Skip to content
CISO Spotlights

Glossary

What is a fractional CISO? A part-time security chief on contract, defined

A fractional CISO fills the chief information security officer role part time, on an ongoing contract. How rules treat it and how it differs from interim or vCISO.

Term: Fractional CISO · also part-time CISO, vCISO, virtual CISO

By the CISO Spotlights Desk · Published · 3 sources

A fractional CISO is a security executive who fills the chief information security officer (CISO) role for an organization part time, on an ongoing contract and often alongside other clients. It is an arrangement for organizations that need the role's judgment and accountability without a full-time seat, and for executives who choose to run a portfolio of security leadership engagements.

How regulators treat an outsourced security chief

Two US rules address the arrangement directly. Both accept that the person in the role need not be on the payroll, and both keep the accountability inside the organization. The Federal Trade Commission's Safeguards Rule, as amended on 9 December 2021, says the designated "Qualified Individual" may be employed by the business, an affiliate or a service provider. If a provider fills the role, the business keeps responsibility for compliance, names a senior member of its own staff to direct and oversee that person, and requires the provider to maintain a protective security program.

New York's 23 NYCRR Part 500 applies the same structure to the CISO of a covered financial firm, who may be employed by a third-party service provider. The smallest covered firms, including those with fewer than 20 employees and independent contractors, are exempt from the CISO requirement altogether, which leaves a part-time arrangement as a choice rather than an obligation.

For a public company, Item 106 of Regulation S-K asks whether the registrant engages consultants or other third parties in its cyber risk processes, and which management positions are responsible. A fractional arrangement shows up in a 10-K through those two questions.

Fractional, virtual and interim

Fractional and virtual CISO (vCISO) are often used interchangeably: virtual stresses remote or service delivery, fractional the share of one person's time. An interim CISO is different in purpose: the engagement exists to cover a vacancy and ends when a permanent chief arrives. A fractional engagement has no vacancy behind it and can run for years.

What it means in a career

For the executive, fractional work trades one employer for several, which changes how a career reads. A person can hold security leadership responsibility at more than one organization at once, and the title each client uses may differ. This site records whatever title and employer the source states, so a fractional engagement appears on a profile in the source's own words.

Where it appears on cisospotlights.com

Related terms

Interim CISO, head of security and security leadership titles.

Sources

  1. 1.
    Federal Trade Commission, Safeguards Rule, 16 CFR 314.4 (eCFR)ecfr.gov · published 13 November 2023 · tier A
  2. 2.
    New York State Department of Financial Services, 23 NYCRR Part 500 (Second Amendment)dfs.ny.gov · published 1 November 2023 · tier A
  3. 3.
    U.S. Securities and Exchange Commission, Regulation S-K Item 106 (eCFR)ecfr.gov · published 4 August 2023 · tier A

Tier A: the organization itself, a regulator or a government page. Tier B: established trade or business press.

Cite this definition as “CISO Spotlights glossary” with a link to this page. See an error? Request a correction.