Planning bands
Three ways to structure ongoing security governance.
Use these as budgeting estimates rather than a tariff. A price becomes a commercial offer only when actual delivery capacity, audit and specialist dependencies, hours and service levels have been agreed in writing.
| Programme | Indicative monthly fee | Typical remit |
|---|---|---|
| Managed ISMS | £2,250–£3,000 | One active ISMS, evidence rhythm, risk actions, audit calendar |
| Virtual CISO / Governance | £3,750–£5,500 | Senior security oversight, risk roadmap, management reporting plus defined operating support |
| Security Assurance Office | £5,500–£8,000+ | Governance plus a bounded monthly allowance for questionnaires and supplier assurance |
What drives scope
We price the actual operating burden.
Headcount is a rough input, not a sufficient price formula. Two companies with the same number of staff may have very different environments, vendor exposure, customer requests and security obligations. The initial discovery assesses that difference.
- Number of legal entities and certifications in scope
- Quality and freshness of existing evidence and risk registers
- The number of independent frameworks and customer requirements
- Volume and complexity of buyer security questionnaires
- Frequency of board meetings and specialist availability
- Planned surveillance, recertification and other audits
One-off work
Take-on and remediation are scoped separately.
Historic gaps, overdue risk actions, control implementation, an urgent audit recovery project or migration between compliance platforms may be a project before a normal monthly programme is workable. We would assess and price this separately.
Certification-body charges, accredited third-party audits, penetration tests, SOC/MDR services, legal advice and incident response are not implied by the retainer unless the written agreement expressly includes them.
A quoted monthly fee is only useful when responsibilities, capacity, exclusions and change control are written down.
Commercial terms
Records must remain portable.
We recommend maintaining security records in client-controlled systems, agreeing who owns each deliverable, and documenting offboarding from the outset. Contract term, service levels, subcontractors, access rights and data protection provisions are agreed before any work begins.
We will not promise certification, legal compliance, guaranteed response times or a particular audit outcome without a valid contractual and operational basis.
Compare like with like
A £2,500 retainer and a £5,000 retainer may not buy the same function.
A low-cost offer might provide a limited number of adviser hours and scheduled reviews. A broader contract may include evidence maintenance, customer-questionnaire operations and executive reporting. Neither is automatically the better deal: the buyer should calculate which work remains on its own payroll.
This comparison is a procurement checklist, not a claim that every tier includes every item. Pricing bands are preliminary until the service operator approves the capacity plan.
| Question | Basic ISMS operation | Fractional leadership | Expanded assurance |
|---|---|---|---|
| Who drives risk decisions? | Client management | Named security leader advises board | Leader plus evidence desk |
| Who updates the register? | Coordinator | Scoped support | Coordinated operational desk |
| Are questionnaires included? | Normally separate | Scoped advisory only | Defined allowance and approval workflow |
| What is excluded? | Control implementation | Unlimited executive availability | Unlimited complex questionnaires |
The hidden cost
Budget for the backlog as well as the monthly rhythm.
Before agreeing an operating retainer, estimate overdue policy reviews, evidence gaps, missing risk owners, expired supplier documents and approaching external audit dates. A distressed ISMS requires a take-on project; including all this effort inside the first monthly payment creates poor incentives for both sides.
For procurement, ask every provider for a first-30-days deliverable list, a capped monthly capacity schedule, subcontractor responsibilities, change-control method and a written exit process. The absence of a price for exceptional work is a risk, not a saving.
Scope the service