Full-Time CISO or Fractional CISO: How Do You Decide?

Choose fractional security leadership when a defined share of senior attention, backed by clear authority, timely coverage and capable internal owners, can meet your actual obligations. Choose dedicated leadership when recurring decisions, organizational change or executive coordination require sustained attention that the proposed fractional arrangement cannot supply. Neither model repairs a missing mandate, an unfunded engineering backlog or a board that refuses difficult decisions.

I would decide what the organization needs someone to do before deciding how to employ them. A CISO title can conceal very different jobs: running a security function, advising management, challenging operational risk, coordinating an incident or explaining exposure to a board. Buying a few days of advice does not automatically provide all five. Hiring an employee does not automatically provide them either.

The useful question is whether a specific leadership arrangement works under your conditions. This paper proposes a way to answer it through decision deadlines, delegated powers, delivery dependencies and evidence of performance. It draws on governance standards and selected regulatory examples, rather than a comparative trial of staffing models. The framework is an analytical proposal, not a validated predictor of breach reduction or a universal staffing formula.

Separate employment, attention and availability

“Full-time versus fractional” bundles several choices together. Employment describes the relationship with the organization. Dedicated or shared describes allocation across responsibilities or clients. Scheduled hours describe planned effort. Availability describes when someone can respond. Decision authority describes what that response can accomplish. These dimensions need their own entries in a proposed mandate.

An employee could have substantial nonsecurity responsibilities. A contractor could be dedicated to an interim appointment. A shared adviser could offer planned strategic work with a separate incident arrangement. Those are conceptual configurations, not claims that a particular provider offers them. The contract and organizational appointment must establish the configuration you are actually buying.

NICE separates work roles from job titles and allows multiple roles to contribute to a particular job (Petersen et al., 2020, §3.4). That gives a useful starting point: describe responsibilities as work, rather than treating “CISO” as a complete specification. The framework does not tell you how many hours a security executive needs or whether that executive should be employed.

I would distinguish three kinds of work in the role description. Direction establishes priorities and resolves tradeoffs. Supervision checks that commitments turn into delivery. Execution performs the changes, investigations and tests. One person may perform elements of each, but the proposed engagement should disclose which work competes for their attention. Otherwise an advisory retainer can quietly become an underfunded implementation service.

Also distinguish authority to recommend from authority to decide. An adviser may identify an unacceptable exposure while a business executive retains the decision to suspend a service. That arrangement can be reasonable if escalation is timely and explicit. It is weak if everyone assumes the adviser has authority that the organization has never granted.

Identify the obligations before choosing the arrangement

Regulation is not a generic reason to insist on either employment model. It is a reason to identify the entity, activity, jurisdiction, applicable provision and any exemption before designing the role. Three bounded examples show why a label such as “regulated business” cannot finish that analysis.

For financial institutions covered by the FTC Safeguards Rule, the FTC explains that the Qualified Individual may work for the institution, an affiliate or a service provider. External appointment does not remove the institution's responsibility or the requirement for internal senior oversight (Federal Trade Commission [FTC], n.d.). Section 314.4(a) also requires the external provider or affiliate to maintain a protective information security program. The current eCFR text corroborates these conditions. This is permission for a defined arrangement within that rule, not approval of any fractional contract.

New York DFS's published second-amendment text similarly permits a CISO employed by a covered entity, affiliate or third-party provider, while retaining entity responsibility and internal oversight conditions (§500.4(a)). Section 500.19 contains exemptions affecting applicability (New York State Department of Financial Services [NYDFS], 2023). The cited copy is expressly a change-identification document, not an official codification. Use it to understand the provision; confirm the applicable current text and entity-specific position before relying on it for an appointment.

For reporting registrants within its scope, Regulation S-K Item 106(c) addresses disclosure of board oversight and management's role, expertise and information processes. The SEC's final rule explains that it did not adopt the separate proposed item specifically asking whether a designated CISO exists (Securities and Exchange Commission [SEC], 2023, pp. 69–71). That disclosure framework should not be converted into a general assertion that every business must hire an employed CISO. Nor does it settle obligations arising elsewhere.

