Part-Time Chief information security officer services

Part-Time CISO Services · a part-time CISO, briefed and shortlisted

Part-Time CISO services put a part-time chief information security officer into your business on set days each week.

The CISO owns cyber and information security risk: the strategy, the controls, the incident plan and the board’s understanding of the risk.

This page sets out what the service covers, when part-time is the right shape, what the market publishes on rates, and how we come back with a shortlist of 3–5, each with rate, availability and IR35 position set out.

Submit a brief → →

How a brief runswhat we undertake

01Brief30-MINUTE SCOPING CALLDay 0
02Shortlist of 3–5VETTED · RATE BENCHMARK · IR35After the brief
03InterviewsYOU MEET THE SHORTLISTYour diary
04Scoped startFIRST-MONTH OUTCOMES AGREEDYou set the date
05Fractional, interim and permanentIR35 POSITION SET OUTOn every brief

Shortlist3–5

£96,250–£161,750

Permanent salary · Robert Half 2026 · pro rata for part-time

Set days, one employer

Commitment

15 minutes · video or phone

Book 15 minutes to hire a part-time CISO

Tell us the scope and the days a week. We come back with Part-Time CISO Services candidates, their day rates and availability.

0115 minutes, video or phone
02We scope the role and the days a week
03A shortlist of 3–5 after the call
04Fractional, interim and permanent briefs

Prefer email? Use the booking page →

Pick a day that suits · live availability

Open the booking calendar →

01/ the role

What part-time CISO services cover

A part-time CISO works set days each week for one organisation.

A part-time CISO works fixed days each week, suited to a business that holds sensitive data and wants the same security lead embedded long term.

The service covers the information security strategy and risk register, security policies, controls and certification such as Cyber Essentials or ISO 27001, incident response planning and exercises, and supplier and third-party security assurance and board reporting on cyber risk.

If you are weighing the options, the same seat is also bought as fractional CISO services, interim CISO services, virtual CISO services, or a permanent hire, set out on the CISO services hub.

What the seat does day to day is set out in the CISO role explained; executives looking for this work can see current CISO roles; the full cost picture is on the CISO cost guide.

02/ scope

What is in scope — and what is not

In scope

The information security strategy and risk register; security policies, controls and certification such as Cyber Essentials or ISO 27001; incident response planning and exercises; supplier and third-party security assurance; board reporting on cyber risk.

Not in scope

Hands-on security operations, monitoring and penetration testing are usually delivered by an engineering team or a managed provider; the CISO directs and assures them.

CISO or a neighbouring seat?

The CISO owns security risk; the CIO owns systems.

Keeping them separate gives the board an independent view of risk.

The scoping test: write down the three decisions you need the CISO to own in the next ninety days. If you cannot, you are not ready to brief.

03/ the week

How a week divides.

Part of a week is the point of the model: the days you buy are yours, the rest of the week goes to other clients. Move the days a week and the week redraws.

Days a week for your company2 days

Your companyAnother clientA third client

Mon

Tue

Wed

Thu

Fri

Illustration only: one way a part-time CISO’s week can divide at 2 days a week for you. Each block is half a day.

04/ the route

Fractional, interim or permanent?

Four taps. The answer names the route for the seat and the page that covers it.

How much of the week does the work fill?

Is there a fixed end or a programme?

Does the seat sit on the board for years?

Is the need now, or can it wait for a search?

The route · Fractional

A fractional CISO services.

The work fills part of the week, so buy the days it needs.

A fractional CISO services holds the seat on agreed days for as long as the seat is needed, and works for other clients on the rest.

The fractional CISO services route Talk it through

05/ rates by stage

CISO rates what the published benchmarks say

Every figure is the named source’s own published band. Fractional Quest publishes no fees: each candidate on a shortlist states their own rate. A part-time employee is usually paid the permanent salary pro rata to the days worked; a part-time contractor is paid by the day.

BenchmarkPublished figureSource

Fractional CISO day rate£1,200–£2,000Optima Europe

Interim CISO day rate£1,000–£1,500Barclay Simpson

Permanent CISO salary (25th–75th percentile)£96,250–£161,750Robert Half 2026

06/ comparison

Four ways to buy a CISO fractional, interim, part-time or permanent

The same CISO seat can be filled four ways. The difference is commitment, contract and how long you need it.

