What is the difference between a fractional CISO and a vCISO?

Usually nothing. Both describe a part-time security executive. Ask whether you get a named person or a rotating pool.

Do we need a fractional CISO if we already have an MSP?

Not always. An MSP runs your IT and tools. A fractional CISO owns risk decisions, frameworks and board reporting. Many companies keep both.

Can a fractional CISO be our CISO of record for customers?

A good one can. Confirm it in writing before you sign, along with who joins customer security calls.

How to pick a fractional CISO in Boise

By the BoiseCyber team · Updated October 19, 2026

A fractional CISO gives you a senior security leader for part of the week instead of a full-time salary. The title is used loosely, so two firms offering "vCISO services" can mean very different things. Use the checklist below on any provider, including us.

The decision checklist

1. A named person, or a pool?

Ask who will actually be in the seat. Some providers assign whichever consultant is free that month. That works for a project, but not for a role your board, auditors and customers need to trust. Ask for the name of the person who will sign off on your roadmap and join customer security calls, and whether that person stays for the whole engagement.

2. Framework fit

Ask which frameworks they have run programs against, not just studied: HIPAA, SOC 2, HITRUST, NIST CSF, ISO 27001, or NIST AI RMF. Ask how they handle two frameworks at once without doubling the evidence work. A good answer names a crosswalk and an owner for each control.

3. Board reporting

Ask to see a sample board readout with the client details removed. You want plain English: where risk moved, what shipped, what needs a decision and what it will take to close the gap. If the sample is a heat map with no decisions in it, the board will get the same.

4. Incident coordination model

Ask what happens at 2 a.m. on a Saturday. A fractional CISO should run the incident call, keep decisions and owners on track, bring in counsel and your insurer, and brief leadership. Hands-on containment and forensics usually sit with your IT team, MSP or incident response firm. Get the response times and who does what written into the agreement.

5. Ownership and exit

Ask who owns the policies, evidence and roadmap if you part ways or hire a full-time CISO. The answer should be you, with a planned handoff.

6. Local presence

Ask whether they can be in the room for a board meeting, tabletop or audit kickoff in the Treasure Valley when it matters, and how the rest of the work happens remotely.

When a local MSP is enough

You may not need a fractional CISO yet. A capable local MSP or MSSP may cover you if:

No customer, payer or auditor is asking who your security executive is.
You are not working toward a framework audit or certification in the next year.
Your board or owners are not asking for regular cyber risk reporting.
Your insurance renewal questions are straightforward and you can answer them with evidence.

In that case, put the money into good IT operations and a yearly tabletop. Come back to this checklist when one of those conditions changes. Many companies keep their MSP and add a fractional CISO above it, so it is rarely an either/or choice.

Questions to ask on the first call

Question	What a good answer sounds like
Who is my CISO, by name?	One named person, for the whole engagement.
Which frameworks have you run programs on?	Specific frameworks and a crosswalk approach.
Can I see a sample board readout?	A redacted example with decisions, not just scores.
What do you do during an incident?	Incident command and coordination, with roles written down.
What do we keep if we part ways?	Everything, plus a planned handoff.
How do you price it?	A fixed fee, scoped on a short call.

Where BoiseCyber fits, and where it doesn't

BoiseCyber is a fractional CISO firm based in Boise. Every retainer comes with a named CISO of record, quarterly board readouts and a twelve-month roadmap. We run incident command beside your team and MSP. We are not a 24x7 monitoring service, and we don't do hands-on forensics.

Ask for a scoping call · See the fractional CISO retainer

FAQ

What is the difference between a fractional CISO and a vCISO?: Usually nothing. Both describe a part-time security executive. Ask whether you get a named person or a rotating pool.
Do we need a fractional CISO if we already have an MSP?: Not always. An MSP runs your IT and tools. A fractional CISO owns risk decisions, frameworks and board reporting. Many companies keep both.
Can a fractional CISO be our CISO of record for customers?: A good one can. Confirm it in writing before you sign, along with who joins customer security calls.