What does an external CISO cost?
Answer two short questions about the size and regulation of your company and get an instant recommendation for the right model, from strategic advisory support from CHF 30,000 per year through an operational vCISO to an interim CISO. For comparison: an internal CISO role costs around CHF 180,000 to 250,000 per year. Indicative, not a binding offer.
Your right CISO model in two questions
How much chief information security officer you need depends mainly on your size and your regulation. The calculator captures both and recommends the right model and the indicative cost.
A CISO, in Switzerland often called ISO, is responsible for information security towards management and the board. Many companies need the function but not an expensive full-time internal role. As an external CISO or vCISO we take on the role at the right scope: strategically advising, operationally steering or as an interim mandate in transition and crisis situations.
The calculator below recommends the right model based on size and regulation and states the indicative annual cost. We prepare the exact offer with hour contingent and steering rhythm after a short conversation.
Calculate the CISO model and cost
Choose company size and regulation. You instantly see the recommended model and the entry cost per year.
Your recommendation
Choose size and regulation above to see your recommendation.
from CHF 30,000 / year
from CHF 60,000 / year
from CHF 75,000 / year
on request
Advisory CISO
- Strategic guidance, quarterly reviews with management
- Security strategy, roadmap and reporting to the board
- Suited to SMEs with their own IT lead
vCISO (fractional)
- Operational and strategic steering, monthly rhythm
- ISMS operation, audit preparation and incident management
- Interface to IT, data protection, authorities and customers
Interim CISO
- Near-full-time mandate for transition, crisis or audit preparation
- For regulated or large organisations with high steering needs
- Building an internal succession included
Indicative, not a binding offer. Compared with around CHF 180,000 to 250,000 for an internal CISO role. We prepare the exact offer after a short conversation.
For a tailored estimate and a fixed-price quote, please use the quote form or the contact form.
Thank you, we received your request.
We reply within one business day with your tailored quote. If it is urgent, book a call directly.
What drives the cost of an external CISO
Four factors explain most differences. The calculator covers the two most important; we clarify the rest in conversation.
Company size
More employees and systems mean more steering effort. As a guide we plan around 4 hours per week under 50 employees, 8 hours up to 250 and 16 hours above.
Regulation and data sensitivity
FINMA, NIS2, DORA, the GDPR or healthcare requirements significantly increase the steering effort, reporting and audit support needed. Critically regulated organisations need a tighter mandate.
Existing maturity and IT lead
If an internal IT lead and first security processes already exist, the strategic advisory role is often enough. Without an internal role the vCISO also takes on operational steering.
Trigger and urgency
An audit, a customer requirement, an incident or a certification deadline change the scope needed. For transition and crisis situations there is the near-full-time interim mandate.
FAQ on CISO cost
What does an external CISO or vCISO cost?
Strategic advisory support starts at CHF 30,000 per year, the operational vCISO at CHF 60,000 per year. A near-full-time interim mandate is calculated individually. For comparison, an internal CISO role costs around CHF 180,000 to 250,000 per year. The calculator above gives you a recommendation in two questions.
What is the difference between advisory, vCISO and interim?
Advisory is strategic guidance on a quarterly rhythm, ideal for SMEs with their own IT lead. The vCISO steers operationally and strategically on a monthly rhythm, runs the ISMS and prepares audits. The interim mandate is near-full-time for transition, crisis or audit preparation.
Is the calculated recommendation binding?
No. The calculator provides an indicative recommendation, not a binding offer. We prepare the exact offer with hour contingent and steering rhythm after a short conversation in which we clarify maturity, internal capacity and trigger.
Does the external CISO also take on the ISO role?
Yes. In Switzerland the function is often called information security officer (ISO). We take on the role towards management, the board, authorities and customers at the agreed scope and coordinate with your IT and data protection as needed.
Prefer to talk directly?
In a short intro call we assess your specific case and give you a binding offer with an hour contingent.