The Security Leader a Small Company Actually Needs

A company of 100 people does not need a chief information security officer. It needs one named person who holds the security decision rights, a risk register with owners and dates, and a quarterly report the owner actually reads. Buying another tool is easier than deciding who is accountable, which is why so many small firms own the tooling and cannot name the person.

The companies that call me after an incident usually have a firewall, backups, an endpoint agent and an annual penetration test. What they lack is a sentence answering three questions: who can shut a system down, who can accept a risk, and who tells the owner when something has gone wrong.

The 2023 SEC disclosure rules are the clearest published statement of what a security leader is accountable for, and they read like a job description. The version of that job I would build at 50 to 200 people is a charter, a register, and a reporting cadence.

What the SEC asks a security leader to own

In July 2023 the Securities and Exchange Commission adopted rules requiring public companies to describe how they govern cybersecurity risk and to disclose material incidents within four business days of determining that an incident is material. Item 106(c)(2) of Regulation S-K sets out what a registrant must say about management:

Whether and which management positions or committees are responsible for assessing and managing such risks, and the relevant expertise of such persons or members … the processes by which such persons or committees are informed about and monitor the prevention, detection, mitigation, and remediation of cybersecurity incidents; and whether such persons or committees report information about such risks to the board of directors.

The text asks who is responsible and why they are qualified, how those people learn about incidents from prevention through remediation, and whether the information reaches the board. Item 106(c)(1) adds the board’s half: how it is informed about risk, and which committee is responsible. Nothing here asks for a platform, a framework subscription or a headcount. The rule asks for a name, a reporting path, and a cadence.

The rules bind registrants, and as of publication they are still operative. In January 2026 the SEC opened a comment request on all of Regulation S-K, cybersecurity governance included, so build the arrangement you would keep if the rule changed. Item 106 disclosures began with fiscal years ending on or after 15 December 2023, and the incident clock for smaller reporting companies started on 15 June 2024. A 90-person engineering firm is outside the rule; its customers are not. The questionnaires that arrive with security reviews, insurance applications and acquisition diligence ask versions of the same three questions, and a company that cannot answer loses work without being told why.

The four-day clock starts when the company determines the incident is material, not when it discovers it. A company with nobody empowered to make that call has a clock running on someone else’s decision, usually the insurer’s counsel.

The Govern function does not require a CISO

NIST published Cybersecurity Framework 2.0 on 26 February 2024 and added a sixth function, Govern, to the five that had organized the framework since 2014. Govern informs the other five, which assume someone has already decided what risk is acceptable and who may act. GV.RR-01 makes organizational leadership responsible and accountable for cybersecurity risk. GV.RR-02 requires that roles, responsibilities and authorities be established, communicated, understood and enforced. GV.RM-06 requires a standardized method for calculating, documenting, categorizing and prioritizing risk.

Each outcome can be met by two people and a signed page. None is met by an org chart or a framework subscription. The word doing the work in GV.RR-02 is enforced: if nothing happens when the authority is ignored, the arrangement is decoration.

Small companies buy the outputs of governance, a policy set or an assessment or a dashboard, and never transfer the authority the function needs to do that work.

What the full-time title costs

The Bureau of Labor Statistics puts the median annual wage for computer and information systems managers at $175,140 as of May 2025, with the lowest decile below $107,550 and the highest above $297,510. That is wage, not total compensation.

A security executive sits above that line. The 2025 IANS and Artico Search benchmark, built on self-reported data from 566 CISOs in the US and Canada collected between April and October 2025, found total compensation up 6.7% on the year while security budgets grew 4%, the slowest rate in five years. Most CISOs land between $250,000 and $700,000. The top 1% clears $3.2 million, which the researchers describe as roughly ten times the median.

At $250,000, the low end of that band, one security executive costs about two and a half median network and computer systems administrators, at $99,130 each. For a 100-person firm that is the whole security payroll, committed to someone with no team and no budget to allocate.

A full-time CISO is hired to set tolerance, allocate resources and answer to a board. At 100 people there is one owner, no board, and a budget set by whoever signs checks. The person you hire either accumulates authority informally, which lasts until the first disagreement about money, or becomes a compliance author producing documents nobody reads. When the breach comes, they are named in the report with no decision to point to. The controls that actually hold cost less than the incident, as I worked through in the threat floor analysis.

