Search hans.study
Indexed across articles, news, KB updates, knowledge base, books, learning, and tools. Press Esc to close.
// FRACTIONAL CISO · HANS STUDY · ONTARIO, CANADA
Retained, part-time security leadership for organizations that need a CISO's judgment but cannot justify a full-time executive. Security strategy, board and executive reporting, program design, risk and compliance ownership, vendor decisions, and incident oversight. Delivered on-site, hybrid, or fully remote as a virtual CISO. Independent, with CISSP held.
Most organizations reach a point where security has outgrown the person handling it on the side. The board is asking questions. The cyber insurance renewal has a longer questionnaire than last year. A compliance framework is now a contract requirement. A customer security review landed on someone's desk and nobody owns the answer. The work needs an executive who can set direction and stand behind it, but the headcount and the budget for a full-time CISO are not there.
A fractional CISO closes that gap. You get the strategy, the accountability, and the boardroom credibility of a senior security executive, on a retained, part-time basis, sized to what the organization actually needs. Not a full-time salary. Not a project that ends when the report is filed. A standing security leader who shows up on a regular cadence and owns the program between sessions.
I have worked across enterprise networks, physical security, OT, and the compliance frameworks that govern them, in government, defence, critical infrastructure, and enterprise environments across Canada and the United States. The fractional CISO work draws on all of it, because real security leadership does not stop at the IT boundary.
A written security strategy tied to the actual risks the organization carries, with a roadmap that sequences the work by impact rather than by whatever the last vendor demo emphasized. Something the leadership team can fund and the technical team can execute.
Security translated into the language the board speaks: risk, exposure, cost, and the trade-offs behind each decision. Regular reporting that holds up under scrutiny from auditors, insurers, and customers, without burying the room in jargon.
Policies, standards, and the operating rhythm that turns them into practice. Access governance, asset and vendor inventory, change control, and the documentation that proves the program exists when somebody asks for evidence.
Ownership of the framework the organization is working toward or maintaining: CMMC, CPCSC, NIST SP 800-171, NIST SP 800-53, ISO/IEC 27001, NERC CIP, ITSG-33, or GO-ITS. Gap assessment, control mapping, evidence collection, and audit defence, run as a program rather than a fire drill.
Independent judgment on the security and technology decisions that are expensive to reverse. What to buy, what to consolidate, what to retire, and which integrator proposals hold up. No resale relationship steering the answer.
A defined escalation path and a leader who can run the room when something goes wrong. Incident response planning before the event, and senior oversight during it, so the organization is making decisions instead of improvising them.
The controls and the evidence that insurers and auditors actually ask for, in place before the questionnaire arrives. Honest answers on the application, and a posture that backs them up.
Mentoring the internal team, setting the technical bar for security hires, and giving an IT group that inherited security responsibility a senior voice to escalate to. The goal is to make the organization more capable, not more dependent.
The engagement model fits the organization, not the other way around. The work is the same. The delivery is whatever the situation calls for.
A CISO who also sells you the platform has a conflict baked into every recommendation. The fractional CISO work carries no resale relationship, no license revenue, and no service contract to protect. The advice on what to buy, what to keep, and what to walk away from reflects the organization's risk and budget, not a partner quota.
It also reaches further than most security leadership. The same person who can write the board report can read a switch configuration, size a video surveillance deployment, segment an OT network, and tell you whether the integrator's design will hold up. Security leadership that understands the infrastructure underneath it, not just the policy on top.
Project-based strategy and technology advisory for organizations that need direction without a standing retainer.
Certification readiness and control work for defence supply chain and Canadian programs.
The network and infrastructure layer the security program depends on.
Security leadership that extends into the control systems most CISOs never touch.
A fractional CISO is an experienced Chief Information Security Officer who works for an organization on a part-time, retained basis instead of as a full-time employee. The organization gets executive security leadership, strategy, board reporting, program ownership, and accountability, at a fraction of the cost and time commitment of a full-time hire. It suits organizations that have outgrown ad hoc security but cannot justify a full-time CISO salary.
They describe the same service with a difference in delivery. A fractional CISO usually implies a regular, retained cadence with some on-site presence and a closer working relationship with the leadership team. A virtual CISO, or vCISO, is delivered remotely and on-demand. In practice the line blurs, and most engagements are hybrid. Hans Study provides both, scoped to whatever the organization actually needs rather than to a label.
The usual triggers are a compliance framework becoming a contract requirement, a board or owner asking for security accountability, a cyber insurance renewal that now demands controls the organization cannot evidence, a customer security review with no clear owner, growth that has outpaced the security function, or an incident that exposed the lack of senior security leadership. If security decisions are being made by people without the authority or the experience to own them, that is the signal.
The work covers security strategy and roadmap, board and executive reporting, security program and governance design, risk management, ownership of the compliance framework, vendor and platform decisions, incident response planning and oversight, cyber insurance and audit readiness, and support for the internal team. The mix is set by the organization's priorities and revisited as they change.
Hans Study holds CISSP and has worked across enterprise networks, physical security, OT and ICS, and the compliance frameworks that govern them, in government, defence, critical infrastructure, law enforcement, and enterprise environments. The fractional CISO work combines executive-level security leadership with hands-on infrastructure depth, which is uncommon at the CISO level and matters when the strategy has to survive contact with the technical reality.
Yes. Hans Study is based in Ontario, Canada, and provides fractional and virtual CISO engagements across Canada and the United States. Remote delivery makes location largely irrelevant, and on-site time is scheduled where the engagement calls for it.
Yes, and that is a deliberate part of the offering. Most CISOs come from an IT background and stop at the IT boundary. Hans Study covers IT, physical security, and OT and ICS, so the security program accounts for the cameras, access control, and control systems that sit on the same networks and carry real risk, rather than treating them as somebody else's problem.
A fractional or virtual CISO engagement starts with a conversation about what the organization needs to own and what it is missing today. No retainer commitment to have that conversation. The scope, cadence, and cost get written down before anything starts.
Related work: a startup taken from no compliance function to ISO 27001 ready as fractional CISO.
Delivered remotely, or through the DHD, a remote access device shipped to site.
Two tools run by default to help me understand how the site is used. You can turn either off at any time. Cloudflare's server-side analytics is always on and never sees your identity.