Hourly, monthly or project: choosing a vCISO engagement model

The three shapes

A fractional CISO offer usually takes one of three forms: an hourly retainer with no minimum, a monthly retainer with a set number of days each week, or a fixed-scope project such as SOC 2 readiness with a start and end date.

Hourly retainers feel safe to a buyer watching budget. In practice the vCISO shows up when something is on fire, and the planned work waits. Six months in, the program has moved very little.

Projects fit work with a clear finish line. SOC 2 readiness is a project. An incident review is a project. Running a security program is ongoing work, and it needs a regular slot in the calendar.

When a monthly retainer is the better fit

For most SaaS companies with 50 to 200 employees, a monthly retainer with a fixed weekly day works best. The fixed day means roadmap work happens on schedule. The vCISO is in your leadership meeting each week, writes your policies, and answers prospect questionnaires.

The risk with retainers is scope creep. A good contract names the weekly scope and says how extra days are added during audit preparation, a big customer review or an incident.

Questions to ask on the first call

What does a typical week with you look like? If the answer is "it depends", you are buying an hourly model.

A questionnaire lands on Friday and is due Monday. Who answers it, who reviews it, and by when?

What happens if we hire a full-time CISO? Look for a short exit clause and an offer to help with the hire.

Will you be the person doing the work? Ask to meet whoever will attend your weekly meeting.