The words, in plain English
This glossary defines the terms an owner meets when hiring fractional leadership or dealing with the legal, technology and security problems that lead to it. Each entry opens with a one-paragraph definition you can quote, then a sentence on why it matters to a company of 10 to 150 people. Every term is an anchor you can link to.
Fractional executive
A fractional executive is a senior leader (CFO, CIO, CMO, COO, general counsel, chief security officer) who works for a company part-time on an ongoing basis, usually 8 to 30 hours a month on a monthly retainer, while serving other clients. The company gets executive judgment and accountability without a full-time salary. For a company under 150 people, it is usually the only way to have the seat filled by someone who has held it before.
Fractional C-suite
A fractional C-suite is a set of fractional executives engaged together to cover several functions at once, ideally from one firm so they coordinate with each other rather than through the owner. The Virtual C-Suite is one: a general counsel, a CIO and a chief security officer on one retainer.
Virtual C-suite
"Virtual C-suite" is used two ways. Managed IT providers use it for vCIO or vCISO add-ons to a support contract. We use it as our name for a standing team of three named fractional executives covering legal, technology and security. The word "virtual" means part-time and remote-capable, not that the executives are software.
Fractional general counsel
A fractional general counsel is a lawyer who serves as a company's in-house counsel part-time on a retainer: contracts, employment, intellectual property, disputes, governance and transactions, with outside specialists brought in when needed. Unlike a law firm on call, the fractional GC already knows the business and sits in the leadership meeting. Also called outside general counsel or virtual general counsel.
Outside general counsel
Outside general counsel is the older term for the same arrangement as a fractional general counsel: a lawyer at a firm who acts as a company's general counsel without being its employee. Some firms distinguish the two by billing (hourly for outside counsel, retainer for fractional); in practice the terms overlap.
Fractional CIO
A fractional CIO is a chief information officer on a part-time retainer who owns a company's technology strategy, budget, security governance, vendor management and compliance program, and directs the managed service provider or internal staff who do the technical work. A fractional CIO decides what the company should run and what it should cost; a help desk fixes what is broken.
vCIO
vCIO, for virtual CIO, usually means a quarterly technology review that a managed service provider includes in its contract. It is useful, and it is also a sales meeting for the provider's own products. An independent fractional CIO works for the company, writes the requirements and reads the provider's invoices.
Fractional CISO and vCISO
A fractional or virtual chief information security officer (vCISO) owns a company's information security program part-time: risk assessment, policies, controls, compliance, incident response planning and the security questionnaires customers send. In our team, information security governance sits with the CIO seat; people, sites and crisis response sit with the chief security officer.
Fractional chief security officer
A fractional chief security officer (CSO) is accountable for the safety of a company's people, sites and operations on a part-time retainer: threat and risk assessment, workplace violence prevention, physical and personnel security, executive protection and crisis management. It is the seat most companies under 150 people have never filled, which is why the first incident lands on the owner.
Interim executive
An interim executive is a full-time, temporary leader who fills a vacant seat for three to twelve months, typically during a search, a transaction or a turnaround. Interim is priced two to three times a fractional retainer because it is full-time. It is the right answer for a sudden gap and the wrong answer for an ongoing need.
Retainer
A retainer is a fixed monthly fee for a defined scope of an executive's time and responsibility, as opposed to hourly billing. Fractional executives work on retainers because the value is in being accountable for the function month after month, not in the hour count. Hourly billing for a fractional executive is widely treated as a warning sign.
Engagement bands: advisory, working, embedded
Our retainers come in three bands by hours per month. Advisory, about 8 hours: the monthly leadership meeting, phone and email access, review of what you send. Working, about 16: advisory plus a defined project or standing responsibility. Embedded, about 30: the partner owns the function, attends your weekly leadership meeting and manages staff or vendors in it.
Franchise disclosure document (FDD)
The franchise disclosure document is the legal document a franchisor in the United States must give a prospective franchisee before a franchise is sold, covering the franchisor's history, fees, obligations, territory, financial performance representations and the franchise agreement itself. It references an operations manual and a technology standard that often do not exist yet when the FDD is drafted, which is where many first-time franchisors get into trouble.
CMMC
The Cybersecurity Maturity Model Certification is the Department of Defense's program for verifying that contractors protect the government information they handle, with levels that set how many controls apply and whether a self-assessment or a third-party assessment is required. For a small contractor the hard part is not the controls; it is that someone has to own the policies, training, evidence and vendor terms that prove them.
FTC Safeguards Rule
The FTC Safeguards Rule requires non-bank financial institutions under the Federal Trade Commission's jurisdiction (including many dealers, lenders, advisors and tax preparers) to maintain a written information security program with specific elements, including a designated person responsible for it. That designated person is, in effect, a CISO, and most covered small businesses do not have one.
HIPAA Security Rule
The HIPAA Security Rule sets the administrative, physical and technical safeguards that covered entities and their business associates must apply to electronic protected health information, including a risk analysis, policies, training and incident procedures. Practices and their vendors often have the technical pieces from an IT provider and none of the administrative ones.
Threat assessment
A threat assessment is the structured evaluation of whether a person or situation poses a risk of violence to a workplace, a school or a community, and what to do about it. It is the core of a workplace violence prevention program and the skill law enforcement crisis professionals bring that security guards and IT providers do not.
Incident command (ICS and NIMS)
The Incident Command System and the National Incident Management System are the standard structures US emergency services use to run a response: one person in charge, defined roles, one plan, one set of communications. A company that has rehearsed even a simple version of it handles a crisis in hours instead of days.
Litigation hold
A litigation hold is the instruction a company issues, as soon as litigation is reasonably anticipated, to preserve every document, email, message and file that could be relevant, and to suspend any routine deletion. Failing to issue one, or issuing it late, can cost a company the case regardless of the facts. It is the first thing a general counsel does when a dispute appears.
Fully loaded cost
The fully loaded cost of an employee is salary plus benefits, payroll taxes, overhead and, in the first year, the recruiting fee: typically 1.25 to 1.35 times salary ongoing, plus 20 to 30 percent of salary once to hire. It is the number a fractional retainer should be compared with, not the salary alone.