How to become a fractional CISO
A fractional CISO in the UK charges £900 to £1,500 a day and holds three to four clients at once. What follows is the arithmetic on that, the honest ceiling, and the cases where this seat does not work part-time at all.
Fractional CISO salary: what the year adds up to
Day rate × days a week × 46 billable weeks, rather than 52, because you will take holidays and because a year of unbroken client work is not a thing that happens. The rates are the band for the seat on the 2026 day rates page.
| Day rate | 1 day a week | 2 days a week | 3 days a week |
|---|---|---|---|
| Starting out£900 a day | £41,400a year | £82,800a year | £124,200a year |
| Established£1,200 a day | £55,200a year | £110,400a year | £165,600a year |
| Top of the band£1,500 a day | £69,000a year | £138,000a year | £207,000a year |
Before tax, before your own costs, and assuming the days are actually sold. Most people starting out spend a good part of the first year at fewer days than they planned.
What moves you up the band
Among the highest fractional rates, driven by certification work and regulated sectors.
How many clients the seat holds
Three to four. Security leadership is unusually schedulable, because most of it is governance, policy and answering enterprise questionnaires, all of which move on somebody else's known deadline rather than emerging at random.
How to get your first fractional CISO clients
A company that has just lost or nearly lost an enterprise deal over a security questionnaire, or is chasing ISO 27001 or SOC 2 for the first time. The trigger is external and sharp, which makes this the easiest fractional seat to sell into.
The audit and the questionnaire travel. Auditors, ISO 27001 and SOC 2 consultancies and enterprise buyers all see who answered well, and a company that passed with your help is the referral the next one listens to.
Where fractional CISO roles come from
From an external trigger: an enterprise security questionnaire, a lost deal, or an ISO 27001 or SOC 2 deadline. Auditors, consultancies and the buyer's own procurement team are often where the introduction starts.
Do you need a qualification or a certificate?
CISSP or CISM are useful and some enterprise questionnaires ask about them, but they are secondary. The programme you owned and the certifications you took a company through are what a client checks first.
It needs a security programme already owned, with policies, controls and an audit or certification taken through. A strong security engineer or penetration tester is a specialist rather than a CISO, because the seat carries the governance and the accountability, not only the technical work.
What the work actually is
Owning the security posture and the answers to it. A great deal of the job is translating between what an enterprise buyer is asking and what the company can honestly claim today.
When this seat does not work fractionally
- There is an active incident. That is incident response, full-time, now.
- They want a certificate rather than security, and will resent every control you introduce.
- There is no engineering capacity to implement anything you recommend.
What people get wrong
- Signing off on a posture you do not control.
- Accepting accountability for a breach without authority over the spend.
- Pricing as a consultant when the seat carries genuine liability.
The mechanics, briefly
Most UK fractional executives work through their own limited company and invoice per day or on a monthly retainer. Professional indemnity cover is worth having before the first engagement rather than after. Check what your last employment contract says about notice and restrictions before you start approaching anybody, particularly if a first client might be somebody you met there.
Employment status is the question that worries people most, and it is worth understanding properly rather than assuming: IR35 and fractional executives covers who decides, what gets tested, and the directorship point that catches people out.
Common questions
What should I charge as a fractional CISO in the UK?
£900 to £1,500 a day is the band on the bench, with a typical rate around £1,200. Among the highest fractional rates, driven by certification work and regulated sectors. At £1,200 a day, two days a week is about £110,400 a year across 46 billable weeks.
How do I get clients as a fractional CISO?
A company that has just lost or nearly lost an enterprise deal over a security questionnaire, or is chasing ISO 27001 or SOC 2 for the first time. The trigger is external and sharp, which makes this the easiest fractional seat to sell into. The audit and the questionnaire travel. Auditors, ISO 27001 and SOC 2 consultancies and enterprise buyers all see who answered well, and a company that passed with your help is the referral the next one listens to.
How many clients can a fractional CISO hold at once?
Three to four. Security leadership is unusually schedulable, because most of it is governance, policy and answering enterprise questionnaires, all of which move on somebody else's known deadline rather than emerging at random.
How many clients do I need to replace a full-time CISO salary?
Against a full-time base of £140,000, the mid-market figure the cost calculator uses for this seat, £1,200 a day across 46 weeks takes about 2.5 days a week. That is two clients at up to two days a week each, before tax and your own costs, and only once the days are actually sold.
Can I become a fractional CISO with no experience in the seat?
It needs a security programme already owned, with policies, controls and an audit or certification taken through. A strong security engineer or penetration tester is a specialist rather than a CISO, because the seat carries the governance and the accountability, not only the technical work.
Do I need a certification to work as a fractional CISO?
CISSP or CISM are useful and some enterprise questionnaires ask about them, but they are secondary. The programme you owned and the certifications you took a company through are what a client checks first.
When does a fractional CISO arrangement not work?
There is an active incident. That is incident response, full-time, now. They want a certificate rather than security, and will resent every control you introduce. There is no engineering capacity to implement anything you recommend.
Other seats
Hiring one rather than becoming one? What a fractional CISO covers and what one costs are the other side of the same numbers. Pricing yourself from a salary? The salary to day rate calculator and what to charge do the arithmetic.
There is no registration fee
No subscription. What listing costs, here and elsewhere, or put yourself on the bench.