Fractional CISOs, often marketed as vCISOs, usually come from security leadership roles: CISO, head of security, security architect or a senior role at an audit or consulting firm. Clients pay for two things: a security program that passes an audit and satisfies customers, and a calm leader when something goes wrong. These steps cover building a practice that delivers both.
1. Choose frameworks and industries
Specialization sells in security. Pick the frameworks you have taken companies through and the industries where they apply. SOC 2 for US software and services companies selling to enterprises, ISO 27001 for international customers, HIPAA for healthcare, PCI DSS for payments, CMMC for US defense contractors and ISO 42001 for companies building AI systems. “vCISO for healthcare software companies preparing for SOC 2 and HIPAA” is easier to buy than “security leader”.
2. Build a repeatable program
Clients want predictability. Write down your standard path: risk assessment, policy set, gap assessment, remediation plan, evidence collection, audit and annual cycle. Build templates for policies, the incident response plan and the tabletop exercise. A repeatable program is what lets one senior CISO serve six or eight clients.
3. Decide on analyst support
Evidence collection, questionnaire answers and documentation take more hours than strategy. Many vCISO firms pair the senior CISO with a security analyst who handles that work at a lower cost. Decide whether you will hire an analyst, partner with a firm or limit yourself to clients with internal staff. This choice sets your capacity and your margins.
4. Price the engagement
Most vCISO firms publish no prices. Retainers typically run $4,000 to $15,000 a month, priced by days per month and framework scope. A gap assessment works well as an entry offer. Set terms that match the work: a SOC 2 Type 2 takes six months to a year, so 6- to 12-month engagements are normal. Price incident response support explicitly, with response times and an hourly rate for heavy periods.
5. Handle liability and insurance carefully
Security advice carries more liability than most fractional work. Form a company. Your contract should cover scope, decision rights, especially who accepts risk, limits of liability, confidentiality and what happens during an incident. Make clear that the client owns its risk decisions and signs off on accepted risks. Buy technology errors and omissions cover and cyber liability insurance, and check that the policy covers security advice and incident work. Do not attest to controls; independent auditors issue reports.
6. Win the first clients
First clients usually come from CTOs, founders and IT leaders you have worked with. Startups facing their first SOC 2 request are the most common buyers. Write to 50 people with a short note on the frameworks you cover and how long your path to an audit takes.
7. Build referral partners
Audit firms, compliance software vendors, managed IT and managed security providers, cyber insurance brokers, fractional CTOs and startup lawyers all meet companies that need a security leader. Audit firms cannot design controls for clients they audit, so they often refer that work out. Disclose any referral fees or software resale margins to clients in writing.
8. Stay current and credentialed
Security changes constantly: new threats, new frameworks and new customer requirements. Keep your technical knowledge current and maintain the professional security certifications buyers look for. Clients and auditors check them.
9. Join peers and programs
Communities and programs for fractional executives cover packaging, pricing and running several clients, and some vCISO firms offer coaching for security leaders moving to fractional work. The programs for aspiring fractional executives are listed below this guide with their published prices and formats.