Fractional CISO or managed IT: which responsibility is missing?

Describe the problem before choosing a title

A leader may hear that the organization needs more security when the immediate problem is an unresolved support queue. Another organization may have responsive technical support but no agreed security priorities. These situations need different help. List the last few security decisions that stalled. For each, ask whether the obstacle was technical capacity, missing authority, unclear ownership, or an unresolved business tradeoff.

Service titles alone will not answer that question. One managed IT agreement may include security planning, while another covers only specified operations. A fractional CISO agreement may include policy work and executive reporting without implementing technical changes. Ask prospective providers to describe deliverables, boundaries, and dependencies in concrete terms. Compare the proposed work with the problem that brought the organization to the discussion.

Separate operating work from decision support

Operating work can include account administration, device management, patch deployment, backup operations, and help desk support when the agreement includes them. Leadership work can include maintaining a risk register, proposing an improvement roadmap, coordinating incident preparation, and explaining choices to executives. Both require knowledge of the organization, but they produce different evidence and need different measures of success.

For operating work, ask what systems the provider covers, when work occurs, and how exceptions reach an accountable person. For leadership work, ask which decisions the adviser will prepare and how recommendations become approved tasks. A report that nobody can act on is an incomplete handoff. A completed technical ticket also does not establish that leadership has accepted the remaining risk.

Write down the shared responsibilities

CISA publishes risk considerations for managed service provider customers, including the need to define shared responsibilities. Use that principle to create a short responsibility table for your own organization. Include access approval, incident escalation, backup restoration, supplier review, security reporting, and employee departures. Name the person who decides, the person who implements, and the person who checks completion.

Include responsibilities retained by the organization. A general manager may authorize operational disruption, a finance leader may approve a payment process change, and a program director may determine whether a volunteer still needs access. A provider can supply evidence and recommendations, but it needs a reliable internal decision path. Specify a deputy when the usual decision maker is unavailable.

Test the proposed handoff with an example

Illustrative example: a district plans to improve remote access for a maintenance vendor. The operations owner explains the maintenance need and acceptable service window. The security adviser evaluates the access approach and proposes review conditions. The IT provider implements the approved configuration. A designated owner confirms that the vendor can perform the required work and that unnecessary permissions are removed.

Ask every proposed provider to walk through a similar scenario. Who opens the request? Who challenges an overly broad permission? Who can approve an exception? Who checks the result? If the answers depend on assumptions about another provider, resolve those assumptions before engagement. This exercise reveals gaps that a list of product names or professional titles may leave hidden.

Choose a manageable starting engagement

A bounded starting engagement might define the current responsibilities, review the highest-priority risks, and produce a short decision agenda. Specify what the organization will receive and what internal time it must provide. Include how recommendations, action records, and working documents will transfer if the engagement ends. Useful support should leave staff able to understand the reasoning behind the plan.

The fractional CISO service at Fractional CISO is a relevant route when the missing work involves ongoing security direction and leadership coordination. If the organization does not yet understand its current gaps, a defined assessment may come first. Evaluate the result by whether decisions become clearer and assigned work progresses, with supporting evidence, rather than by the volume of meetings or reports.

Sources and further reading

• CISA: risk considerations for managed service provider customers

This field note is general educational guidance. Your organization’s requirements, scope, and service arrangements determine the work that applies.