Fractional CISO pricing
A fractional CISO costs less than a full-time hire and comes with real numbers, not a quote wall. Fixed-scope work runs $1,500 to $20,000; retainers run $4,000 to $12,000 a month. All prices in USD.
Security Questionnaire Rescue
A customer sent a security questionnaire and your deal is stalled. Fast turnaround.
Learn more →Audit-Readiness Gap Assessment
Find out exactly where you stand and get a scored plan to audit-ready.
Learn more →SOC 2 Readiness Sprint
The full path to audit-ready: scoping, controls, evidence, auditor management.
Learn more →Cloud Security Review
A review of your cloud and infrastructure for the gaps found first.
Learn more →What sets the SOC 2 readiness sprint price: Type I or Type II, how many trust criteria are in scope, your company size and number of systems, and how much is already in place.
Fractional CISO retainer
Ongoing security leadership on a monthly retainer. Three tiers, sized to where you are.
Essentials
About 10 hours a month
- About 10 hours a month of senior security leadership
- Async access for security questions and vendor or questionnaire support
- Ownership of your compliance program status, keeping SOC 2 or ISO on track
- Monthly security leadership call
- Security questionnaire support, up to two or three a month
- Quarterly cloud and security posture check
- Your program run inside the tools you already use, with controls, evidence, and deadlines kept current by us.
Growth
About 20 hours a month
- Everything in Essentials, plus:
- About 20 hours a month of senior security leadership
- Active audit-period support: driving SOC 2 or ISO to completion, not just upkeep
- Board and investor-facing security reporting
- Deeper cloud and infrastructure posture work: access, networking, logging
- Priority turnaround on questionnaires and security reviews
- Security roadmap ownership and guidance for your team
- Risk register and questionnaire log kept current for you.
Command
About 30 to 35 hours a month
- Everything in Growth, plus:
- About 30 to 35 hours a month of senior security leadership
- Full audit management: we run the SOC 2 or ISO engagement end to end
- Multi-framework programs (SOC 2, ISO 27001, and more in parallel)
- Board and investor security reporting on a set cadence
- Vendor risk and third-party review program
- Priority access and fastest turnaround across all work
Founding client rate: our next three retainer clients get Essentials at $3,000/mo, locked for 12 months, in exchange for a reference and a short case study. After 12 months it converts to the standing Essentials rate. Three spots.
Xorabyte takes a maximum of three retainer clients at a time, so each gets senior attention. When those spots are full, new clients join a waitlist.
Engagements begin with a short written agreement (MSA / engagement letter).
Based in the Greater Toronto Area, working remotely with startups across Canada and the US.
We work inside your tools
We run your program inside the tools you already use, including a compliance platform such as Vanta or Drata if you have one. If you do not, we keep your controls, evidence, risks, and deadlines tracked for you and walk you through status every month. No new software to learn or staff.
Pricing FAQ
What does a fractional CISO cost?
A fractional CISO retainer at Xorabyte starts at $4,000 a month for Essentials, runs $7,000 to $7,500 a month for Growth, and $10,000 to $12,000 a month for Command. Fixed-scope work is separate: a $6,000 to $9,000 gap assessment, a $12,000 to $20,000 SOC 2 readiness sprint, and a security questionnaire rescue from $1,500. Prices are in USD.
What drives the SOC 2 readiness sprint price?
What sets the price: Type I or Type II, how many trust criteria are in scope, your company size and number of systems, and how much is already in place.
Do you cap how many clients you take?
Yes. Xorabyte takes a maximum of three retainer clients at a time, so each gets senior attention. When those spots are full, new clients join a waitlist.
Do we need to buy new software?
No. We work inside the tools you already use, including a compliance platform such as Vanta or Drata if you have one. If you do not have one, we keep your controls, evidence, and deadlines tracked for you and walk you through status every month.
How do engagements start?
Engagements begin with a short written agreement (MSA / engagement letter). We scope the work on a call, then put it in writing before anything begins.
Comparing this to a full-time hire? See fractional CISO vs full-time CISO for cost, scope, and accountability side by side.