Chief information security officer services · fractional, interim, part-time, permanent

CISO Services · fractional, interim, part-time and permanent

CISO services come in four shapes: fractional, interim, part-time and permanent.

The CISO owns cyber and information security risk: the strategy, the controls, the incident plan and the board’s understanding of the risk.

This hub sets out what the seat covers, which shape fits which situation, and what the market publishes on rates.

Each route has its own page; every brief gets a shortlist of 3–5 with rate, availability and IR35 position set out.

Submit a brief → →

How a brief runswhat we undertake

01Brief30-MINUTE SCOPING CALLDay 0
02Shortlist of 3–5VETTED · RATE BENCHMARK · IR35After the brief
03InterviewsYOU MEET THE SHORTLISTYour diary
04Scoped startFIRST-MONTH OUTCOMES AGREEDYou set the date
05Fractional, interim and permanentIR35 POSITION SET OUTOn every brief

Shortlist3–5

£1,200–£2,000

Fractional day rate · Optima Europe

£1,000–£1,500

Interim day rate · Barclay Simpson

£96,250–£161,750

Permanent salary · Robert Half 2026

15 minutes · video or phone

Book 15 minutes to hire a CISO

Tell us the scope and the days a week. We come back with CISO Services candidates, their day rates and availability.

0115 minutes, video or phone
02We scope the role and the days a week
03A shortlist of 3–5 after the call
04Fractional, interim and permanent briefs

Prefer email? Use the booking page →

Pick a day that suits · live availability

Open the booking calendar →

01/ the role

What CISO services cover

The CISO owns cyber and information security risk: the strategy, the controls, the incident plan and the board’s understanding of the risk.

In scope: the information security strategy and risk register; security policies, controls and certification such as Cyber Essentials or ISO 27001; incident response planning and exercises; supplier and third-party security assurance; board reporting on cyber risk.

Hands-on security operations, monitoring and penetration testing are usually delivered by an engineering team or a managed provider; the CISO directs and assures them.

What the seat does day to day is set out in the CISO role explained; executives looking for this work can see current CISO roles; the full cost picture is on the CISO cost guide.

02/ scope

Four ways to buy the CISO seat

Fractional CISO services

A fractional CISO holds the CISO seat on a standing weekly commitment, usually alongside a small number of other clients, and owns outcomes rather than hours.

A fractional CISO, often called a virtual CISO, gives a business a named security leader on a standing weekly commitment: the strategy, the policies and the board conversation, with operations delivered by the team or a provider.

Fractional CISO services sets out the scope, the rates and how we shortlist.

Interim CISO services

An interim CISO works full-time for a fixed term to cover a gap, lead a change or see a transaction through, then hands over.

Interim executives are hired for immediate impact: they expect to take decisions from the first week.

Interim CISO services sets out the scope, the rates and how we shortlist.

Part-Time CISO services

A part-time CISO works set days each week for one organisation.

A part-time CISO works fixed days each week, suited to a business that holds sensitive data and wants the same security lead embedded long term.

Part-Time CISO services sets out the scope, the rates and how we shortlist.

Permanent CISO

A permanent CISO is right for regulated firms, businesses holding large volumes of personal or payment data, and groups where security is a board-level standing risk.

Virtual CISO services

Sold as outsourced CISO: a provider or a named individual off your payroll.

See virtual CISO services.

03/ the route

Fractional, interim or permanent?

Four taps. The answer names the route for the seat and the page that covers it.

How much of the week does the work fill?

Is there a fixed end or a programme?

Does the seat sit on the board for years?

Is the need now, or can it wait for a search?

The route · Fractional

A fractional CISO services.

The work fills part of the week, so buy the days it needs.

A fractional CISO services holds the seat on agreed days for as long as the seat is needed, and works for other clients on the rest.

The fractional CISO services route Talk it through

04/ rates by stage

CISO rates what the published benchmarks say

Every figure is the named source’s own published band. Fractional Quest publishes no fees: each candidate on a shortlist states their own rate.

