Fractional CISO & CIO
Starts at $1,500/mo
A security leader for a shop that can't hire one full-time
A fractional CISO gives your business a named, experienced security leader — the person who owns your NIST SP 800-171 program, answers the insurance and prime-contractor questionnaires, makes the risk and vendor calls, and drives you toward CMMC assessment-readiness — without the cost of a full-time hire. OneBody offers this from $1,500 a month. For a shop that needs IT direction more than security, the same arrangement is available as a fractional CIO.
What a fractional CISO actually does
Someone owns the security program so no one on your team has to become the accidental expert. That means the policies, the quarterly reviews, the vendor and risk decisions, the answers to insurance and prime-contractor questionnaires, and a straight answer when something goes wrong — a named person accountable for security, not a binder on a shelf.
Who this is for
Three kinds of shops hire this. Defense suppliers with DFARS clauses and a prime’s deadline, who need real 800-171 program ownership. Small businesses whose cyber-insurance renewal now asks for a named security lead. And owners who need IT direction more than security — the fractional CIO tier covers roadmap, vendor, and budget decisions for a shop with no IT leader.
Why us
OneBody Innovation is Corey Payne— fourteen years in Department of Defense IT, cybersecurity, and systems engineering, a U.S. Air Force veteran with time at U.S. Strategic Command. He held Information System Security Officer and Manager (ISSO/ISSM) roles — accountable for a DoD system’s security controls, its System Security Plan, and its POA&Ms. CMMC and NIST SP 800-171 draw from the same NIST control families that role runs, so a prime’s questionnaire asks for the artifacts he already owned, on higher-stakes systems. That is who answers when your questionnaire is due.
The tiers
Four levels, monthly, offered as capacity allows. Gap assessments and audits are scoped and billed separately from the retainer.
- Security Officer on Call$1,500/mo
- The small shop that needs a named security lead: policy oversight, quarterly reviews, questionnaire and insurance answers.
- Fractional CISO — Standard$3,500/mo
- Active program ownership: monthly cadence, your 800-171 program, risk and vendor decisions, incident guidance.
- Fractional CISO — CMMC Intensive$5,000–7,500/mo
- Driving to assessment-readiness against a prime's deadline. Hands-on.
- Fractional CIOFrom $2,000/mo
- No security focus — IT strategy, roadmap, and vendor/budget decisions for a shop with no IT leader.
- Full-time CISO, fully loaded
- well over $200k/yr
- Fractional coverage
- from $1,500/mo
One senior security leader's accountability, at a fraction of a full-time salary.
Frequently asked questions
Is a fractional CISO a real security lead, or just advice?
Both. You get program ownership and decisions, not just a report handed over. On the CMMC-Intensive tier the work is hands-on, driving toward assessment-readiness against your deadline.
How is this different from your CMMC readiness service?
The gap assessment is a fixed-scope project that gets you assessment-ready. The fractional CISO is the ongoing role that keeps you there — and covers everything else a security leader owns. Many shops do the assessment first, then keep a monthly retainer.
What if we just need IT direction, not security?
That's the fractional CIO tier: roadmap, vendor, and budget decisions, and one accountable person for IT strategy — without a security-compliance focus.
Can you also run the CMMC gap assessment itself?
Yes. Gap assessments and audits are scoped and billed separately from the monthly retainer, which is the market norm. See our Cybersecurity & CMMC service for that fixed-scope work.
No security leader, and a deadline coming?
Urgency buyers skip the assessment pitch — talk to us directly.