Founders guess fractional CISO hours and overpay or underprotect. Guess wrong and you either pay full-time money for part-time coverage, or leave real gaps open right before an audit.
| Fractional CISO cost | roughly $8,000 to $25,000 per month depending on company stage |
|---|---|
| Full-time CISO base pay | roughly $200,000 to $350,000 base in the US |
| SOC 2 Type II observation period | typically 3 to 12 months |
| SOC 2 Type II total timeline | roughly 6 to 12 months end to end |
1. List four numbers about your company
Before you talk to anyone, write down your headcount, your compliance load (SOC2, ISO 27001, HIPAA, PCI, or none), your current security maturity (none, basic, intermediate), and any audit or launch date already on the calendar. Example: 42 employees, SaaS, pursuing SOC2 Type II by Q2, no security hire yet.
2. Hand those numbers to AI as a decision aid
Open any AI chat and paste this, filling in your own details: ‘I’m hiring a fractional CISO for [company]. Size: [X employees]. Compliance needs: [SOC2/ISO/HIPAA/PCI/none]. Current security maturity: [none/basic/intermediate]. Upcoming deadlines: [audit date]. Budget: [$X/month]. Give me a realistic weekly hours range with reasoning, the deliverables that fit in that time, a trade-off table versus a full-time hire, and the signal that tells me when to switch to full-time.’ This turns a vague ask into a scoped answer built from your situation, not a generic average.
3. Read the trade-off table before the number
The hours figure means nothing without the trade-off next to it. A lower hours range usually trades away responsiveness, not quality, so check what you are giving up at each level before you anchor on a number.
4. Check the deliverables actually fit the hours
Ask AI directly: ‘At [X] hours a week, can these deliverables realistically get done: [list them]?’ If the answer is no, either raise the hours or cut the deliverable list. This is the step that stops founders from signing a retainer that quietly underdelivers.
5. Write the hours and an escalation clause into the contract
Put the agreed weekly hours and the deliverable list directly into the retainer agreement, plus one line for what happens if an incident or audit pushes past that scope, such as extra hours at a stated rate or a defined cap. That clause protects both sides when things get busy.
6. Re-run the prompt every quarter
Your company’s size and risk load change faster than most retainers get renegotiated. Every quarter, feed AI your updated numbers and ask if the hours still fit or if it is time to move toward full-time.
A worked example
A 42-person fintech startup preparing for SOC2 Type II, with no security hire yet, needs to brief a fractional CISO candidate on expected hours.
Before
We need a CISO. How many hours a week should we budget and what should we expect them to deliver?
After
Based on your stage (42 employees, first SOC2 cycle, no existing security function), budget 10 to 15 hours a week for the first two to three months covering policy buildout, gap assessment, and vendor coordination, dropping to 6 to 8 hours a week once controls are running. In that time, expect a written risk register, core policies for access control, incident response, and vendor risk, a SOC2 control mapping, and a monthly board-ready status update. Trade-off: fractional at 8 to 10 hours a week costs roughly a third of a full-time salary but caps responsiveness to multi-day turnaround on urgent issues. Full-time starts to make sense once you cross roughly 150 employees, handle regulated customer data directly, or face security incidents on a monthly basis. Signal to re-evaluate: ad hoc requests regularly exceeding the contracted hours for two months running.
Three ways to bend it
Scoping a fractional CFO or CTO
Use the same prompt and swap the role and deliverables, financial close and board reporting for a CFO, architecture reviews for a CTO, instead of SOC2 controls. The constraints-in, trade-off-out structure works for any fractional executive hire.
Comparing two vendor quotes
If two fractional CISO firms quote different hours for the same scope, feed AI both quotes alongside your constraints and ask it to flag which one’s hours do not match the deliverables promised.
Scoping an internal hire instead
Use the same prompt to decide between a fractional hire and a junior in-house security lead, asking AI to compare hours, cost, and coverage gaps for each option against your specific risk profile.
When it goes wrong
AI gives me a vague range like ‘5 to 20 hours’.
That means your constraints were vague too. Add the actual audit date, the number of past incidents, and how sensitive your data is, then ask again.