FractionalInterimPart-timePermanent

CommitmentDays a week, ongoingFull-time, fixed termSet days each weekFull-time, open-ended

Usual contractContract for services, often via the executive’s companyDay-rate contract for the mandateOften pro-rata employment; sometimes a contractorEmployment contract

Clients at onceA small portfolioOneOneOne

Best whenYou need CISO judgement every week, not every dayYou need full-time cover or a change led nowYou want the same person on the same days for the long termThe seat is full-time work for years

ExitNotice period, or convert to permanentHand-over at the end of the mandateEmployment noticeResignation or redundancy

07/ timing

When part-time CISO services are the right call

Three situations where the part-time shape beats the alternatives.

Scenario 01

Steady state

The same person, the same days

A part-time CISO works fixed days each week, suited to a business that holds sensitive data and wants the same security lead embedded long term.

Scenario 02

Scope

A defined weekly load

The work — the information security strategy and risk register, supplier and third-party security assurance — is regular and predictable, so a fixed pattern of days covers it.

Scenario 03

Retention

Senior people who want fewer days

Many experienced chief information security officers choose part-time work for the long term; a part-time role can attract someone a full-time salary could not.

08/ vetting

How we vet the shortlist

Five stages: qualification, mandate fit, reference deep-dive, shortlist and analysis, kick-off.

01
Qualification screen
Verify Part-Time CISO Services tenure, sector context and stage fit.
SOURCING
02
Mandate fit
Match to your situation — stage, board dynamics, timing.
MATCHING
03
Reference deep-dive
We take references ourselves, from recent past clients — real outcomes, not titles.
VERIFY
04
Shortlist
Three to five candidates with day rate, availability and IR35 position set out.
SHORTLIST OF 3–5

09/ how it runs

How a part-time CISO engagement runs from brief to hand-over

Brief.

You tell us the scope, the days each week and the start date, and what success looks like in the first ninety days.

A clear brief names the decisions the CISO will own.

Shortlist.

We come back with 3–5 part-time chief information security officers against the brief, each with day rate or salary expectation, availability and IR35 position set out, assessed through our five-stage vetting.

Rhythm.

A part-time CISO works best with the same days every week, so the team knows when decisions get made.

Agree in writing which meetings fall on their days and how urgent issues are handled on the others.

Hand-over.

If the seat grows into full-time work, the part-time CISO can help recruit the permanent successor, or convert themselves.

10/ before you sign

Before you buy part-time CISO services three checks

Standing.

Check professional standing and references before you sign: what the board should expect from its security lead; see the NCSC Cyber Security Toolkit for Boards.

Status.

Decide whether the role is employment or a contract for services, and write the contract to match how it will actually run.

Scope.

Write down what is out of scope.

Hands-on security operations, monitoring and penetration testing are usually delivered by an engineering team or a managed provider; the CISO directs and assures them.

11/ questions

Part-Time CISO services FAQ

The questions people ask before bringing in a part-time CISO.

The CISO seat’s full scope: the information security strategy and risk register; security policies, controls and certification such as Cyber Essentials or ISO 27001; incident response planning and exercises; supplier and third-party security assurance; board reporting on cyber risk. Hands-on security operations, monitoring and penetration testing are usually delivered by an engineering team or a managed provider; the CISO directs and assures them.

A part-time CISO on an employment contract is usually paid the permanent salary pro rata. Robert Half 2026 puts the permanent band at £96,250–£161,750 (25th–75th percentile). Each candidate on our shortlist states their own rate or salary expectation.

An interim CISO works full-time for a fixed term, usually to cover a gap or lead a change. A part-time CISO works set days each week for one organisation, for as long as the business needs it.

A customer security questionnaire you cannot answer, a tender requiring certification, an incident, or an insurer or investor asking who owns cyber risk. Part-time is the right shape when the workload is steady and you want the same person long term.

A part-time CISO on your payroll is an employee, so IR35 does not arise. If they work through their own company, the off-payroll rules apply as for any contractor: for medium and large clients the client makes the status determination.

You brief us on the scope, the days and the start date. We come back with a shortlist of 3–5 part-time chief information security officers, each with day rate or salary, availability and IR35 position set out, assessed through our five-stage vetting.

Book 15 minutes · shortlist of 3–5

Bring the brief. We architect the team.

A shortlist of 3–5 with day rate, availability and IR35 position set out, after five-stage vetting.

Book a call →Submit a brief