Are You Ready? Fractional CISO Readiness Checklist

Leadership and board exposure

Security questions come up at board or leadership level but nobody owns the answer.
A senior manager or director could not describe the organisation's top three security risks if asked today.
Security reporting to leadership is either absent, irregular, or not acted on.
The board has asked about cyber insurance, regulatory compliance, or a supplier security questionnaire in the last 12 months.

You have an active or approaching compliance requirement: ISO 27001, Cyber Essentials, SOC 2, GDPR, NIS, NCSC CAF, or similar.
A customer, insurer, or procurement process has asked for evidence of a security programme in the last year.
An incident, near-miss, or phishing event happened in the last 18 months and the response was improvised.
Your organisation handles sensitive data, personally identifiable information, or operates in a regulated sector.

Staff are using AI tools (ChatGPT, Copilot, Gemini, or similar) without a formal policy or governance process.
The organisation is evaluating or has already adopted AI tools in a customer-facing or data-sensitive context.
Nobody has formally assessed whether your AI use complies with GDPR Article 22, the EU AI Act, or your sector's guidance.

Core policies (acceptable use, access control, incident response, data classification) either do not exist or have not been reviewed in over 12 months.
Security responsibilities are distributed across IT, legal, and management without a single accountable owner.
You rely on a generalist IT team or an MSP to cover security, without a named senior security lead.
A risk register exists in name but is not actively maintained or used to inform decisions.

A full-time CISO hire is not viable right now: the role would be over-resourced, the budget is not available, or the need is not yet consistent enough.
There is a defined security project, audit, or deadline coming in the next three to six months.
Leadership would value access to senior security judgement on an as-needed basis, without a permanent headcount commitment.

Your score

Score guide

0–4

Not yet

5–9

Worth a conversation

10–14

Strong fit

15+

Act now

If you scored 5 or above:

A short, no-pressure conversation. We come with questions, not a pitch.

Want the full capability statement?

Leave your email and we will send it across — credentials, engagement model, and the first 90 days.