The hours it suggests blow past my budget.
Tell AI your budget ceiling and ask it to recompute hours at that ceiling, listing exactly which deliverables get cut. A smaller number with a shorter deliverable list beats a number you cannot afford.
When not to use this
If you already have a signed quote from a vendor with a detailed scope of work, this exercise will not fix a bad vendor relationship, it only helps you sanity-check the ask before you sign. And if you are in a regulated industry where a full-time CISO is a legal requirement, no amount of scoping gets you out of that obligation, so check with a compliance advisor first.
What you can now do
You walk into the retainer conversation with a number built from your own situation, not a guess borrowed from someone else’s company.
Part of Making Life Easier With AI, a weekly walk-through of one small thing AI can take off your plate.
Take this further
Act as a blunt hiring manager who has read ten thousand resumes, not a career coach. I will paste my full resume and the job description I want. Rewrite the whole resume for that role, section by section, in this order: summary, experience, skills, education. Rules: every experience line leads with impact, not duty. Use bracketed placeholders like [8 percent] for any number I did not give you, and list at the end every placeholder I need to replace with a real figure. Keep it to one page of text. Plain formatting only, no tables or columns, so screening software can parse it. After the rewrite, tell me the three weakest claims that need evidence before I send this anywhere. My resume: [paste resume]. The role: [paste job description].
Takeaways
- Before contacting any candidate, write down your headcount, compliance load, current security maturity, and any fixed audit or launch date.
- Feed those four numbers into an AI prompt and ask for a weekly hours range, matching deliverables, a trade-off table versus full-time, and a signal for when to switch.
- Ask AI directly whether your deliverable list fits inside the proposed hours, then either raise the hours or cut the list before you sign anything.
- Write the agreed weekly hours, the deliverable list, and an overage or escalation clause directly into the retainer contract.
- Re-run the scoping prompt every quarter with updated numbers to check whether the hours still match your risk profile.
Questions people actually ask
How many hours a week should a fractional CISO work for a small startup?
It depends on your compliance load and maturity level, not a fixed industry number. Early-stage companies building their first SOC 2 program typically need a heavier block of hours for policy writing and gap assessment, then can drop to a lighter maintenance level once controls are running. The right way to find your number is to feed your headcount, compliance needs, maturity, and deadlines into an AI prompt and ask for a range with reasoning, then check that the deliverables actually fit inside it.
How much does a fractional CISO cost compared to a full-time CISO?
Fractional or virtual CISO engagements commonly run in the thousands per month depending on company stage and scope, while a full-time CISO’s base pay plus bonus and equity runs well into six figures annually. The fractional route generally costs a fraction of the full-time total, but it trades away immediate responsiveness and continuous presence, so the comparison should weigh coverage gaps, not just price.
When should a company switch from a fractional CISO to a full-time hire?
Common signals include crossing a meaningful headcount threshold, handling regulated customer data directly, facing security incidents on a recurring monthly basis, or regularly blowing past contracted hours for two months running. None of these alone is a hard rule, so re-check your own numbers each quarter rather than relying on a generic trigger point.
What should a fractional CISO deliver in the first few months of a SOC 2 push?
Expect a written risk register, core policies covering access control, incident response, and vendor risk, a control mapping against the relevant framework, and a regular status update suitable for a board or leadership audience. If a proposed hours budget cannot realistically produce that list, the fix is to raise the hours or shorten the deliverable list before signing, not to assume it will work out.
How long does SOC 2 Type II compliance usually take?
Most organizations need roughly six to twelve months end to end, covering pre-audit preparation, an observation period where auditors gather evidence on live controls, fieldwork, and report drafting. The observation period itself typically runs three to twelve months, with three being a practical floor so recurring controls like quarterly access reviews can be tested at least once.
Sources
What happens next
Expect more founders to treat fractional security and finance roles the same way, scoping hours with a repeatable prompt instead of a vendor’s standard package. Watch whether vendor quotes start converging around narrower hourly bands as this kind of AI-assisted scoping becomes common, and whether buyers get sharper at spotting a mismatch between promised deliverables and proposed hours before they sign.
