How is a Fractional CISO different from a classic consulting firm?
Consulting firms write recommendations. A Fractional CISO owns the result. On retainer, ODCUS steers the security program like an employed CISO. Defined time allocation, no fixed costs, no junior handoff.
How much does a Fractional CISO cost compared to a full-time CISO?
A full-time CISO in Switzerland costs between CHF 150'000 and 250'000 per year (jobs.ch salary data), plus benefits, recruiting and months of searching. The CISO Retainer starts at CHF 4'900 per month, so CHF 58'800 per year, cancellable after six months. Operational within two weeks instead of after months of recruiting.
We already pay for many security tools. Will this make it more expensive?
Usually not. First step in every engagement: what do you already have, what works, what can go. In most engagements license costs go down while coverage goes up. Cost optimization is part of the engagement, not an add-on.
We are only 80 employees. Aren't we too small for a CISO?
For a full-time CISO, often yes. For a fractional one, that is exactly the target audience. ODCUS works with companies from 50 employees, typically 1 to 4 days per week, 3 to 12 months.
What if we already have an IT lead or security officer?
Common case, good setup. ODCUS complements the line function with methodology and reporting and takes the interface to executive board and audits. Your team keeps day-to-day responsibility but gains time and depth. Also available as pure sparring: second opinion, coaching and preparation of executive and board meetings. Bookable as its own package: CISO Sparring, from CHF 2'400 per month.
What if we already have an ISMS that nobody actually follows?
The most frequent case. ODCUS does not produce new paper but reactivates what exists: what is still current, what must go, where processes are missing, who owns what. Documentation often shrinks by half and the rest becomes workable.
Which frameworks and regulations do you cover?
ISO 27001, NIST CSF, CIS Controls, Swiss ISG, Swiss nDSG, NIS2, DORA, FINMA Circular 2023/01. SOC 2 and TISAX on request.
How quickly can you start?
Intro call within one week. Scoping plus fixed-price offer within five more working days. Kickoff within two weeks of contract signing, depending on scope.
Do you recommend compliance or ISMS tools?
When size and maturity fit, yes. ODCUS is vendor-independent and does not accept commissions from vendors. The tool that gets recommended depends on context, not on a margin. If an existing tool does the job, it stays.
What is the minimum term? What if it does not fit?
The retainer is cancellable monthly after 6 months. Cyber Assessment and ISMS Implementation are fixed-price projects with defined endpoints. If after the first month it becomes clear the setup does not work, ODCUS says so and ends cleanly.