BenchmarkPublished figureSource

Fractional CISO day rate£1,200–£2,000Optima Europe

Interim CISO day rate£1,000–£1,500Barclay Simpson

Permanent CISO salary (25th–75th percentile)£96,250–£161,750Robert Half 2026

05/ comparison

Four ways to buy a CISO fractional, interim, part-time or permanent

The same CISO seat can be filled four ways. The difference is commitment, contract and how long you need it.

FractionalInterimPart-timePermanent

CommitmentDays a week, ongoingFull-time, fixed termSet days each weekFull-time, open-ended

Usual contractContract for services, often via the executive’s companyDay-rate contract for the mandateOften pro-rata employment; sometimes a contractorEmployment contract

Clients at onceA small portfolioOneOneOne

Best whenYou need CISO judgement every week, not every dayYou need full-time cover or a change led nowYou want the same person on the same days for the long termThe seat is full-time work for years

ExitNotice period, or convert to permanentHand-over at the end of the mandateEmployment noticeResignation or redundancy

06/ timing

Which shape fits your situation

Match the shape to the work, not the title.

Scenario 01

Weekly judgement

Fractional

You need a CISO to own decisions every week, but the work does not fill five days.

A customer security questionnaire you cannot answer, a tender requiring certification, an incident, or an insurer or investor asking who owns cyber risk.

Scenario 02

Now, full-time

Interim

An incident has happened or nearly happened.

An interim CISO leads the response, the remediation and the regulator and customer conversations.

Scenario 03

Long term

Part-time or permanent

A part-time CISO works fixed days each week, suited to a business that holds sensitive data and wants the same security lead embedded long term.

A permanent CISO is right for regulated firms, businesses holding large volumes of personal or payment data, and groups where security is a board-level standing risk.

07/ vetting

How we vet the shortlist

Five stages: qualification, mandate fit, reference deep-dive, shortlist and analysis, kick-off.

01
Qualification screen
Verify CISO Services tenure, sector context and stage fit.
SOURCING
02
Mandate fit
Match to your situation — stage, board dynamics, timing.
MATCHING
03
Reference deep-dive
We take references ourselves, from recent past clients — real outcomes, not titles.
VERIFY
04
Shortlist
Three to five candidates with day rate, availability and IR35 position set out.
SHORTLIST OF 3–5

08/ before you brief

Before you buy CISO services what to decide first

The decisions.

Write down the three decisions the CISO will own in the next ninety days.

That list decides the shape: weekly decisions point to fractional, a time-bound programme to interim, a steady load to part-time.

The neighbours.

The CISO owns security risk; the CIO owns systems.

Keeping them separate gives the board an independent view of risk.

The checks.

What the board should expect from its security lead: see the NCSC Cyber Security Toolkit for Boards.

For a contractor engagement, agree how it will run in practice, because that decides IR35 status; HMRC’s guidance for clients sets out who makes the determination.

09/ questions

CISO services FAQ

The questions people ask before bringing in a CISO.

Ways of filling the CISO seat without, or before, a permanent hire: fractional (days a week, ongoing), interim (full-time, fixed term) and part-time (set days, one employer), alongside a permanent search. The CISO owns cyber and information security risk: the strategy, the controls, the incident plan and the board’s understanding of the risk.

Fractional when you need CISO judgement every week but not every day; interim when you need full-time cover or a change led now; part-time when the load is steady and you want the same person long term; permanent when the seat is full-time work for years.

Published UK bands: Fractional CISO day rate £1,200–£2,000 (Optima Europe); Interim CISO day rate £1,000–£1,500 (Barclay Simpson); Permanent CISO salary (25th–75th percentile) £96,250–£161,750 (Robert Half 2026). Fractional Quest publishes no fees; each candidate on a shortlist states their rate.

Hands-on security operations, monitoring and penetration testing are usually delivered by an engineering team or a managed provider; the CISO directs and assures them.

You brief us on scope, shape and start date. We come back with a shortlist of 3–5, each with rate, availability and IR35 position set out, assessed through our five-stage vetting.

Book 15 minutes · shortlist of 3–5

Bring the brief. We architect the team.

A shortlist of 3–5 with day rate, availability and IR35 position set out, after five-stage vetting.

Book a call →Submit a brief