What a fractional CISO can and cannot transfer

Hitch Partners surveyed more than 100 US virtual and fractional CISOs between 13 June and 31 July 2023, a sample they estimated at a quarter of the US vCISO population, with the method published alongside. More than 80% had worked as full-time CISOs. Governance, risk and compliance work appeared in 72% to 90% of engagements.

What transfers is method: the assessment, the register, the policy set, the reporting format, and the judgment that comes from running the same problem at a dozen other companies. What does not transfer is the authority to accept risk, the signature on a notification decision, and the standing to tell the owner that a project will not ship. A retainer cannot be accountable to the owner in any sense that survives an incident.

Hitch’s findings describe the failure from the other side. Respondents named budget constraints (63%) and the client’s commitment to implementing recommendations (54%) as their top challenges, and described “ambiguously defined objectives, job requirements, and increasing scope of responsibilities after starting their engagements.” More than half said contracts frequently ran past the original term. Companies under 500 employees are more likely than larger ones to engage a vCISO for sales credibility, which is a legitimate purchase and a different product from accountability.

Decision rights for a 50–200 person company

Adjust the thresholds to your business. Decides means the call is theirs and the record shows it. Recommends means they are heard first. Executes means they carry it out. Informed means they hear about it before the next quarterly meeting.

Decision	Owner or CEO	Security lead	IT and operations	Function heads
Accept a risk scored above tolerance	Decides	Recommends	Provides evidence	Informed
Security spend above an agreed threshold	Decides	Recommends	Consults	Informed
Declare an incident and activate the plan	Informed within the hour	Decides	Executes	Informed
Notify regulators, customers or insurers	Decides, with counsel	Recommends	Provides facts	Informed
Take a system offline to contain damage	Informed	Decides	Executes	Informed
Grant a policy exception with an expiry date	Informed	Decides	Consults	Requests
Approve a vendor that will hold company or customer data	Informed	Decides against a checklist	Consults	Requests
Grant privileged access	Informed	Audits by sample	Decides per policy	Requests
Present the quarterly security report	Signs the risk acceptances	Presents	Supplies the numbers	Informed

Incident declaration and risk acceptance determine the cost of everything that follows, and small companies leave both to whoever happens to be in the room. If the same person declares the incident, investigates it and writes the account that reaches the owner, nothing checks the version of events you will repeat to your insurer and your largest customer.

The one-page charter

Six clauses, signed by the owner, dated, reviewed once a year.

Clause	What it must say
Scope	Which systems, data and locations the authority covers, and which sit outside it because a vendor or landlord controls them.
Authority	Three named powers: stop a deployment or disconnect a system; spend up to a stated amount; require evidence from any team before a change ships.
Limits	What the lead cannot do: accept risk above tolerance, approve their own exceptions, make a notification call, or hire.
Escalation	The triggers that reach the owner within the hour, and the ones that reach them within the day: suspected ransomware, data leaving the network, an insider, a breached vendor.
Reporting	The four numbers, the date, the audience, and the fact that the report reaches the owner unedited.
Review	The annual review date, and the deputy who holds the same authority when the lead is unavailable.

The clause companies skip is the deputy. A firm with one named security lead has a single point of failure: if that person is travelling, on leave or has just resigned, nobody can declare an incident. Name a second person and give them the authority in writing, while the decision is still cheap.

The risk register that survives a year

Most registers die because they hold everything and belong to nobody. Keep twenty rows. Each needs eight fields: an ID, the risk, the business owner, likelihood and impact from 1 to 5, the product, the treatment with its date, and the review date. Define what a 3 means before anyone scores a row, so the list can be compared across quarters.

The owner is the person who owns the business outcome, not the system. The finance platform’s admin console belongs to IT; the risk of a fraudulent payment belongs to the controller. GV.RM-06 is NIST’s formal way of saying the scoring rules are written down and applied the same way by everyone who touches the list.

