Transparent pricing. Senior execution.
Service products designed to match where your company is and what's driving urgency. Every engagement is scoped precisely with no retainer-for-retainer's-sake.
New to fractional CISOs? Read the guide — what it is, what it costs, and how it compares to a vCISO or full-time hire →
Security Program Maturity Review
A structured assessment with written findings and prioritized recommendations.
A structured one-hour review using a maturity checklist, with a high-level advance review of up to 10 pages of selected documents. You receive an indicative maturity snapshot and a one-page summary of your top three priority gaps and next steps. Detailed evidence validation, technical testing, and comprehensive audit readiness assessments are separately scoped.
Fee applies in full toward any retainer or sprint engagement signed within 30 days.
What's Included
- Structured session working through a security program maturity checklist across key control domains
- High-level advance review of up to 10 pages of selected policies, assessments, or audit excerpts
- Indicative maturity snapshot based on the discussion and selected documents
- One-page written findings summary delivered within 2 business days
Deliverables
- One-page findings summary: maturity snapshot, top three priority gaps, and recommended next steps
- Honest assessment of whether a larger engagement would add value and if needed, which one fits your situation
- A path forward that guides next steps in reaching your organizational security goals
Security Questionnaire Rescue
An enterprise deal stalled by a security questionnaire? Get senior security help drafting accurate, evidence-backed responses to SIG, CAIQ, CyberGRX, and customer questionnaires.
What's Included
- Questionnaire and deadline review with a fixed scope before kickoff
- Mapping existing policies and evidence to customer questions
- Response drafting and review with your technical owners
- Gap triage and agreed customer follow-up support
Deliverables
- Completed response draft for your approval and submission
- Evidence index and reusable answer library
- Prioritized gaps with recommended next steps
Fractional CISO Retainer
Ongoing security program leadership for technology companies that need a senior security executive — without the $300K full-time commitment.
What's Included
- Monthly security program status review and roadmap update
- Risk register review and prioritization
- Quarterly board or executive security reporting
- Security policy and procedure development
- Vendor security assessment and third-party risk management
- Incident response advisory and on-call guidance
- Compliance framework monitoring (SOC 2, ISO 27001, HIPAA, PCI DSS)
- Up to 2 hours ad-hoc advisory within the ~20 monthly hours; additional hours agreed in advance at $350/hr
Deliverables
- Written monthly security program status report
- Updated risk register with prioritized action items
- Executive security summary (board-ready on request)
SOC 2 / ISO 27001 Readiness Sprint
Readiness for one framework: SOC 2 or ISO 27001. Combined frameworks are quoted separately. External audit and certification fees, platform subscriptions, security tooling, and penetration testing are additional costs. Four consecutive SOC 2 Type II audits with zero exceptions — across two different organizations.
What's Included
- Gap assessment against SOC 2 TSC or ISO 27001:2022 controls
- Risk assessment and remediation roadmap
- Policy and procedure development for the agreed framework and scope
- Control design and documentation
- Audit evidence collection setup
- Auditor selection support
- Pre-audit internal readiness walkthrough
- One review of first audit findings and a remediation action plan, within agreed support hours and end date
Deliverables
- Gap Analysis Report with prioritized remediation roadmap
- Control Documentation Package
- Audit Readiness Report + Evidence Package
AI Security Governance Framework
EU AI Act obligations are arriving in phases, and many organizations still lack a mature AI security strategy. This engagement builds your framework before enterprise customers or auditors demand it.
What's Included
- AI tool and use case inventory across the organization
- Risk assessment against NIST AI RMF and EU AI Act requirements
- AI Acceptable Use Policy development
- Data governance controls for AI training and inference data
- Vendor AI risk assessment framework and questionnaire
- Executive and board briefing on AI risk posture
- Alignment mapping to applicable regulatory frameworks
Deliverables
- AI Use Case Registry
- AI Acceptable Use Policy (draft, ready for legal review)
- AI Risk Assessment Methodology
- Vendor AI Security Assessment Questionnaire
- Board-ready AI Risk Summary
Incident Response Planning & Tabletop Exercise
Cyber insurance now requires documented IR plans. This engagement builds the plan, assigns the roles, validates it with a live tabletop exercise, and delivers everything in 30 days or less.
What's Included
- Review or development of Incident Response Plan (NIST SP 800-61 aligned)
- Role and responsibility matrix development
- Communication templates (internal, customer, regulatory, media)
- Tabletop exercise design (2–3 hours with key stakeholders)
- Tabletop exercise facilitation
- Post-exercise gap analysis
Deliverables
- Complete Incident Response Plan
- Role assignment matrix and contact directory
- Communication templates package
- Post-exercise findings report with prioritized action items
Hourly Advisory
Senior security guidance when you need a specific question answered or a decision reviewed.
What's Included
- Any security topic within scope of expertise
- Written summary of recommendations upon request
- Follow-up questions via email for 5 business days after session
Deliverables
- Varies by engagement — discussed at booking
Board / Fractional Advisor
Security credibility and governance for early-stage startups that need to answer investor and customer security questions and do not have a full security program in place.
What's Included
- Monthly advisory session (2 hours) with preparation informed by your current priorities
- Monthly update to your security posture summary for board or investor use
- Prioritized action list and roadmap updates for future compliance needs
- Email guidance and review of selected questionnaire responses within the ~4 total monthly hours
Deliverables
- Monthly security posture summary for board or investor use
- Prioritized action list with recommended next steps
- Meetings, preparation, written updates, and between-session guidance share the ~4-hour monthly allocation; larger requests are scoped separately