I would turn applicable requirements into appointment conditions: named responsibility, reporting access, competence, evidence retention and specific approval duties. Counsel should confirm legal applicability; management must then make the approved arrangement operational. A contract that repeats a rule without providing access to the required information is not an operating design.

These examples were checked for this analysis in October 2026. They are deliberately selective. Sector rules, contractual obligations, cross-border requirements and later changes may alter the feasible options. No employee-count threshold or universal legal conclusion follows from them.

Write a mandate that survives disagreement

NIST CSF 2.0 distinguishes leadership accountability, established responsibilities and authorities, and resources appropriate to those responsibilities (National Institute of Standards and Technology [NIST], 2024, GV.RR-01–03). I would use that distinction to test whether the proposed role can function when another executive disagrees with its recommendation.

Consider a product release with an unresolved access-control weakness. Who can require a review? Who can defer release? Who can accept the residual exposure, and what information must they receive? What happens when the security leader and product owner disagree about severity? The mandate needs a route to a decision, not merely a statement that security “partners with the business.”

A useful mandate names the decisions reserved to the governing body, those retained by business executives and those delegated to security leadership. It specifies escalation triggers and the records expected from each decision. It also identifies which powers remain unavailable: an adviser should not imply an ability to authorize expenditure, direct employees or halt operations unless the organization has granted it.

The UK Cyber Governance Code of Practice calls for defined executive and nonexecutive ownership and regular two-way dialogue with relevant senior executives (Department for Digital, Culture, Media and Sport et al., 2025, section E). I treat this as governance guidance, not a universal legal prescription. Its practical implication for an engagement is that access to leadership should be part of the arrangement rather than dependent on occasional invitations.

Test that access with an uncomfortable issue. Could the security leader report that the sponsor has deferred a material remediation decision? Can the board hear the disagreement without the sponsor editing it out? A formally impressive appointment that cannot surface adverse information has a structural weakness. Changing the person's payroll category leaves that weakness intact.

The mandate should also make the organization answerable to the leader. Specify who supplies architecture records, financial assumptions, incident information and delivery status. Set an escalation path for missing inputs. Holding someone responsible for assessing an exposure while denying them the evidence creates an impossible assignment, regardless of their competence.

Test response coverage against decision deadlines

Scheduled effort and urgent availability are different resources. A monthly allowance can be sufficient for planned reviews and inadequate for a decision needed during an outage. Conversely, constant availability may add little value where operational teams can act under approved authority and reserve strategic questions for scheduled review.

NIST's incident-response guidance calls for documented response responsibilities and the authority needed to fulfil them; those responsibilities can extend to contracted parties (Nelson et al., 2025, GV.RR-02). It does not establish a universal response time for a fractional CISO. Your deadline has to follow the decision, the consequences of waiting and the available alternatives.

I would distinguish acknowledgment, informed participation and authorized decision. An answered phone establishes contact. It does not establish that the person has obtained sufficient context, reached the necessary parties or exercised a power they hold. Contractual service measures should say which event they measure and what happens when the next stage cannot proceed.

For each consequential decision, describe the maximum tolerable delay under a stated scenario. Then identify the required evidence, decision owner, alternate and communications path. A severe account compromise may require technical containment under predelegated authority before the CISO joins. A major customer communication may need legal and executive approval. Treating both as “call the CISO” obscures the different dependencies.

Ask about concurrent demand explicitly. If a provider supports multiple organizations, a shared incident or common deadline could create competing claims on the same person. This is a scenario to assess, not a measured claim about how often fractional providers fail. Obtain the actual allocation, substitution and escalation terms without requesting other clients' confidential details.

Dedicated employees also need substitutes. Illness, leave and simultaneous demands do not disappear with employment. Compare the complete coverage arrangements on both sides. A staffed provider may have a stronger substitute than a lone employee; a vague promise of team support may have no usable substitute at all.

