The January Renewal: What to Ask Your Fractional CISO

A lot of fractional CISO engagements run on the calendar year, which means the renewal conversation happens right about now, usually as an afterthought between the holidays. The proposal arrives, the price looks familiar, and the easiest thing is to sign.

Before you do, the renewal deserves four questions. Not an adversarial review; a working conversation about what the next year should look like. The answers tell you whether you are renewing a program or just renewing a habit.

Key takeaways

• Renewal season is the one natural lever you get all year. Use it.

• Ask what changed this year, and listen for evidence rather than activity.

• Ask what next year's plan is, and expect specifics with dates.

• Ask what they need from you; a one-way engagement drifts.

• Ask what happens if you leave. The answer tells you who owns your program.

Step 1: What changed this year?

The honest answer names outcomes: the incident process that now works, the training numbers that moved, the vendor review that actually happened. The weaker answer lists activity: meetings attended, documents produced, hours billed.

We wrote about the broader version of this checkup in is the engagement earning its keep. Renewal time is when that question gets asked with a signature pending, which concentrates the answers nicely.

Step 2: What is the plan for next year?

A good fractional CISO arrives at renewal with next year's priorities already sketched: what gets fixed first, what the board will see, what the year looks like quarter by quarter. If the plan is essentially this year repeated, ask why.

Repetition is sometimes right, especially in year two of a build. But it should be defended as a choice, not defaulted into.

Step 3: What do you need from us?

The best engagements are two-way. If your fractional CISO never asks anything of you, the engagement has quietly become a service you consume rather than a capability you are building.

Listen for specific asks: an hour of the owner's time monthly, a decision that has been pending, budget authority for a named fix. Those asks are a sign the engagement is alive.

Step 4: What happens if we leave?

Ask it directly. Who holds the documentation, the vendor relationships, the passwords and the program history if the engagement ends? A confident provider answers cleanly, because they have built the program to be yours.

An uncomfortable or evasive answer here is the single most useful piece of information the renewal conversation can produce. You are not planning to leave; you are checking who owns what you paid for.

Frequently asked questions

Is January really when these renew?

Many do, because engagements often start at the top of a year or after a fall incident. Check your agreement; the notice window is usually 30 to 60 days.

What if the answers are disappointing?

Disappointing answers are still valuable. They either start a fixing conversation with your current provider or inform the search for a different shape of help.

Should the board see the renewal review?

The conclusions, yes. If cyber oversight sits with the board, the state of the fractional engagement is part of what they oversee.

A practical next step

Before the renewal gets signed in the holiday rush, put the four questions on the calendar for a real conversation in early January. If the answers raise more questions than they settle, a Decision-Clarity Call is a good way to get an independent read.