Advisory
Fractional CISO Services, and What They Cost
Many organizations need security judgment more than they need another security tool. Fractional leadership provides experienced direction at the level of engagement the organization actually requires.
Fractional Security Leadership
Direction, prioritization, and translation
A full-time security executive is a significant commitment, and many organizations are not at the point where the role is justified. What they are missing is not headcount. It is someone accountable for deciding what to do first, saying no to the wrong investments, and explaining security posture to people who do not work in security.
Fractional security leadership fills that gap. The engagement can be scoped as ongoing advisory time, a defined project, or interim coverage during a transition, and it works alongside your existing IT team, MSP, or internal security staff rather than replacing them.
Independent by design. Craft Consulting Solutions is a consulting company, not a security-product reseller. Recommendations are based on your risk and technical requirements rather than on the need to sell a particular platform.
Because the same practice performs hands-on technical testing, advisory recommendations stay grounded in how systems are actually attacked, not only in what a framework says should exist.
Scope
What fractional leadership covers
Engagements are assembled from the areas where you need coverage. Few organizations need all of them at once.
- Cybersecurity strategy
- Security governance
- Risk management
- Security budgeting
- Security roadmap development
- Executive reporting
- Board reporting
- Vendor risk
- Security project oversight
- Security architecture
- Vulnerability management
- Incident-response planning
- Security metrics
- Security awareness
Defined Engagements
Advisory services delivered as discrete projects
If ongoing advisory time is not the right fit, these engagements have a clear beginning, end, and deliverable.
01
Security Roadmap Development
A sequenced, budgeted plan that turns a list of gaps into a program. The roadmap establishes what happens in the next quarter, the next year, and the year after, with dependencies made explicit and effort estimated realistically against the resources you actually have.
- Current-state baseline
- Prioritized initiative sequencing
- Effort and budget estimation
- Dependency and resourcing analysis
- Executive-ready summary
02
Policy & Governance Development
Security policies, standards, and procedures written to fit how your organization actually operates. Policy that nobody follows creates audit risk without reducing security risk, so documents are scoped to what can genuinely be enforced.
- Policy set development and revision
- Standards and procedures
- Roles and accountability
- Exception and risk-acceptance process
- Governance cadence and oversight
03
Vendor / Third-Party Risk Management
A workable process for evaluating the security of vendors and partners, sized to your organization. Includes support on both sides of the questionnaire: assessing your vendors, and responding credibly when your customers assess you.
- Vendor risk process design
- Assessment criteria and tiering
- Contract and security-requirement review
- Ongoing monitoring approach
- Customer security questionnaire support
04
Incident Response Planning
An incident response plan that works under pressure: defined roles, decision authority, escalation criteria, communication paths, and the specific playbooks for the incident types most likely to affect your environment.
- Incident response plan development
- Roles, authority, and escalation
- Scenario playbooks
- Internal and external communication
- Legal, insurer, and regulatory touchpoints
05
Cybersecurity Tabletop Exercises
Facilitated, scenario-driven exercises that put the plan in front of the people who would have to execute it. Exercises can be run for technical responders, for executive decision-makers, or for both together.
- Scenario design for your environment
- Technical and executive sessions
- Injects and decision points
- Observations and gap analysis
- Post-exercise action plan
06
Executive & Board Reporting
Security reporting that a non-technical audience can act on: posture, trend, material risks, what is being done about them, and what decisions are being asked of the board. Includes support in the room when that helps.
- Board and executive materials
- Security metrics that mean something
- Risk register and treatment reporting
- Investment justification
- Meeting participation
Ongoing advisory
A recurring commitment measured in days per month, with continuity across quarters and a standing point of contact for security decisions.
Defined project
A roadmap, policy set, incident response plan, or tabletop exercise delivered as a discrete engagement with a fixed scope.
Interim coverage
Bridge support during a leadership transition, a major initiative, or a period of elevated scrutiny from customers or insurers.
Retainers
Ongoing advisory, priced in public
Fractional leadership is a commitment of time, so it is priced as one: a set number of days each month at a published monthly rate. Defined projects and interim coverage are quoted individually against the same rates.
Advisory
$2,500 per month · 1 day per month
A standing security advisor for organizations that mostly need judgment on call: the questions that arrive from a customer, an insurer, or the board, answered by someone who already knows your environment.
What it covers
- Named point of contact for security decisions
- Review of policies, vendors, and proposed changes
- Customer and insurer security questionnaire support
- Quarterly posture summary suitable for leadership
Commonly bought by: Organizations with competent IT and no security owner.
