Pillar 06 — The Fractional CISO Operating System

Pillar 06 of the CISO Marketplace AI Security Department, built DIY. The capstone the other five feed — the managed fractional CISO pillar is the done-for-you version.

A fractional practice is not "a CISO, but part-time" — it is an operating system. This builds it around the one thing the AI vCISO platforms structurally cannot do: a human-owned register that aggregates every security stream into board-legible, quantified risk.

The register is the hub, and the hub is the whole job. Security produces findings from many places at once — a compliance gap analysis, a code scanner, a pentest, the SOC's alerts, an incident. Left alone they live in five tools speaking five languages. The junior version of the job is checking each tool. The senior version — the one worth $500K-equivalent leadership — is aggregating them into one register a human owns, and conducting it out to the board in the one language the board acts on: money.

You are not competing with the AI vCISO platforms; you are the layer they cannot replace. Cynomi, Centraleyes and the rest generate policies and assessments well, cutting deliverable time by roughly half, and run right they are your force multiplier. What they structurally do not do: own the risk — a report cannot sit in a board meeting and be accountable for the number; roll up a portfolio, because most are session-centric; make the materiality call, which is a human decision; or carry the relationship. The sales answer when a prospect asks why they need you if the platform writes the policies: the platform writes policies, but it cannot be accountable to your board for whether your $3.2M exposure is acceptable. Bill for judgment; automate the drafting.

The 2026 pricing ladder, so you place a client by risk rather than hope. Advisory at $1,600–$4,000/month for 4–8 hours. Core Program at $5,000–$12,000/month for 12–20 hours — the mid-market sweet spot and where most engagements land. Compliance-heavy at $10,000–$20,000/month for regulated estates. Anchored on the Q1 2026 median placement of $9,500/month for 16 hours with a SOC 2 Type II sign-off and a quarterly board deck, with the four scoping questions that decide which band a client belongs in.

The first 90 days, assessment to first board deck — the quarter in which the client decides whether they bought a report-writer or a leader. Days 1–30 stand up the register, run the gap analysis, and inventory assets by business value rather than IT replacement cost. Days 31–60 turn gaps into a ranked roadmap tied to real financial exposure, and agree a risk appetite before you report against it. Days 61–90 drive the top three to visible progress and deliver the first five-page board deck.

The board deck — five pages, every quarter. Top-3 risks quantified; a fixed metrics dashboard so trends read at a glance; material incidents; compliance posture and trajectory; and asks framed as exposure-reduction per dollar. The most common mistake is putting operational metrics — patch rates, blocked-email counts — on the board's page: those measure the security team's work, not the exposure the board is accountable for. When a director asks how much cyber risk the company is carrying, a patch rate is not an answer.

Cyber risk quantification without six-figure software. Pick a handful of high-exposure scenarios, estimate likelihood and loss with a documented, model-agnostic method, and tie each back to controls so the number moves when you remediate. The rigour that matters to a board is traceability, not the price of the tool.

Practitioner-led with MSP scaling notes throughout, marked as such — what to industrialise (assessment, drafting, the register template) and what never to scale away (the board relationship, the materiality call). The portfolio roll-up is called out as the specific moat the session-centric platforms lack.

Includes the aggregation register schema, a fillable scoping and pricing worksheet, the 90-day onboarding checklist, the five-page board-deck outline, and an engagement-readiness checklist. Market data current as of September 2026 and cited, so the numbers hold up in a live sales conversation.

Works standalone. It is also where the registers from Pillar 02, Pillar 03 and Pillar 04 become one.

And when the register itself is the deliverable. This guide argues that the register is what outlives the engagement. The 2026 AI Risk Register is how you build one for the hardest asset class to govern — a five-plane schema, deterministic classification against the EU AI Act, NIST AI RMF, ISO 42001 and TRAIGA, scoring that derives autonomy and blast radius from an agent's granted tool scopes, and 41 prompts that get you there from an empty repository. This guide is the practice; that one is the artifact, and the pair is cheaper than buying both.

And at enterprise scale. Where the AI register governs one domain, The Enterprise Risk Register is the hub the whole estate feeds into — the engagement as the first-class object, a coverage matrix that knows what has gone stale, treatment modelled as a budgeted project, and priced solutions with the ROI attached. Both registers share canonical entity names, so the family gives you one register with two ingest lanes rather than two that disagree at the board meeting.