Interim CISOs and Open Seats: How Long the Top Security Job Stays Empty

TL;DR: The top security job usually stays open for months: providers put a permanent chief information security officer (CISO) search at 15 to 26 weeks, 4 to 6 months or 6 to 9 months, though our own record cannot measure vacancies. Providers say interim cover can start within two weeks and runs 3 to 9 or six to twelve months. In our reading, that leaves little slack, so name who signs off on cyber risk acceptance now.

What an interim CISO is and how long the seat stays open

An interim chief information security officer (CISO) is a senior security executive hired for a fixed stretch who holds the job itself, not an advisory seat. Our record cannot measure how long a seat sits empty between one CISO leaving and the next one starting, so every length below is a provider's claim.

The role in one line

Go Fractional describes someone who "temporarily assumes the top security leadership role in an organization" (Go Fractional). Teremark CIO says the interim steps in "with full authority over cybersecurity strategy, risk, and teams during a leadership transition" (Teremark CIO). IOmergent says interim and acting CISO "are often used interchangeably" (IOmergent). The glossary entry is at /glossary/interim-ciso.

What providers say about length

Teremark puts a typical engagement at 3 to 9 months. It also says a permanent search can involve a gap of 15 to 26 weeks. Fractional CISO says its contracts usually run for six to twelve months and are billed hourly. IOmergent says executive security hires take 4 to 6 months on average.

Teremark covers leave as a separate case. It says absences can last from eight weeks to a year.

How fast the seat gets covered

IOmergent says most engagements start within 2 weeks. Fractional CISO says it can have someone working as early as next week, and that an interim might work 40 hours per week, depending on need.

In our reading, the search estimates sit inside the engagement ranges, and that leaves little slack. A search that runs long will push the interim toward the far end of a contract. A budget built on the short end will need a second approval partway through.

These are sales pages, so we treat the ranges as each provider's stated norm, not as measured averages.

One step for this week

Write down the name of the executive who signs off on cyber risk acceptance until an interim or permanent CISO is in place, and tell the audit committee. Teremark's checklist opens with the same question: "Who currently owns cyber risk at the executive level?" (Teremark CIO). An empty answer to that question is the gap an interim is hired to close.

What does an interim CISO do in the first weeks

The first weeks are less about new strategy and more about keeping promises the departed leader already made. Provider descriptions of the interim chief information security officer (CISO) role agree on a short list of duties. In our reading, the order of that list matters as much as the list itself.

Keep the calendar

IOmergent describes the opening of an engagement as taking the handoff: the interim leader will pick up "open commitments: audits, board dates, customer questionnaires and any live incidents". That works as a day-one checklist. A board date does not move because the seat is empty. Neither does an audit window or a questionnaire sitting in a sales queue.

The same page puts a written product early in the engagement: "A short written assessment of the program and a plan leadership agrees to." After that it describes a steady rhythm, "Weekly with the team, a monthly summary for leadership, and board reporting." For a longer view of early priorities, see our first 90 days plan.

Lead the team that is already there

An interim leader inherits people who may be uneasy about their own roles. IOmergent says the interim CISO leads the existing security team, "especially when there's no clear deputy to step up". Go Fractional lists mentoring as part of the job, with the aim to "prepare for the transition to a permanent leader".

We think the early one-to-one conversations with direct reports do more for continuity than an early tool review.

Take ownership after an incident

When the seat opened because of a breach, the work changes shape. Fractional CISO says its interim leaders work with remediation experts and the cyber insurance company to resolve the incident, then improve the program while the search runs. A reader can check two things on day one: who holds the insurer relationship today, and whether the interim has the authority to make decisions during remediation.

Scope can stay open. The same provider says hourly billing means the interim can take on whatever work is needed, rather than a set of contracted deliverables.

Prepare the program for the next hire

The last job starts early. IOmergent lists two pieces of transition work:

The test of an interim engagement is whether the permanent hire walks into a program with current documents and kept commitments. See open seats for roles currently in that gap, and the glossary entry for terms.

How long CISO seats stay open on our record

On our record, announced appointments far outnumber announced departures over the last 12 months. That gap in counts says something about what gets announced. It says nothing about how long any seat sat empty.

Of the 441 moves on the Wire as of October 23, 2026, the record holds 159 appointments and 22 departures.

