# Fractional CISO, LLC - **Type:** Advisory firm - **Website:** https://www.fractionalciso.com - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A US firm in Massachusetts that provides part-time chief information security officers and prepares companies for SOC 2 and ISO 27001 audits, usually on a fixed retainer. ## Fractional CISO scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 2/5 Only a self-reported, uncorroborated claim of a perfect audit pass rate exists; no independent case of regulatory defence or incident handling was found. ### Qualifications of the people who do the work: 4/5 Team page publicly names multiple CISSP holders plus CISM, CRISC, CIPM, CDPSE and CMMC-CCP credentials across its vCISO principals. ### What it publishes about fees: 3/5 Retainer structure, billing cadence and three-year contract term are disclosed, but no dollar rates or ranges appear anywhere on the site. ### Knowledge of your sector: 3/5 Staff bios show SOC 2, ISO 27001, HIPAA and CMMC engagement experience across sectors, but no single vertical specialism is claimed. ### Independence from what it sells: 4/5 The firm sells advisory retainers directly and shows no owned GRC software product or automation-platform referral funnel. ### Who carries the risk if the advice is wrong: 2/5 No professional-indemnity or errors-and-omissions insurance disclosure, guarantee terms, or liability language appears on the public site. ## Sources for Fractional CISO Every line carries the page it was read on and the date it was checked. - Fractional CISO, LLC is registered as an active Massachusetts domestic LLC. - Source: https://opencorporates.com/companies/us_ma/001195076 - Checked: 2026-09-20 - The firm's registered address and agent are on file with the Massachusetts register. - Source: https://opencorporates.com/companies/us_ma/001195076 - Checked: 2026-09-20 - The firm was founded by Rob Black in June 2017. - Source: https://www.fractionalciso.com/about/ - Checked: 2026-09-20 - The firm names multiple credentialed staff running SOC 2 / ISO 27001 engagements. - Source: https://www.fractionalciso.com/team/ - Checked: 2026-09-20 - The firm's fee model is a fixed retainer, not hourly billing, with no published dollar rates. - Source: https://www.fractionalciso.com/pricing/ - Checked: 2026-09-20 - The firm's own privacy policy names its legal entity as 'Fractional CISO, LLC'. - Source: https://www.fractionalciso.com/privacy-policy/ - Checked: 2026-09-20 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Not published - Credentials: Published - Independent accreditation: Not published - Client results: Published - How it uses AI: Not published ## Strengths - Deep bench of named, credentialed staff (multiple CISSP holders, plus CISM, CRISC, CIPM, CDPSE and CMMC-CCP) assigned specifically to SOC 2 and ISO 27001 readiness work. - Nine years of continuous operating history (founded June 2017) with Massachusetts filings current through the 2025 Annual Report. - Client-outcome evidence is attributed to a named person and company (Jeff Hansen, CTO, WayPath Consulting) rather than only anonymous quotes. - Publishes its pricing STRUCTURE (fixed quarterly retainer, three-year term, cancellation option) even though it withholds exact rates. ## Things to check Each one carries the factual basis it rests on. - No dollar pricing, hourly rates, or fee ranges are published anywhere on the site; only the retainer model and contract length are disclosed. - Basis: Reviewed fractionalciso.com/pricing/ on 2026-09-20; it names the billing model and a pricing-calculator lead form but no rate figures - The firm's own privacy policy is silent on whether or how AI tools are used on client engagements or where client data goes if AI is used. - Basis: Reviewed fractionalciso.com/privacy-policy/ on 2026-09-20; the data-handling clause covers retention and security controls only, with no AI-use language - The claim of a perfect audit pass rate is unaudited and not corroborated by any independent source found. - Basis: Homepage/blog states 'Our clients have never failed a compliance audit, you won't either' with no third-party citation ## Where this firm appears - [Do you need a data protection officer?](https://theassurancedesk.com/best/first-appointment) - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.