Part-time or full-time CISO: how to choose the right model

Many companies know they need someone to lead their security, without knowing whether the need justifies a full role. Between a part-time CISO who is on site a few days a month and a full-time CISO on the payroll, the wrong choice is expensive either way. This guide gives you the criteria to decide, the traps in each model and how to organise the move from one to the other.

Two models, two logics

A part-time CISO (also called a fractional, shared or virtual CISO) is an experienced professional who works for several organisations, either independently or through a firm. A full-time CISO is an employee, part of your organisation chart, who carries security day to day.

The difference is not only the number of hours. It is the nature of the role.

Criterion	Part-time CISO	Full-time CISO
Presence	A few days a month, as contracted	Daily
Main role	Frame, prioritise, structure, prepare an audit	Lead, execute, manage a team, stay the course
Internal knowledge	Builds slowly, in sessions	Builds continuously, alongside the teams
Crisis management	Availability to be negotiated in the contract	Present by default, owns the response
Outside perspective	Strong, fed by several contexts	Needs active upkeep
Set-up	Fast	Full hiring process
Commitment	Service contract, adjustable	Employment contract, long-term

When part-time is the right call

A part-time CISO is not a cut-price version of the role. It is a good answer to specific situations.

The workload does not justify a full role. A small company with a simple IT estate, little sensitive data and well-chosen providers mainly needs regular decisions, not a permanent presence.
You are starting from scratch. A first assessment, a risk map and a roadmap can be laid down by someone experienced who has done it elsewhere.
You have a one-off deadline. Preparing ISO 27001 certification, meeting a major customer's requirements or aligning with NIS2 calls for strong expertise over a defined period. Our article on the profiles needed for ISO 27001 certification covers these needs.
You want to clarify the role before hiring. A few months with a part-time CISO tell you which internal profile you are really missing.
You are waiting for an internal CISO to start. An interim engagement keeps the topic led while you recruit.

When you need a full-time CISO

Some signals show that the shared model has reached its limits, or never fitted.

Exposure is high. Health data, financial data, critical infrastructure, a regulated activity: security becomes a daily subject and incident response cannot wait for a slot.
You fall under NIS2. The directive requires continuous risk management, incident notification within short deadlines and involvement of management bodies. For important or essential entities, permanent internal leadership quickly becomes necessary. Our article on the profiles to hire for NIS2 details these obligations.
A security team exists or is about to. Hiring, managing and growing analysts takes a presence that part-time cannot offer.
Security becomes a sales argument. Customer questionnaires, third-party audits, contractual requirements: when these arrive every week, someone inside has to answer them.
Decisions are piling up. If choices wait between two visits, the pace no longer matches the need.

The costs people forget

Comparing a service fee with a loaded salary is tempting but misleading. Each model has less visible costs.

Part-time

Handover time. At each visit, the CISO has to be brought back up to speed. If nobody prepares these sessions, part of the time you pay for is lost.
The internal counterpart. Without a security contact inside, decisions are not applied. That counterpart's time is real, and often taken from IT.
Dependency. If knowledge of your security lives in a provider's head, changing contracts becomes risky.

Full-time

The hiring itself. A CISO search takes months, with an interview panel, a case study and a negotiation. Our guide to hiring a CISO walks through the process.
Resources. A CISO without budget or team produces reports, not security. The role commits resources beyond its own pay.
The cost of a mistake. A wrong hire at this level hurts for a long time, and an early departure often leaves a half-built programme.

Questions to ask yourself

Before you decide, answer these honestly with your leadership and your IT director.

Which data and services would hurt most to lose, and how long can you operate without them?
Are you subject to NIS2, DORA or sector-specific regulation? Check the official texts on cyber.gouv.fr if in doubt.
How many security decisions are waiting today for lack of an owner?
Who, internally, would apply a part-time CISO's decisions?
Are customers or partners asking for evidence of security more and more often?
Do you plan to hire security staff within the next two years?

If most answers point to a daily need, full-time is the answer. If they mostly describe a need for structure, part-time is a sound starting point.

Making a part-time CISO work

The model works when it is framed with the same rigour as a hire.

Write a clear mandate: scope, expected deliverables, visit frequency, reporting line.
Negotiate crisis availability: response time, on-call terms, what happens if an incident hits while they are with another client.
Name an internal counterpart who prepares sessions and tracks progress between visits.
Require shared documentation: risk register, roadmap, decisions taken. It must belong to you.
Assess the person like a candidate: case study, conversation with leadership, reference checks. A good part-time CISO can explain what they did elsewhere without breaching client confidentiality.

Moving from part-time to full-time

For many companies, the two models follow each other. Done well, the transition saves valuable time.

Stage	What happens
Structuring	The part-time CISO sets the assessment, risk map and roadmap
Defining the role	Together you identify the missing internal profile: technical, governance or business-oriented
Hiring	They can join the interview panel and case study to challenge finalists
Handover	A few weeks of overlap to pass on files, decisions and relationships

The internal role is not always a CISO. Sometimes the part-time CISO keeps the steering role and the hire is for execution, such as a GRC analyst who runs compliance day to day.

In short

A part-time CISO suits structuring work, a deadline or clarifying a need, provided there is an internal counterpart and crisis availability written into the contract. A full-time CISO becomes necessary when exposure, regulation, a team or customers make security a daily subject. The right choice starts from your risks and your decision pace, not from a price comparison.

Torn between the two models, or ready to hire your CISO? At Cyber Recrut, a recruiter and a security practitioner help you frame the role before the search starts, and our shortlisted candidates prove their skills on hands-on labs. See how we work or tell us about your need.