CISO as a service: the same job, held to a higher standard

vCISO, fractional CISO, CISO as a service — vendors use the labels interchangeably, and search engines treat them as one market. There is no technical distinction hiding in the terminology: all three mean a senior security leader you don’t employ, carrying the responsibilities a chief information security officer would carry.

What genuinely differs between providers is the operating model underneath the label: a solo consultant with a calendar, a small advisory practice, or a firm with an engineering bench and software behind the leader. Since the name on the brochure won’t tell you which one you’re buying, the useful move is to know what the “as a service” framing should oblige — and make every candidate vendor answer to it.

When you buy infrastructure as a service, you buy guarantees — uptime, response, replaceable parts — not one talented administrator’s best effort. Apply the same standard here. A CISO-as-a-service offering worth the name commits to four things in writing: response-time SLAs for the work that blocks revenue, a team behind the named leader so there’s no bus factor, an enumerated deliverables list, and continuity terms that survive both personnel changes and the end of the contract.

Plenty of respectable consultants can’t make those commitments — a solo practitioner can’t offer a bench, however sharp they are. That doesn’t make them bad advisors; it makes them consulting hours wearing a service’s name. If the guarantees aren’t in the agreement, price the engagement as advice, not as a service.

Four patterns predict disappointment. The one-person shop selling a service label it can’t structurally deliver — brilliant until the week they’re unreachable. The assessment factory, where the relationship peaks at the findings deck and the remediation is your problem. The running meter, where every question after signing becomes a billable event, so your team learns to stop asking. And the vague subcontractor answer, where you can’t find out who actually does the work until after you’ve signed.

A useful heuristic: a price too small to include execution is an advice price. If two quotes differ several-fold, they aren’t competing offers — they’re different products, and the comparison you actually want is scope against scope. For the adjacent build-versus-buy question, see outsourced compliance team.