Security leadership your board and buyers recognise — a few days a month.
A named, accountable practitioner who owns the risk register, chairs management review, answers investor diligence and keeps your certification alive. Without the £140k hire you can't justify yet.
What you'll walk away with
- A named security leader on your org chart for diligence, audits and customer reviews.
- An owned, current risk register with treatment decisions taken at the right level.
- Board and investor reporting that translates technical risk into commercial terms.
- Management review, internal audit and supplier assurance actually happening on schedule.
- Incident readiness: a tested plan, defined roles and a route to notification decisions.
What's included
Monthly leadership cadence
A standing session with founders or the exec team: risks, decisions, priorities and what changed since last month.
Risk ownership
Risk register maintained against ISO 31000 principles, with treatment plans that reflect runway, not theory.
Board & investor reporting
A concise security and compliance pack for board meetings, funding rounds and enterprise diligence.
Audit accountability
The named contact for certification bodies and customer auditors — internal audit, findings and corrective actions covered.
Vendor & supplier assurance
Proportionate third-party review so critical suppliers get scrutiny and the rest do not consume your week.
Incident response readiness
Playbooks, roles and a tabletop exercise so the first serious incident is not the first rehearsal.
How we work
- Step 1
Onboard
Understand the product, stack, customers and commitments already made in contracts and questionnaires.
- Step 2
Establish
Set the risk register, control set and reporting rhythm; agree what needs escalation and what does not.
- Step 3
Operate
Run the monthly cycle in the platform: reviews, evidence, actions, supplier checks, board pack.
- Step 4
Scale out
As you hire internally, transfer ownership deliberately — the system and its history stay with you.
Fractional CISO for startups FAQ
- How many days a month is typical?
- Most early-stage companies land between one and four days a month, weighted higher during a certification push or a major enterprise deal.
- Can you be named in customer contracts and diligence?
- Yes. The role is a genuine accountable appointment, not advisory-only, and is regularly named in due diligence responses and audit correspondence.
- What happens when we hire a full-time CISO?
- That is the intended endpoint. Everything runs in your workspace with documented decisions and history, so handover takes weeks rather than restarting the programme.
- Do we need the software to use this?
- It is strongly recommended — the platform is where the risk register, evidence and reviews live, which is what keeps a fractional model efficient.
Talk to us about Fractional CISO for startups
Share a few details and we'll come back within one working day with a proposed scoping call and indicative timeline.