Fractional
$4,500 per month · 2 days per month
Ownership of the security program rather than commentary on it. Sets the roadmap, drives it between sessions, and represents security to auditors, customers, and the board.
What it covers
- Everything in Advisory
- Security roadmap owned and maintained, not just written
- Risk register and remediation tracking
- Audit and framework support through the cycle
- Vendor and third-party risk review
Commonly bought by: Companies in a SOC 2 or PCI cycle, or answering enterprise customers.
Embedded
$8,500 per month · 4 days per month
Weekly presence and active program leadership. Runs the security function day to day, leads the audit, and is in the room for board and customer conversations.
What it covers
- Everything in Fractional
- Weekly working sessions with your team
- Audit lead, including evidence and auditor liaison
- Board and executive reporting, with attendance
- Incident response leadership if something happens
Commonly bought by: Regulated environments, or bridging a security leadership gap.
The platform is public. Go and look at it. Craft Consulting Solutions builds and runs ThreatFeed, a live threat-intelligence platform: executive briefings from daily to quarterly, CVE and breach search, MITRE ATT&CK and ATLAS technique ranking, and current adversary and tooling analysis. It is open to read, with nothing to sign up for. A retainer is partly buying someone who already knows what is being exploited this week, rather than someone who reads about it when you do.
Committed days against a twenty-day working month
Retainer Terms
What the commitment actually is
A retainer buys scheduled attention, not unlimited availability. Publishing the terms alongside the price is how both sides know what was bought.
- Three-month minimum, then month to month with 30 days notice
- Days are scheduled in advance rather than held on call
- Unused days do not carry over; a heavy month is rebalanced by agreement
- Priority scheduling on penetration testing engagements
- A named individual, not a ticket queue or an account manager
- Travel, where you want someone in the room, is quoted separately at cost
Penetration testing is priced separately and published in full on the testing pricing page. Retainer clients get priority on the testing calendar, not a different rate.
Questions
Common questions about fractional CISO work
How much does a fractional CISO cost?
Here, $2,500 to $8,500 a month depending on how much time you need: $2,500 for one day a month, $4,500 for two, and $8,500 for four. Those are published monthly rates rather than estimates, with a three-month minimum and month-to-month thereafter. A full-time security executive in the same market is a multiple of this, which is the point of the model.
What does a fractional CISO actually do?
Decides what to do first, says no to the wrong investments, and explains security posture to people who do not work in security. In practice that means owning the security roadmap, maintaining a risk register, handling customer and insurer security questionnaires, leading audit and framework work, reviewing vendors, and reporting to executives or the board. It is judgment and accountability rather than headcount.
What is the difference between a fractional CISO and a vCISO?
In practice the terms are used interchangeably, and both describe experienced security leadership bought as a fraction of a full-time role. What actually differs between providers is the commitment: whether you get scheduled days from a named individual, or on-call access to whoever is available. Here it is a set number of days each month from the same person.
How many days a month does a fractional CISO need?
Most organizations with competent IT and no security owner start at one day a month. Two days is the point at which the roadmap gets driven between sessions rather than only discussed, and is where most companies in a SOC 2 or PCI cycle land. Four days buys weekly presence and active program leadership, which regulated environments and leadership gaps tend to need.
Can a fractional CISO help with SOC 2 or PCI?
Yes, and it is the most common reason companies start. The Fractional retainer at $4,500 a month covers framework support through the cycle: evidence, policy, remediation tracking, and working with the auditor. Penetration testing required by the framework is priced separately and published in full on the pricing page.
Does a fractional CISO replace my IT team or MSP?
No. It works alongside them. Your IT team or MSP runs the infrastructure; the fractional CISO decides what the security priorities are, holds the risk picture, and is accountable for the direction. Most engagements make an existing IT function more effective rather than duplicating it.
What happens to unused days?
They do not carry over. Days are scheduled in advance rather than held on call, and a heavy month is rebalanced by agreement rather than by accrual. Publishing that is deliberate: a retainer that quietly banks unused time turns into an obligation neither side planned for.
How long is the commitment?
Three months minimum, then month to month with 30 days notice. The minimum exists because the first month is largely spent understanding your environment, and an engagement that ends there produces cost without benefit for either side.
Discuss security leadership
Engagements range from a defined project, such as a roadmap or policy set, to an ongoing advisory relationship measured in days per month.