Fractional security leadership is priced by scope and cadence, not headcount, and it splits into three shapes: a fixed-scope assessment, a monthly retainer, and project work priced per deliverable. CannaShield publishes its own rates — $750 for a one-week starter assessment, $1,800/month for a GRC retainer, $2,500–$4,500 for a state compliance audit. Those are our numbers, not an industry survey. Use them as one reference point when you compare.
The short version
- Scope drivers: number of locations, systems in play, whether an audit or renewal is imminent, and how much documentation already exists.
- The comparison that matters is not vCISO versus nothing. It is vCISO versus a senior security hire, versus your MSP’s security add-on, versus the cost of the incident.
- A retainer that produces no artifacts you can hand to an underwriter is a subscription, not a security program.
What are the engagement models?
Three, and they serve different moments.
- Fixed-scope assessment. A defined piece of work with a written deliverable — current-state assessment, gap report, prioritized roadmap. Good first move when you do not yet know what you need. CannaShield's Cannabis Cyber Starter Assessment is one week at $750; the deeper State Cannabis Cyber Compliance Audit runs three weeks at $2,500–$4,500.
- Monthly retainer. Ongoing ownership at a set cadence — policy maintenance, vendor reviews, access review oversight, incident escalation, and someone to call. Our GRC Foundations retainer is $1,800/month.
- Project work. Priced per deliverable: a cyber insurance readiness package, a BEC defense sprint, a ransomware resilience audit. Useful when there is a specific forcing event.
What actually drives the price?
Five things, and none of them is your revenue:
- Locations and entities. Each site adds network, staff, and access review surface. Each legal entity adds documentation.
- Systems in scope. A cash-only single-site dispensary is a smaller problem than an operator running e-commerce, delivery, a loyalty platform, and a cultivation facility with environmental controls.
- Deadline pressure. A renewal or underwriting deadline in six weeks compresses the work and raises the price. Starting nine months out is cheaper.
- What already exists. If you have current inventories and any written policy, a large chunk of discovery is already done.
- Regulatory footprint. One state is one appendix. Five states is five sets of deadlines and notification contacts.
How does it compare to hiring someone?
A full-time security leader is a senior executive salary plus benefits and payroll costs, plus recruiting, plus the tooling budget they will ask for in month two. For a single-site dispensary or a small cultivator, that is not a proportionate spend, and it is a role most operators cannot interview for competently.
What you give up with fractional is availability — a set number of hours per month, so work gets prioritized rather than done on demand. What you gain is judgment from someone who has handled incidents, without a hiring cycle.
There is a real crossover point. Multi-state operations, an internal IT team of any size, or continuous audit and investor pressure eventually justify a permanent hire. Below that, fractional is usually the better use of the money.
Is this different from what our MSP already charges for security?
Usually, yes — and the distinction is worth understanding before you pay for both.
An MSP security add-on typically means tooling and monitoring: endpoint protection, patching, maybe email filtering, sometimes a dashboard. Real value, and you should have it.
What it generally does not include is risk ownership: deciding what to accept, writing the program, running vendor reviews, preparing renewal evidence, or being the accountable name when a regulator asks. There is also a structural issue — asking your MSP to independently assess the environment your MSP built puts them in an awkward position, and good MSPs will say so.
The two are complements. Your MSP runs the controls; the vCISO decides which controls, proves they work, and owns the answer.
What should be included, and what usually is not?
Ask for the deliverables list in writing before signing. A serious engagement should produce most of these:
- Current-state assessment against a named framework, dated
- Written information security program and policies that reflect your actual operations
- Asset, data, and vendor inventories
- An incident response plan with your state's reporting clocks written into it
- A risk register including accepted risks and who accepted them
- Insurance and renewal evidence, assembled rather than scattered
- A defined escalation path when something happens
Commonly excluded and worth clarifying: incident response labor during an actual incident (often a separate retainer plus hourly — ours is $1,200/month plus $275/hour), penetration testing, tool licensing, and remediation implementation as opposed to remediation planning.
How do we tell a real engagement from a template subscription?
Ask four questions and listen carefully.
"Can I see a redacted deliverable?" If the sample is a generic policy pack with a logo swapped in, you are buying templates.
"Who is doing the work, and what have they responded to?" Cannabis security advice from someone who has never worked an incident tends to be theoretically complete and practically useless.
"What happens at 9pm on a Saturday?" The answer should be specific, and it should include what is and is not covered.
"Show me how you'd handle a next-business-day reporting obligation." If they do not know Connecticut has one, they do not know Connecticut.
One more red flag: anyone who tells you a framework certification is legally required for your cannabis license. It is not, and the claim is a reliable signal about everything else they will tell you.
How should we think about the return?
Be honest that security spend is insurance against events with uncertain probability. Anyone quoting you a precise ROI figure is making it up.
What you can reason about are the concrete costs that are avoided or reduced. MariMed disclosed a $646,000 loss from a single forged email — a callback procedure costs nothing and addresses that class of loss directly. An operator who cannot answer underwriting questions accurately risks a coverage dispute after a claim. Renewal preparation done continuously costs less than two weeks of scramble. And an unreported reportable incident is a licensing problem in a way the incident itself may not be.
Those are the four buckets. None of them produces a clean multiple, but together they usually justify a modest monthly number for an operator whose license is the whole business.
What is a sensible first engagement?
Buy the assessment before you buy the retainer.
A fixed-scope assessment gives you a written picture of where you stand, a prioritized list, and — just as usefully — a low-cost trial of how the provider actually works. You find out whether their questions are sharp, whether the deliverable is specific to you, and whether you want them on the phone during a bad week.
If the assessment is generic, you have spent a small amount to learn something important. If it is good, the retainer conversation gets much easier, and it starts from a real roadmap instead of a proposal.
Where to go next
- Do cannabis companies need a CISO?
- What GRC framework should a cannabis company use?
- Cyber Insurance Qualification services