What is the difference between fixed-scope and retainer pricing?

Fixed-scope work is a defined project with a flat price: a security questionnaire answered, a gap assessment, a SOC 2 readiness sprint, or a cloud security review. A retainer is ongoing monthly leadership where the practitioner owns your program over time. Most startups start with a fixed-scope engagement, then move to a retainer once they see the value.

Do Canadian privacy laws affect the cost?

They can affect scope, which affects price. Operating under PIPEDA nationally, and Quebec Law 25 if you handle Quebec residents' data, adds requirements that a good fractional CISO folds into the same program. It rarely changes the pricing model, but it can change how much work is in scope.

How Much Does a Fractional CISO Cost in Canada?

A fractional CISO in Canada typically costs a few thousand dollars a month on a retainer, or a fixed fee per project. Senior practitioners often bill in the range of $200 to $500 per hour, retainers commonly land between roughly $3,000 and $10,000 per month, and fixed-scope work is usually a flat quote. The exact number depends on hours, scope, and how much is already in place.

That is the short answer. Below is what actually drives the price, and how to think about it as a founder deciding whether to hire, outsource, or wait.

Why founders ask this question at all

Almost nobody shops for a fractional CISO out of curiosity. The question shows up because something forced it: an enterprise customer blocked a deal until you have SOC 2, a fundraise put your security posture under diligence, a cyber-insurance renewal now requires controls you have not implemented, or the founder has quietly become the de facto security owner and it is pulling them off the product.

In every one of those cases the real question behind the price is simple. What does it cost to make this problem go away without hiring a full-time executive? That framing matters, because it changes how you read the numbers.

The three ways fractional CISOs price

There are really only three pricing models in this market, and most practitioners use some blend of them.

Hourly. Straightforward ad hoc advice, billed by the hour. In Canada, senior security leaders commonly bill $200 to $500 per hour. Hourly is fine for a one-off question, but it gets expensive fast the moment the work becomes ongoing, and it gives you no cost certainty.

Fixed scope. A defined project with a flat price. This is the cleanest model for startups because you know the number before you start. A security questionnaire answered, an audit-readiness gap assessment, a SOC 2 readiness sprint, or a cloud security review all fit here.

Monthly retainer. Ongoing leadership where the practitioner owns your security and compliance program over time. This is what people usually mean by "fractional CISO." Retainers in Canada commonly run between roughly $3,000 and $10,000 per month depending on hours.

What actually moves the number

Two engagements that look similar can be priced very differently. Here is what drives the spread.

Hours per month. The single biggest lever on a retainer. A program in steady-state upkeep needs far fewer hours than one being driven through an active audit. Ten hours a month and twenty-five hours a month are different products at different prices.

How much is already in place. A team that already has documented policies, access reviews, and logging needs less remediation than a team starting from zero. The more groundwork exists, the less a readiness engagement costs.

Scope of the framework. SOC 2 Type I is lighter than Type II. One trust criterion is lighter than five. ISO 27001 has its own scope drivers. The more that is in scope, the more work, and the higher the price.

Company size and systems. More systems, more environments, and more people mean more controls to implement and more evidence to collect. A ten-person startup and a hundred-person scale-up are different jobs.

Regulatory overlay. Canadian startups operate under PIPEDA, and any team handling data on Quebec residents also falls under Quebec Law 25. A good fractional CISO folds these into the same program, but they can expand what is in scope.

Fractional versus a full-time hire

The reason fractional exists is the gap between what a startup needs and what it can justify hiring. A full-time CISO in Canada commonly commands a total compensation package well into the low-to-mid six figures once salary, equity, and benefits are counted. For a company that needs senior security judgment a few days a month, that is a poor fit on both cost and utilization.

A fractional CISO closes that gap. You get the seniority and the accountability without carrying a full executive salary, and you can scale the hours up during an audit and back down afterward. For most startups between roughly 20 and 200 people, that is the right shape until security becomes a full-time job on its own.

What Xorabyte charges

We publish our numbers instead of hiding them behind a call. The full ladder is on the pricing page, but in short:

Security Questionnaire Rescue: $1,500, fast turnaround for a stalled deal.
Audit-Readiness Gap Assessment: $4,000, a scored plan to audit-ready.
SOC 2 Readiness Sprint: $6,000 to $12,000, the full path run for you.
Cloud Security Review: $2,500 to $5,000.
Fractional CISO Retainer: Essentials from $4,000 a month, Growth $6,000 to $8,000 a month.

We cap the number of retainer clients we take, and our first three retainer clients get a founding-client rate. The point of publishing this is simple: you should be able to budget before you ever get on a call.

How to decide

If a single deal is blocked, start with the smallest fixed-scope engagement that unblocks it, usually a questionnaire rescue or a gap assessment. If security has become an ongoing drag on the founder or an engineer, a retainer will almost always cost less than the time you are currently losing. And if you are staring down an audit, a readiness sprint gives you a dated plan instead of a guess.

The fractional CISO services page walks through how each engagement works. If you are in the GTA, we also work with Toronto startups locally and across Canada remotely.

Ready to put a number on it?

The fastest way to get a real figure for your situation is a short scoping call. Tell us what triggered the need, and you will leave with a clear path and a price, not a sales pitch. Book a call.