Model the path to an executable decision

For a particular scenario, let D be the time available before waiting creates an unacceptable consequence. Let L be elapsed time from recognizing the need for a decision to communicating an authorized decision to the people who must act. A necessary scheduling condition is L ≤ D. It is not sufficient: a fast decision based on inadequate evidence can still be wrong, and execution may need additional time after authorization.

If notification, context gathering, consultation and authorization occur strictly in sequence, their elapsed times add. When some activities run in parallel, the relevant quantity is the duration of the longest dependent chain, not the sum of everyone's labor hours. A shared adviser could spend little time on a decision that waits hours for a required executive. Adding adviser hours would not shorten that executive's queue.

This model is my proposed diagnostic abstraction. I would populate it from timestamped decision records and an explicitly bounded exercise, preserving the conditions under which each observation was made. Do not substitute the provider's acknowledgment target for L, or combine the fastest observed stage from several unrelated incidents into an imaginary end-to-end result.

There are two distinct reserve questions. Can the organization supply enough knowledgeable attention when work arrives together? Can it reach an authorized decision owner before the deadline? Extra attention cannot compensate for an inaccessible decision owner; delegated authority cannot compensate for missing expertise. A viable design must address both, including what to do when evidence remains incomplete at D.

The organization may then choose a reversible protective action under preapproved authority while a larger decision remains open. That option changes the decision path and its consequences; it does not make the original deadline disappear. Review it with the affected operational owners before treating it as a coverage remedy.

Establish who turns decisions into working controls

A capable leader can select a remediation priority, but someone still has to change the identity policy, test the application, negotiate the supplier requirement or prove restoration. I would require each major commitment in the leadership plan to name an execution owner and the resources that owner controls.

This creates a useful diagnostic distinction. If approved work repeatedly waits for engineers, procurement or a business owner, additional leadership hours may not address the binding constraint. If delivery teams are ready but repeatedly wait for cross-functional prioritization or risk decisions, leadership capacity may be the constraint. The evidence is the location and cause of delay, not the number of open tickets alone.

The security-team capacity analysis develops that delivery question. Here the narrower task is to determine whether the proposed leader can direct the available capability. A CISO engagement should not be credited with implementation capacity that exists only in an optimistic project plan.

I would inspect a small set of actual commitments with different dependencies: one technical change, one business decision and one external obligation. Trace each from identification through authorization, implementation and verification. Record where work waited, whose attention was required and which information was missing. Do not infer the entire year's demand from a conveniently quiet week.

A fractional arrangement becomes more plausible when routine execution has stable owners, required decisions can be scheduled and escalation works between meetings. Dedicated leadership becomes more plausible when unresolved coordination demands recur across several functions and cannot be delegated without losing necessary context. These are hypotheses to test against your records, not categorical descriptions of small and large companies.

Missing information is itself a result. If nobody can reconstruct why important decisions waited, first establish a usable decision record. Selecting a staffing model on unobserved demand risks buying the wrong remedy and then judging the person against an assignment that was never understood.

Use qualification gates before comparing fees

I would evaluate candidate arrangements in two stages. First, reject or redesign options that fail a necessary condition. Then compare the feasible options on effort, cost, flexibility and expected continuity. This avoids a common weakness in weighted scorecards: several attractive scores can conceal a missing condition that makes the arrangement unusable.

Necessary condition	Evidence to inspect	Consequence of an unresolved gap
Applicable obligations can be met	Scoped legal requirements and named responsibilities	Do not represent the option as compliant
The mandate permits the required decisions	Appointment, delegation and escalation record	Repair authority before assessing performance
Urgent decisions have adequate coverage	Defined response stages, alternate and exercised path	Add coverage or change the arrangement
Approved work can be executed	Delivery owners, capacity and verification responsibilities	Fund or redesign execution separately
Material conflicts can be challenged	Disclosures, reporting access and independent review	Separate incompatible responsibilities
The organization can continue after departure	Accessible records, substitute and transition terms	Repair continuity before dependence grows

These are proposed acceptance gates, not a certification scheme. An unresolved condition can sometimes be repaired by adding an internal sponsor, a separate response retainer or independent assurance. That creates a different option with different costs. Record the repair rather than comparing the unrepaired price with another option's complete service.

