Briefing
Most small and mid-sized businesses do not need a full-time chief security officer or chief technology officer. They do need someone accountable for the decisions those roles make. Fractional leadership provides that on a part-time basis.
The two roles solve different problems. A fractional CISO owns risk: the risk assessment, the risk register, policy, security questionnaires from customers, and evidence for examiners or auditors. A fractional CTO owns direction: architecture, platform choices, build versus buy, and how new locations and systems fit together. Replacing a phone system, moving to hosted voice, or consolidating carriers is a CTO decision with security consequences.
The frameworks have made governance explicit. NIST added a Govern function in CSF 2.0, released February 26, 2024. The first goal in CISA's Cybersecurity Performance Goals 2.0 is establishing cybersecurity roles and responsibilities, and CISA notes third parties can help fill them.
What to do
- Start with a CISO if a customer, examiner or prime contractor is asking security questions nobody can answer, or the last risk assessment is out of date.
- Start with a CTO if systems grew without a plan, a major platform or phone system decision is coming, or spending keeps rising without explanation.
- If you are growing in a regulated market, plan for both and keep them on one roadmap.
- Get the scope in writing: named person, hours or deliverables, meetings, and response times.
- Make sure policies, risk registers and diagrams belong to you when the engagement ends.
How to verify
- Ask for a sample board or owner update before you sign.
- After 90 days, check that you have a dated risk register or a written technology roadmap, depending on the role.
- Confirm the firm advising you is not also auditing an environment it operates.
Sources
- NIST, NIST Releases Version 2.0 of Cybersecurity Framework, Feb 26, 2024
- CISA, Cybersecurity Performance Goals 2.0
Questions about your phones, network or IT? Contact Texwan.