Senior security leadership, on retainer
The gap between IT and accountability
Most mid-sized South African organisations have competent IT and no security leadership. The result is predictable: decisions are made on technical grounds without anyone weighing business risk, the board receives reassurance rather than evidence, and nobody owns the answer when a client questionnaire, an insurance renewal, or a regulator arrives.
A permanent CISO may be the right answer for a large or complex organisation. For many mid-sized organisations, however, the cost of a full-time executive appointment is difficult to justify, and the role may not yet require full-time capacity.
A fractional CISO provides access to senior security leadership, accountability, and continuity at a level of time and cost proportionate to the business's needs.
What the retainer covers
Board and executive reporting
A standing security report your board can act on, written in the language of governance and business risk rather than the language used to sell security tools.
Risk ownership
A maintained cyber risk register, with treatment decisions recorded, owned and reviewed.
Policy and standards
A policy set that reflects how the organisation actually operates, reviewed on a defined cycle.
Third-party and client assurance
Vendor risk assessment, and responses to the security questionnaires your own clients send you.
Incident readiness
Response plans, tabletop exercises, and a defined escalation path before it is needed rather than during.
Technical direction
Many SMEs already use Microsoft 365 for email, collaboration and Office applications. Where Microsoft 365 Business Premium is licensed, the same subscription provides a cost-effective security foundation through Microsoft Entra ID, Conditional Access, Microsoft Intune, Defender for Business and Defender for Office 365. SACyber provides independent guidance on configuring and governing these capabilities effectively, measuring the resulting posture through Microsoft Secure Score, and identifying where an additional product is—or is not—needed.
How the engagement runs
Structured in hours, reviewed every six months
Retainers are structured in monthly hours rather than fixed days, which keeps the arrangement useful in a quiet month and available in a difficult one.
A typical engagement begins with a four- to six-week baseline — understanding the environment, establishing the risk register, and producing the first board report. From there, the rhythm settles into monthly working sessions, quarterly board reporting, and availability in between.
Engagements are reviewed every six months. If the organisation has matured to the point where the retainer is no longer earning its cost, you will hear that from me.