We count visits with Google Analytics cookies and Vercel Web Analytics to see which pages help readers most.

Cookie settings
The Assurance Desk

Fractional CISO, LLC review

Advisory firm

A US firm in Massachusetts that provides part-time chief information security officers and prepares companies for SOC 2 and ISO 27001 audits, usually on a fixed retainer.

Relevant if you are preparing for a SOC 2 or ISO 27001 audit and want named, qualified staff

Price Not published
Indemnity cover Not published
How it uses AI Not published
Facts last checked

Not published means we did not find it on the firm's own pages.

Fractional CISO scores

Six scores, each 1 to 5. The evidence for each is further down.

Help when things go wrong 2/5
Qualifications of the people who do the work 4/5
What it publishes about fees 3/5
Knowledge of your sector 3/5
Independence from what it sells 4/5
Who carries the risk if the advice is wrong 2/5

What Fractional CISO offers, and what it publishes

You get named, qualified people. Its team page lists founder Rob Black, RJ Russell, David Lin, Aimee Cardwell, Chinmayee Paunikar and Sean Kelley, each with the CISSP security qualification. The work covers gap analysis, control design, working with your auditor, and SOC 2 Type 1 and Type 2 audit support.

Fractional CISO does not publish a price. It says it generally charges a fixed retainer, paid quarterly, on a three-year contract with an option to cancel early, but gives no figures. It does not publish indemnity insurance or liability terms. Its privacy policy does not say whether it uses AI on client work.

The firm says its clients have never failed a compliance audit; we found no outside source that confirms it. One client outcome carries a name: Jeff Hansen, chief technology officer of WayPath Consulting, cites 'SOC 2 Compliance Achieved'. It shows no software of its own for sale. We found no ISO 42001 AI governance case study.

Strengths

  • Deep bench of named, credentialed staff (multiple CISSP holders, plus CISM, CRISC, CIPM, CDPSE and CMMC-CCP) assigned specifically to SOC 2 and ISO 27001 readiness work.
  • Nine years of continuous operating history (founded June 2017) with Massachusetts filings current through the 2025 Annual Report.
  • Client-outcome evidence is attributed to a named person and company (Jeff Hansen, CTO, WayPath Consulting) rather than only anonymous quotes.
  • Publishes its pricing STRUCTURE (fixed quarterly retainer, three-year term, cancellation option) even though it withholds exact rates.

Things to check

  • No dollar pricing, hourly rates, or fee ranges are published anywhere on the site; only the retainer model and contract length are disclosed.
  • The firm's own privacy policy is silent on whether or how AI tools are used on client engagements or where client data goes if AI is used.
  • The claim of a perfect audit pass rate is unaudited and not corroborated by any independent source found.

Common questions

Does Fractional CISO publish its rates?

No. Its pricing page describes a fixed retainer, paid quarterly, over a three-year contract with an early-cancellation option, but gives no dollar figures.

What does Fractional CISO help with?

SOC 2 and ISO 27001 audit preparation, from gap analysis and control design to working with the auditor. Staff biographies also show work on HIPAA, a US health privacy law, and on CMMC.

Does it say how it uses AI on client work?

No. Its privacy policy covers data retention and security controls but says nothing about its own use of AI tools.

Is its claim that clients never fail audits confirmed elsewhere?

Not that we found. The firm says its clients have never failed a compliance audit, but we found no outside source that confirms it.

Evidence for each Fractional CISO score

Show our working

Notes behind each thing to check

  • No dollar pricing, hourly rates, or fee ranges are published anywhere on the site; only the retainer model and contract length are disclosed. (Reviewed fractionalciso.com/pricing/ on 2026-09-20; it names the billing model and a pricing-calculator lead form but no rate figures)
  • The firm's own privacy policy is silent on whether or how AI tools are used on client engagements or where client data goes if AI is used. (Reviewed fractionalciso.com/privacy-policy/ on 2026-09-20; the data-handling clause covers retention and security controls only, with no AI-use language)
  • The claim of a perfect audit pass rate is unaudited and not corroborated by any independent source found. (Homepage/blog states 'Our clients have never failed a compliance audit, you won't either' with no third-party citation)
Six criteria, each scored 1 to 5, with the evidence for each.
CriterionScoreEvidence
Help when things go wrong 2/5 Only a self-reported, uncorroborated claim of a perfect audit pass rate exists; no independent case of regulatory defence or incident handling was found.
Qualifications of the people who do the work 4/5 Team page publicly names multiple CISSP holders plus CISM, CRISC, CIPM, CDPSE and CMMC-CCP credentials across its vCISO principals.
What it publishes about fees 3/5 Retainer structure, billing cadence and three-year contract term are disclosed, but no dollar rates or ranges appear anywhere on the site.
Knowledge of your sector 3/5 Staff bios show SOC 2, ISO 27001, HIPAA and CMMC engagement experience across sectors, but no single vertical specialism is claimed.
Independence from what it sells 4/5 The firm sells advisory retainers directly and shows no owned GRC software product or automation-platform referral funnel.
Who carries the risk if the advice is wrong 2/5 No professional-indemnity or errors-and-omissions insurance disclosure, guarantee terms, or liability language appears on the public site.

Sources for Fractional CISO

  • Fractional CISO, LLC is registered as an active Massachusetts domestic LLC. (Status: Active; Company Number 001195076; filings current through the 2025 Annual Report filed 20 Oct 2025) (opencorporates.com, checked 20 September 2026)
  • The firm's registered address and agent are on file with the Massachusetts register. (275 Grove Street, Suite 2-400, Auburndale, MA 02466; registered agent Robert Black) (opencorporates.com, checked 20 September 2026)
  • The firm was founded by Rob Black in June 2017. ("In June 2017, Rob pulled the trigger. He quit his job and Fractional CISO was born.") (fractionalciso.com, checked 20 September 2026)
  • The firm names multiple credentialed staff running SOC 2 / ISO 27001 engagements. (Team page lists Rob Black CISSP, RJ Russell CISSP, David Lin CISSP/CIPM/CDPSE/CISM/CRISC, Aimee Cardwell CISSP, Chinmayee Paunikar CISSP, Sean Kelley CISSP among others) (fractionalciso.com, checked 20 September 2026)
  • The firm's fee model is a fixed retainer, not hourly billing, with no published dollar rates. ("Generally, Fractional CISO's pricing is set as a fixed rate retainer, payable quarterly"; contracts run 3 years with an early-cancellation option) (fractionalciso.com, checked 20 September 2026)
  • The firm's own privacy policy names its legal entity as 'Fractional CISO, LLC'. ("Fractional CISO, LLC") (fractionalciso.com, checked 20 September 2026)

Seeking ISO 42001 certificationFirst DPO or AI policyRegulated sectors

Where this firm appears

If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.

This is an independent editorial guide, not legal advice.