Fractional GRC
A fractional GRC lead builds and runs governance, risk, and compliance programs sized to your team — not scaled down from a Fortune 500 department, but built from the ground up around the frameworks that actually apply to you. This is the same work often called a virtual CISO or vCISO engagement — GRC is the more accurate term for the scope here (program and controls ownership, not incident response or running a security team), but if vCISO is the term you searched, this is the right page. I own the program the way an in-house GRC director would, without the overhead of a full department. That includes the parts of a GRC program that are easy to promise and hard to actually run: closing out an aging risk-assessment backlog, keeping vendor questionnaires from piling up, and making sure the automation meant to support the program doesn't become its own unmanaged project. I've taken over a third-party risk program running 120 days behind its own SLA and closed the backlog completely — this isn't theoretical.
What this covers
Third-party / vendor risk management program design
Intake, assessment, and ongoing monitoring built to scale from a ten-vendor list to a thousand-vendor list without redesigning the process.
More on this →SOC 2, ISO 27001, NIST 800-53 & NIST CSF control mapping
Building controls that hold up to audit, not just checking a box — mapped once and reused across frameworks instead of maintained as separate spreadsheets.
More on this →Security questionnaires, SIG assessments & residual risk reporting
Handling the volume without sacrificing quality. Backlogs get triaged by actual risk, not submission date.
Executive and board-level risk reporting
Translating technical risk into language stakeholders can act on — a risk register nobody reads is a compliance artifact, not a risk register.
Policy, process & procedure development
Documentation that's actually followed, not shelfware, written by someone also responsible for the program the policy governs.
GRC tooling: ServiceNow VRM, OneTrust, RiskRecon, BitSight
Implementation and ongoing administration, including the same development discipline the tooling itself needs — enhancement work doesn't skip the rigor of the program it supports.
Who this is for
Organizations that need a real GRC program — not a consultant who writes a report and leaves — but don't have the volume of work to justify a full-time hire. Especially useful ahead of an audit, a customer security review, or when a growing vendor list has outpaced your current process. It also fits organizations with a GRC function on paper but not in practice: policies exist, but nobody's actually running the third-party risk queue or getting ahead of the next SOC 2 renewal before it becomes a fire drill.
Let's talk about governance, risk & compliance
I take on a limited number of clients at a time so every engagement gets real attention. Reach out to discuss scope, cadence, and fit.
Book an introductory call