A fractional CISO, or vCISO, typically costs $4,000 to $15,000 a month. Most vCISO firms quote after a call and publish no prices. The retainer is only part of the cost of a security program: auditor fees, compliance automation software and security tools add to it, often by more than the retainer itself in the first year. The table below this guide shows any minimum fees published by the providers listed here.
Typical levels
- Advisory, 1 to 2 days a month: roughly $4,000 to $6,000. Policies, risk assessment, questionnaire support and a monthly review.
- Program leadership, 2 to 4 days a month: roughly $6,000 to $10,000. Runs a compliance program toward an audit, manages vendors and the incident response plan, joins customer security calls.
- Heavy, a day a week or more, often with an analyst: $10,000 to $15,000 and up. Several frameworks at once, regulated data, or a larger company with an internal IT and engineering team to direct.
What drives the price
The framework drives most of it. A single SOC 2 program is lighter than SOC 2 plus ISO 27001 plus HIPAA. Regulated data adds work: health records, payment cards and defense contracts each bring their own controls and audits. Company size and the number of systems matter, since every system holding sensitive data needs controls and evidence. The starting point matters too. A company with no written policies and shared admin passwords needs a heavier first six months than one with basic hygiene in place.
The costs beside the retainer
Budget these separately:
- Audit fees. A SOC 2 Type 1 report from a licensed CPA firm commonly costs around $10,000 to $25,000, and a Type 2 often $20,000 to $60,000 or more. ISO 27001 certification audits are priced by the certification body, with surveillance audits in the following years.
- Compliance software. Automation platforms that collect evidence and track controls often cost several thousand to tens of thousands of dollars a year.
- Security tools. Endpoint protection, single sign-on, device management, backups and logging, priced per user or device.
- Penetration testing. Often required for SOC 2 and by customers, typically a separate project.
Projects
Some companies start with a project. A gap assessment against SOC 2 or ISO 27001 typically runs a few weeks and produces a remediation plan. An incident response plan with a tabletop exercise, a policy set or a cyber insurance readiness review are other common projects.
Term
SOC 2 Type 2 reports cover an observation period of usually three to twelve months, so the path from start to report often takes six months to a year. Expect engagements of 6 to 12 months or longer, with an annual cycle after the first report.
What the first month costs in time
Plan on 4 to 8 hours from the CEO or CTO in month one, more from whoever runs IT or engineering. Expect interviews, access to system inventories and cloud accounts, a review of existing policies and the open customer questionnaires.
How to read a quote
Check the days per month, whether an analyst is included for evidence work, which frameworks are covered, whether audit fees and software are included or extra, how incident response support is priced if something happens, and the term. Ask whether the firm resells compliance software or tools.