Only then build the cost comparison. Include paid leadership time, internal coordination effort, implementation capacity, coverage arrangements, transition work and independent review where needed. Keep the horizon and included responsibilities consistent. An employee salary and a narrow advisory fee are not comparable totals when one includes management work that the other excludes.

Do not monetize hypothetical breach prevention simply to make the preferred option look cheaper. Where decision delays have observable business consequences, describe those consequences and the uncertainty. The security-spending analysis explains how to compare improvements without treating speculative avoided loss as booked value. The leadership choice still needs a feasible mandate before economics can distinguish the options.

Work through a fictional coverage failure

Consider an invented company, Alder Services. It needs recurring governance work, support for product decisions and an executive escalation route during incidents. The following hours and deadlines are invented inputs for reasoning, not observed client data, market benchmarks or recommended staffing levels.

Suppose Alder allocates twelve leadership hours each week: four for scheduled governance, four for product decisions, two for supplier issues and two for follow-up. An offered fractional arrangement also supplies twelve scheduled hours. On that arithmetic alone, demand appears to fit. The match says nothing about when those hours are available or whether the underlying estimates include preparation and coordination.

Now introduce a Tuesday incident requiring a consequential service decision within ninety minutes. The scheduled adviser is unavailable until Wednesday. Alder's internal operations manager can isolate a defined workload but cannot authorize the wider service interruption under the current mandate. The fractional option fails this scenario because the necessary decision has no timely authorized owner, even though the weekly hours still balance.

Three repairs are conceptually possible. Alder could delegate the relevant bounded decision to a competent internal executive with access to advice. It could purchase a separate, specified response arrangement that includes an authorized internal decision route. Or it could redesign the leadership appointment for dedicated availability with a substitute. None is automatically correct; each must be assessed against operational consequences and applicable requirements.

Notice what would not repair the problem: increasing next month's scheduled hours, changing the title on the contract or promising to work harder after the event. The deficiency is temporal and organizational. It is not simply an annual total of effort.

Add a second condition. Assume Alder's product teams now need fourteen hours of recurring leadership attention each week, before the original governance and supplier work. Keeping the other invented allocations produces twenty-two hours of planned demand against twelve available. That is a different failure: a recurring capacity gap of ten hours under the stated assumptions. A coverage retainer does not supply those scheduled hours unless its terms explicitly do so.

The exercise separates two reasons to change the model. Urgent coverage may need delegated authority or a separate response service. Persistent coordination demand may justify a larger allocation or dedicated appointment. The same organization could encounter both, but identifying which condition failed prevents a generic “hire a CISO” recommendation from hiding the actual design work.

Separate leadership from independent assurance

An external person is not independent merely because they invoice you. If the same provider recommends a platform, earns revenue from its implementation and reports whether that implementation was effective, the arrangement contains a potential self-review problem. An employed leader can face analogous pressure when evaluating a program they designed.

The IIA's Three Lines Model describes safeguards for independence, including clear responsibilities and independent review where self-review risks arise. It also states that outsourcing does not change the activity's role or the board's accountability for its appropriate direction (Institute of Internal Auditors [IIA], 2026, pp. 9, 19). This does not make every CISO an internal auditor. It requires distinguishing management's work from the assurance used to challenge that work.

I would ask every candidate arrangement to disclose relevant commercial interests and the boundaries of its assurance claims. Who benefits from the recommended procurement? Who defines the success criteria? Who can obtain evidence directly? Who reviews an adverse finding about the provider's own service? A disclosure starts that conversation; it does not by itself remove the conflict.

Where independent assurance matters, arrange it separately enough to challenge the operational account. The reviewer needs a scope, evidence access and reporting route that the subject of the review cannot quietly constrain. The precise structure depends on the organization. The important point is to avoid calling a management progress presentation an independent evaluation.

Confidentiality also belongs in the engagement design. NIST's supply-chain guidance calls for documented contractor access agreements, appropriate limits and mechanisms to track access (Boyens et al., 2024, PS-6). Applied here, I would give the leader access proportionate to their work, using organizationally controlled identities and records. Strategic responsibility is not a reason to distribute unrestricted administrator access by default.

