The appointment owns
The fractional CISO sets the first risk priorities, reviews supplier and access decisions, and gives trustees a usable view of accepted and unresolved risk.
fractional executive recruitment
Hire Fractional CISO
Hire Fractional Chief Information Security Officer: give an external CISO recurring days to guide cyber risk, security priorities and board decisions while an internal team carries out daily work.
Brief us on this role →Chief Information Security Officer briefChoose a part of the brief
Part 01 / 04
Risk to reduce
Choose the service or information risk that needs executive security judgment first.
Part 02 / 04
Recurring decisions
Define the risk, supplier, control and board forums the CISO will lead on agreed days.
Part 03 / 04
Operating team
Name the IT, engineering and security people who implement between those days.
Part 04 / 04
Incident cover
Set monitoring, escalation and decision authority when the CISO is not scheduled.
Hire Fractional Chief Information Security Officer: what must the role own?
Choose the service or information risk that needs executive security judgment first.
Risk to reduceChoose the service or information risk that needs executive security judgment first.
Recurring decisionsDefine the risk, supplier, control and board forums the CISO will lead on agreed days.
Operating teamName the IT, engineering and security people who implement between those days.
Incident coverSet monitoring, escalation and decision authority when the CISO is not scheduled.
Role reference: NCSC Cyber Security Toolkit for Boards: risk management. The NCSC asks boards to set risk appetite, integrate cyber with business risk and see clear ownership and escalation. A fractional CISO can advise on that recurring work only when operational cover exists between their days.
What changes when the Chief Information Security Officer is fractional?
Fractional is an ongoing leadership pattern on agreed days. It does not provide round-the-clock incident command by itself. State who watches for events, who can act immediately and when the fractional CISO must be called.
fractionalChoose a part of the brief
Part 01 / 04
Days
Agree the recurring days and which decisions cannot wait for the next scheduled session.
Part 02 / 04
Authority
Give the leader clear decision rights on those days, rather than an advisory title without ownership.
Part 03 / 04
Cover
Name who handles urgent work between the agreed days.
Part 04 / 04
Review
Review the scope when the workload changes; do not assume the original pattern will always fit.
How would this work in a real brief?
The hiring decision becomes clearer when the work and its boundary are written down together.
Illustrative brief · a charity changing its member systems
A small IT team operates the systems, while the trustees need clear advice on access, suppliers and cyber risk. The security leadership work does not fill a full week.
The fractional CISO sets the first risk priorities, reviews supplier and access decisions, and gives trustees a usable view of accepted and unresolved risk.
Another owner retains
The IT lead runs daily systems and incident triage; trustees approve material risk decisions and an on-call owner can escalate an incident.
How should you assess Chief Information Security Officer candidates?
Put the same work and evidence in front of each candidate before comparing answers.
The evidenceChoose a part of the brief
Part 01 / 04
Risk ordering
Ask candidates to prioritise the same small set of access, supplier and recovery risks.
Part 02 / 04
Board advice
Test whether they can explain a residual risk and a choice of actions without security jargon.
Part 03 / 04
Between-day design
Ask what the internal team may decide without waiting for the next CISO day.
Part 04 / 04
Pattern review
Ask what evidence would justify more days, an interim or a permanent seat.
Acas recommends a consistent, fair selection process: choosing who to interview.
Does this hiring pattern fit the work?
Test the amount of the week, the expected end and the continuity needed before writing the contract.
The working pattern · fractional
A fractional Chief Information Security OfficerAn external executive owns a continuing remit on agreed days. Set the decision rights and cover between those days.
What must happen before the Chief Information Security Officer starts?
Agree the first risk decision the appointment must improve.
A clear startChoose a part of the brief
Part 01 / 04
Risk outcome
Agree the first risk decision the appointment must improve.
Part 02 / 04
Days and forums
Set recurring days and the board, risk and delivery meetings that need attendance.
Part 03 / 04
Cover
Name the incident and risk-decision owner between those days.
Part 04 / 04
Review
Check whether controls, ownership and escalation are improving the selected risk.
- 1
Risk outcome
Agree the first risk decision the appointment must improve.
- 2
Days and forums
Set recurring days and the board, risk and delivery meetings that need attendance.
- 3
Cover
Name the incident and risk-decision owner between those days.
- 4
Review
Check whether controls, ownership and escalation are improving the selected risk.
A useful Chief Information Security Officer brief names the decision, the working pattern and the evidence before it names a candidate.
What should the brief say?
Hire Fractional Chief Information Security Officer begins with risk to reduce, a stated working pattern and the evidence you will ask every candidate to show.
15 minutes · video or phone
Brief us on a Chief Information Security Officer
Tell us what the role must own, how it will work and when it must start.
- 01A brief built around the decisions and working pattern.
- 02A shortlist of 3–5 with pay or day rate, availability and IR35 position set out.
- 03Five-stage vetting before a candidate reaches you.
Pick a day that suits · live availability
