Scoping a Fractional CISO Engagement: Hours, Deliverables, Handoffs

The fractional CISO engagement starts with goodwill on both sides and a scope that says something like 'provide security leadership.' Six months later, both sides are quietly frustrated: the company expected a program, the CISO expected an advisory role, and nobody can point to the document that would settle it, because the document never said.

Fractional work fails on scope the way custom software fails on requirements: the ambiguity is invisible at signature and expensive at month six. The hours get consumed by whatever is loudest, the deliverables drift, and the engagement's real value - senior judgment applied to the right things - dissolves into availability.

The fix is a one-page scope built on three honest numbers: the hours, the deliverables, and the handoffs. Here is how to write it.

Key takeaways

• Fractional engagements fail on vague scope, not vague talent.

• Define the hours as a rhythm: what happens weekly, monthly, quarterly.

• Name the deliverables as artifacts: documents, reviews, meetings - not 'leadership.'

• Decide the handoffs: what the CISO advises on versus owns versus never touches.

• Revisit the scope at ninety days; the first version is a hypothesis.

Step 1: Define the hours as a rhythm, not a number

'Ten hours a month' is not a scope; it is an invoice line. The workable version is a rhythm: a weekly hour with the IT lead, a monthly leadership review, a quarterly board summary, plus a stated allowance for the unexpected. The rhythm tells everyone when the CISO's judgment will be applied and protects the hours from erosion by calendar creep.

The unexpected needs its own line. Incidents and urgent customer questionnaires will consume fractional hours first; decide in advance whether they draw from the monthly rhythm or arrive as additional time, or the first busy month rewrites the engagement by accident.

This fictional example shows one company's rhythm. It is an illustration, not a prescription.

Cadence	What happens	Hours
Weekly	IT lead working session	1
Monthly	Leadership security review	2
Quarterly	Board summary + program planning	4
As needed	Incidents, urgent questionnaires	up to 6/mo, flagged

Step 2: Name the deliverables as artifacts

'Security leadership' is unmeasurable; artifacts are not. The first ninety days should name its documents and events: the risk register, the incident plan refresh, the customer questionnaire library, the board summary. Each has a date and a definition of done.

After the first quarter, the deliverables shift from building to running: the quarterly reviews held, the access review completed, the tabletop run. The scope page should say both, so month six can be compared to month six's promise.

The artifact list is also the defense against the two classic failure modes: the engagement that becomes an on-call advice line with nothing to show, and the one that becomes a document factory nobody reads. The rhythm uses the artifacts; the artifacts feed the rhythm.

Step 3: Draw the handoff lines explicitly

The most important column on the scope page is who does the work. The fractional CISO advises, decides, and reviews; the doing - patching, configuring, onboarding users - belongs to the IT team or provider. Blur this line and you pay executive rates for technician hours, or worse, nobody is sure who holds the wrench at 2 a.m.

Write three columns: what the CISO owns, what they advise on, and what they never touch. The never-touch column is as valuable as the others; it keeps the engagement's boundaries honest and the liability clear.

The evaluation criteria in assessing a fractional CISO before hiring presuppose exactly this clarity - scope is where the interview promises become operational.

Step 4: Re-scope at ninety days

Treat the first scope as a hypothesis. At ninety days, hold the explicit review: did the rhythm hold, did the artifacts land, which activities consumed the hours that were meant for something else?

Adjust in writing. The engagement that cannot be re-scoped is either perfectly estimated - unlikely - or drifting. The honest ninety-day conversation is also where both sides decide what the relationship is actually for, with evidence instead of impressions.

That review is a small version of the same discipline in deciding between fractional and full-time help: the answer changes as the company does, and the scope should be allowed to change with it.

The related discussion of assessing a fractional CISO before hiring is worth your time alongside this one. The related discussion of fractional and full-time help is worth your time alongside this one.

Frequently asked questions

How many hours does a typical fractional engagement need?

For a small or mid-size company, eight to twenty hours a month covers most rhythms: the weekly session, the monthly review, the quarterly board work, and a modest buffer. Far less becomes purely advisory; far more starts to look like a part-time hire.

Should the fractional CISO have admin access?

Rarely. Review access - the ability to see configurations and reports - is usually enough. The doing belongs to the operational team, both for cost and for clean accountability when something changes.

What is the sign the scope is wrong?

The monthly surprise: hours consumed by things nobody chose, deliverables nobody remembers promising, and a vague sense of value on both sides. That is the scope asking to be rewritten, not the talent asking to be replaced.

A Defensible Next Step

If you have a fractional CISO - or are about to sign one - write the one-page scope this week: the rhythm, the artifacts, the three handoff columns. The engagement it saves will be your own. Book a Decision-Clarity Call if you want the scope built together.