A row reads like this: R-07, the finance platform’s administrator account has no phishing-resistant second factor, owner: controller, likelihood 3, impact 4, score 12, treatment: enforce single sign-on and hardware keys by 15 January, review 15 January. When the owner lives with a risk instead of treating it, the decision goes in the row with their name and the date. That entry is the only evidence the company made a decision rather than drifted, and it is the first thing an insurer, a customer’s security team or an acquirer will ask to see. On the cost side, the distribution matters more than the average, as I argued in the analysis of IBM’s breach report.

Four numbers, once a quarter

The report is one page and forty-five minutes. It carries four numbers, always the same four, so the trend does the arguing:

1. Open risks above tolerance: how many, whose, and the date each is due.
2. Patch compliance: the percentage of in-scope systems inside the agreed patch window, read from the tool rather than from memory.
3. Restore tests: how many backups were restored on purpose this quarter, and how many worked.
4. Privileged accounts without phishing-resistant multi-factor authentication: a count that should fall every quarter.

Add a paragraph on incidents since the last report: the count, days to contain, what is still open. Add the decisions you need from the owner. Then stop. A second page invites editing, and an edited report is not a control.

The cadence fails in three familiar ways. The lead reports to the manager whose budget the findings threaten, so bad news arrives softened; the fix is a direct line to the owner for this report. The register fills with findings nobody can price, so the owner stops reading; the fix is one sentence per row on what stops. The meeting moves twice and then disappears; the fix is to attach it to something that already has a date.

What this means for operators

You are buying decisions, not coverage. No platform will tell you who may disconnect the plant network at two in the morning. The arrangement I would build is an owner who accepts risk in writing, one named lead with three written authorities and a deputy, a twenty-row register, and a quarterly page of four numbers. None of it requires a security department. All of it requires the owner to spend an hour a quarter being told things they would rather not hear.

The title distracts in both directions. Hiring a CISO you cannot empower produces documents; refusing to name anyone leaves the loudest person on the incident call as the decision-maker. The fractional route works only when the charter is signed before the retainer, so the boundaries are set while everyone is calm. Budget questions get easier once decision rights are settled, which is why I treat budget reallocation as downstream.

Run a test this week. Ask two people this: who would tell the owner about a breach before a customer does? If the answers differ, the accountability is not real yet. The rest of my writing on leadership comes back to this: the security problems that persist in small companies are decision problems wearing technical clothes.

What to do

1. Name the person this month. Write the name into the charter and the incident plan. An unassigned role is a wish.
2. Sign a one-page charter with the three authorities, the escalation triggers, and a deputy who holds the same powers when the lead cannot be reached.
3. Build a twenty-row register with a business owner, a score, a treatment and a review date on every row. Score the top ten with the owner in the room.
4. Set the tolerance line in units the owner already uses: days of downtime, dollars of loss, number of customer records. A tolerance expressed as “high” cannot be accepted or refused.
5. Fix the quarterly date now and attach it to the ownership meeting or the insurance renewal so it survives a busy quarter.
6. Report four numbers from systems, not recollection, and put the decisions you need at the bottom of the page.
7. Verify one control each quarter by sampling. Pull ten accounts and check the second factor; restore a backup and time it.
8. Record every acceptance. When the owner lives with a risk, the row carries their name and the date, and the next report repeats it until it closes.

This quarter, decide who holds the authority. Then sign the page that says so, and put the first five risks in front of the owner with real owners and real dates. If the owner column is empty, you have found the gap that no product closes and no retainer fills.

Sources

1. Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure — Federal Register, 2023-08-04.
2. SEC Adopts Rules on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure by Public Companies — Securities and Exchange Commission, 2023-07-26.
3. The NIST Cybersecurity Framework (CSF) 2.0 — National Institute of Standards and Technology, 2024-02-26.
4. Computer and Information Systems Managers — Bureau of Labor Statistics, May 2025.
5. New Report from IANS and Artico Search Shows 6.7% Rise in CISO Compensation in 2025 — IANS Research, 2025-11-13.
6. The CISO Pay Gap: Inside Cybersecurity’s Massive Compensation Divide — IANS Research, 2025-11-13.
7. 2023 vCISO Service Provider Survey Results — Hitch Partners, 2023.
8. Cybersecurity Incident Disclosure: Form 8-K Tracker (Two-Year Update) — Debevoise & Plimpton, 2026-05-21.