Fractional CISO
A CISO for the business, part-time.
The security leadership role that owns your CMMC program from inside the business, part-time. Scoped per client.
Fractional CISO for defense contractors: a part-time security and compliance leader who owns the CMMC program from inside the business, chairs the reviews, and speaks to the program when a prime asks.
Sound familiar?
A full-time CISO would run us $250,000 to $500,000 a year, loaded.
Salary, bonus, benefits and a recruiting fee add up before the role has done a single day of work.
We do not have six months to run a search.
A real CISO search takes four to six months, and nobody is doing the job while it runs.
Whoever we hired would probably leave in two years anyway.
Median CISO tenure sits close to two years. You would be back doing this search again soon.
We do not need someone full-time. We need someone senior, part-time.
Fractional CISO engagements typically run $1,000 to $5,000 a month for a small business, senior expertise without the full-time bill.
One person owns every security call we make.
No one to check a judgment against, and no backup if that person leaves.
We want someone who can speak to a prime, not just to us.
The role owns the program from inside the business and chairs the reviews, rather than advising from outside it.
What it is
A CISO, a chief information security officer, is the person accountable for a company's security program. Most small defense suppliers cannot justify one full time, yet CMMC is not finished when a score is posted: controls drift, people leave, systems change, and the affirmation is signed again every year. A fractional CISO is that role, part-time: someone who keeps the plan current, runs the reviews where decisions get made and recorded, and can speak to the program when a prime or an assessor asks.
Is this the right service?
SCOPED, NOT PRICEDWho it is for
A contractor with a CMMC Level 2 requirement and nobody on staff whose job it is to own the security program. Usually a business that has started the work and needs it run, not restarted.
How it starts
A scoping call to agree the shape of the role: which reviews, how often, and what is already in place. If there is no recent gap assessment, the role starts with one.
How it differs
The gap assessment tells you where you stand, once. CMMC Level 2 program leadership gets you from there to your assessment. A fractional CISO owns the program after that, or alongside your own team. CMMC In A Container includes that ownership inside a managed program with its own environment.
The $5,000 gap assessment, CMMC In A Container™, or all three side by side.
What you receive
What this is not
We are not an Authorized C3PAO and we do not certify anyone. A fractional CISO is a part-time role we provide, not a full-time hire, and what we can commit to is our own accountability rather than what a third party will do.
Book a 30-minute call.
BOOK A CALLScoped per client, so the first step is a conversation. Pick a time.
What happens in 30 minutes
- We learn about your business and the defense contracts you hold or are bidding on.
- We walk you through a gap assessment, the first step toward CMMC, and what it covers.
- If you qualify, we help you apply to Cyber Grants Alliance for an in-kind grant, which provides the gap assessment itself. No slides.
Talk to us about it.
This is scoped per client, not priced on a page. Tell us what you have and we will tell you what it takes.
Defense supplier under 25 people? Start with the grant.
Cyber Grants Alliance, a nonprofit, awards in-kind cybersecurity grants. It provides the work itself, including CMMC Level 1 and Level 2 gap assessments. There is no cost to you, and you are under no obligation to buy anything afterward, from us or from anyone.