagement, not the person. The question is whether this arrangement, as scoped and steered, is producing the outcomes the company bought. Sometimes the fix is the company's own participation.

When in the year should this happen?

Late enough to have evidence, early enough to shape next year. November or December fits most engagements and lines up with planning season.

A Defensible Next Step

Pull the original scope and ask for the evidence against each line before the renewal conversation. If you are the fractional leader, bring the scorecard first; it is the strongest retention argument there is. Book a Decision-Clarity Call if you want a neutral read on the engagement.