Cost Estimates, Worked Examples and Best-Fit Checklists
vCISO pricing in Canada: fractional CISO retainers, day rates and what deliverables to expect
How vCISO and fractional CISO services are priced in Canada: retainers, day rates, fixed-fee assessments, deliverables and how to scope one.
A vCISO (virtual or fractional chief information security officer) is a part-time security leader you contract instead of hiring a full-time executive. vCISO services are usually priced as a monthly retainer for a set number of hours or days, as a fixed-fee project (for example a risk assessment and roadmap), or by the day or hour for ad hoc work. The right model depends on whether you need continuing leadership, such as reporting to owners, answering client and insurer questionnaires and steering a managed security provider, or a one-time plan. Price is only half the comparison: insist on named deliverables, a named person and a way to measure progress.
This guide is part of how to choose a managed security provider. All figures are illustrative.
What a vCISO typically does
| Area | Typical deliverables |
|---|---|
| Risk and planning | Risk assessment, asset inventory review, 12–24-month security roadmap, budget proposals |
| Policies | Information security policy, acceptable use, incident response plan, access control, vendor management |
| Governance | Quarterly report to owners or board, risk register, metrics |
| Third parties | Reviewing your managed security provider's reports and SLA, assessing new software vendors |
| Compliance and assurance | Client security questionnaires, cyber-insurance applications, preparation for CyberSecure Canada certification or other assessments |
| Privacy coordination | Working with your privacy lead on breach procedures and, in Quebec, the person in charge of personal information protection |
| Incidents | Coordinating with response firms, lawyers and insurers during an incident |
A vCISO is not usually the person who monitors alerts or configures firewalls; that is the job of your IT provider or MSSP. A good vCISO makes sure those providers do what you pay for.
Pricing models compared
| Model | Illustrative price (CAD, before tax) | Fits | Watch out for |
|---|---|---|---|
| Monthly retainer, light (about 1–2 days a month) | $2,000–$4,000 a month | SMEs that need ongoing oversight and reporting | Hours that expire unused |
| Monthly retainer, standard (about 3–5 days a month) | $4,000–$10,000 a month | Growing or regulated businesses with many questionnaires | Scope creep into hands-on IT work |
| Fixed-fee assessment and roadmap | $8,000–$30,000 per project | A first plan, or before choosing an MSSP | A report without follow-through |
| Day rate | $1,500–$2,500 a day | Workshops, board sessions, incident support | Hard to budget |
| Hourly | $175–$350 an hour | Occasional questions | Many small invoices |
These are illustrative ranges, not market data. Some MSSPs include a few vCISO hours a quarter in higher tiers; ask whether that time is a real adviser or an account manager.
Scoping a retainer
Illustrative example. A 40-person Edmonton health-technology company needs to answer frequent client security questionnaires, prepare for a client audit and oversee its new MDR provider.
| Task | Days per year (estimate) |
|---|---|
| Quarterly risk report and owner meeting | 4 × 1 = 4 |
| Client questionnaires | 12 × 0.5 = 6 |
| Policy set and annual update | 5 |
| MDR provider monthly review | 12 × 0.25 = 3 |
| Incident response plan and tabletop | 3 |
| Vendor assessments | 3 |
| Total | 24 days |
At an illustrative $1,800 a day, the year costs 24 × $1,800 = $43,200, or $3,600 a month on retainer. A light retainer of $3,000 a month ($36,000 a year) would buy 20 days at that rate, short of the estimate by four days; the company should either cut the questionnaire time (for example by building a reusable answer library) or budget the larger retainer.
Enter the retainer as a fixed cost in the cost estimator next to your monitoring fees, as in the worked cost examples.
Judging quality without testimonials
- Named person. Ask who will do the work and for a summary of their experience and any professional certifications; verify certifications with the issuing body.
- Sample deliverables. Ask for a redacted sample roadmap and a sample board report.
- Independence. Ask whether the vCISO earns commissions on products or services they recommend.
- Canadian context. They should know PIPEDA breach duties, Quebec's Law 25 and, where relevant, Alberta's PIPA and the Critical Cyber Systems Protection Act.
- Continuity. What happens if the named person leaves.
Contract points for a vCISO engagement
- Deliverables and timelines in the statement of work, not just hours.
- Rollover of unused hours for at least one quarter.
- Confidentiality and handling of your risk register and assessments.
- Limits of responsibility: a vCISO advises; decisions stay with management.
- Professional liability insurance held by the provider.
- Notice period to end the retainer, usually 30 to 90 days.
When the vCISO also oversees testing, coordinate with penetration testing and authorisation and the SLA questions for your monitoring provider.
Frequently asked questions
Do I need a vCISO if I already have an MSSP?
Not always. If your MSSP provides clear reports and your owners can make decisions from them, a project-based assessment once a year may be enough. Retainers help when questionnaires, audits or growth create constant demand.
Can a vCISO sign insurance applications for us?
They can prepare answers, but an officer of your business usually signs and is responsible for accuracy. Misstatements can affect coverage.
Is a vCISO the same as a privacy officer?
No. In Quebec, the person in charge of the protection of personal information is by default the person with the highest authority in the enterprise, who may delegate the function. A vCISO can support but is a different role.
How long should a first engagement last?
Many businesses start with a fixed-fee assessment and roadmap, then decide on a retainer.
Sources
- Canadian Centre for Cyber Security — guidance on security programs for small and medium organizations
- Office of the Privacy Commissioner of Canada — accountability and breach duties
- Commission d'accès à l'information du Québec — the person in charge of personal information protection
- Innovation, Science and Economic Development Canada — CyberSecure Canada background