Keep sensitive risk records, executive materials and incident decisions in approved repositories with defined access and retention. Specify how deputies and subcontractors are authorized. A useful adviser should leave the organization with better institutional knowledge, rather than becoming its only route to its own evidence.

Evaluate the arrangement through decisions and transitions

NIST distinguishes implementation, effectiveness, efficiency and impact measures (Schroeder et al., 2024, §3.3). For this appointment, I would resist reducing performance to policies delivered, meetings attended or invoices below budget. Those can describe activity without establishing whether important decisions became timely and executable.

Use a bounded decision sample instead. Record the question, required information, decision deadline, actual decision, execution owner and eventual verification. Separate delay caused by the leader from delay caused by an unavailable sponsor or missing engineering capacity. A timely but unsupported approval should not count as good performance simply because it met a response target.

Include decisions that remain open. Excluding unresolved cases can make a slow arrangement look successful because only easy completions enter the denominator. Report the observation period and the mix of decision types. A handful of cases can expose a failure mechanism; it cannot establish a reliable comparative success rate between fractional and employed leadership.

The NCSC board toolkit emphasizes risk ownership, escalation and consideration of risks occurring together (National Cyber Security Centre [NCSC], 2025, p. 21). I would use a combined-demand scenario when reviewing the arrangement: a supplier issue, an incident and a board deadline arriving together. The point is to examine prioritization and substitution, not manufacture a stress-test score from invented probabilities.

Define change triggers in advance. Examples include repeated missed consequential decisions attributable to coverage, recurring demand exceeding the contracted allocation, an acquisition requiring sustained coordination or a conflict that cannot be adequately separated. These are proposed triggers for reassessment, not automatic instructions to dismiss a provider or add an employee.

Continuity deserves an acceptance test before the relationship ends. GAO's Green Book distinguishes succession from sudden-vacancy contingency planning and addresses continuity where a service organization performs a key role (U.S. Government Accountability Office [GAO], 2025, §§4.06–4.08). It is a federal internal-control standard; its use here is an explicitly proposed analogy for organizational resilience, not a claim that every private company must follow it.

Ask a designated substitute to reconstruct one unresolved decision from the approved record. Can they identify the issue, assumptions, deadline, responsible parties and next action without the outgoing leader narrating it? If not, the transition problem is already present. Address it while the incumbent can still help, and include revocation of obsolete access when responsibilities change.

Where this method can mislead

A strong argument for dedicated leadership is accumulated context. Repeated participation can improve understanding of informal dependencies and allow earlier intervention. A strong argument for fractional leadership is access to relevant expertise for a bounded need without committing to a broader appointment. Neither proposition establishes that one model outperforms the other in a particular organization. Competence, sponsorship, information access and execution capacity can dominate the contractual distinction.

There is also a danger in making the mandate too rigid. Some valuable leadership work consists of discovering problems that nobody knew to specify. Leave room for investigation and revision, while keeping consequential authority explicit. A contract can define the route for changing scope without pretending all future work is predictable.

The source base supports governance principles, selected obligations and operational distinctions. It does not provide a controlled comparison of breach outcomes, a market-price study or a validated minimum number of CISO hours. The fictional example proves only the arithmetic and logical consequences of its assumptions. It should not be mistaken for evidence about typical companies or providers.

I would therefore choose the arrangement that can demonstrate the required authority, attention, coverage and continuity under your conditions, then revisit it against observed decisions. Sometimes that will be fractional leadership with capable internal delivery. Sometimes it will be a dedicated executive. Sometimes neither proposal is ready because the organization has not supplied the mandate or resources required for either to work.

Before you buy the title, define the decisions you need made. Request a briefing on your security leadership requirements to examine the mandate, coverage gaps, internal delivery dependencies and conditions that would justify a different arrangement. Bring a sanitized description of the decisions that currently stall; sensitive operational details belong in an agreed private discussion.