Source: CISO Tribune record: 441 moves on the Wire, as of 2026-10-23

Appointments and departures on the record, last 12 months

Label	records
Appointments	159
Departures	22

The chart draws on 441 moves logged on the Wire as of October 23, 2026. Of those, 159 are appointments and 22 are departures. In our reading, the imbalance reflects disclosure habits more than hiring volume: a company tends to announce a new chief information security officer (CISO) and to say little when one leaves.

What the record can and cannot measure

• It can count appointments and departures that were made public, and attach each to a company and a date.
• It cannot measure the vacancy itself. A gap only shows up when we hold both the exit and the arrival for the same seat. With so few departures logged, most appointments have no matching exit date.
• It cannot see interim cover. An acting or interim leader is rarely announced, so a seat that looks empty on our record may have been run by someone throughout.
• It cannot tell a stalled search from a quiet one. A missing appointment may mean no hire, an unannounced hire or a decision not to fill the role.

Our open seats view and the time-to-fill report carry these limits too.

Setting the record against outside figures

The average search length one provider gave earlier comes from a seller of interim services, and our record cannot confirm or contradict it. A search firm offers a different angle. Riviera Partners writes that "a vague mandate is the most common reason searches stall," and that in stalled searches the obstacle "is rarely budget". The same firm says a failed search "burns roughly nine months of mandate drift before anyone calls it". It also reports that top candidates "are routinely running multiple processes simultaneously".

Neither source publishes the data behind its figure. We think both are best read as practitioner estimates from firms that sell into the gap.

Not every interim seat ends in a hire. IOmergent says many interim engagements move to a fractional arrangement when the company decides it does not need a full-time CISO. On our record, that outcome would look like a departure with no appointment after it.

What a reader can check

If your seat is open, keep your own dates: the day the last CISO left, the day an interim started and the day the role was approved with a written mandate. Those three dates show more about your gap than our counts can. If the mandate date is late, in our reading, that delay is the place to look first.

Who covers the role in between

Four kinds of holder usually cover a vacant chief information security officer (CISO) seat. They differ less in title than in authority and hours. The table below is our reading of the trade-offs. The sourced detail follows it.

What the sources add

The deputy option depends on bench strength. Fortium Partners says most searches at the executive level can take 6-9 months, and that a search of that length may not be an issue when strong secondary leadership is in place. The same guide lists deputy CISO experience as potentially suitable for the permanent role, so an acting stint can double as a trial.

The outside options split on hours. IOmergent describes interim work as having higher time commitment and full accountability for the security function, and fractional work as an ongoing, part-time engagement. It also says that without a need for near full-time coverage, a fractional CISO is usually the better fit. On ramp-up, it says most interim CISOs are operationally effective within the first 2-3 weeks.

Fractional CISO, a provider, says an interim might also work 40 hours per week, while part-time CISOs work indefinitely. It positions the interim model for large businesses and enterprises that have had a full-time CISO before.

The supply of outside leaders is limited too. Fortium notes that not every CISO wants or is qualified for interim or fractional work.

What to check before choosing

• Whether the deputy can drop part of their current load for the duration.
• Whether the CIO already owns the security budget, which affects how much conflict the arrangement carries. Our reporting structure guide and the role comparison cover the lines.
• Whether a live incident or audit needs more hours than a part-time engagement offers.
• Who signs off on risk acceptance while the seat is open. In our reading, this is the decision most often left unassigned, whichever holder is chosen.

Do regulators allow an acting CISO

In our reading, an examiner cares less about the title than about two things: whether someone owns the program, and whether the documents behind it are current.

New York DFS: the risk assessment carries the weight

The letter states that it does not create new obligations.

Two requirements matter during a vacancy:

• Risk assessments must be reviewed and updated at least annually, and also after a change in business or technology materially changes cyber risk.
• DFS expects each covered entity to be able to demonstrate how its assessment informed controls, compensating controls and risk acceptance decisions.

The letter does not name the departure of a chief information security officer (CISO) as a material change. We think a long vacancy is still a good reason to test whether the assessment reflects how the business runs today.

DFS also lists gaps it found in reviews. These include failing to assign ownership and failing to document risk response decisions. In our reading, an open seat makes both gaps easier to fall into. The department reviews risk assessments and security policies during examinations and investigations, so an interim leader should expect those documents to be read.

The letter does not address who must hold the CISO designation, or whether an interim or third-party person can hold it.

SEC filings: how management is described

The Securities and Exchange Commission (SEC) has two items that bear on an open seat: Regulation S-K Item 106 and Form 8-K Item 1.05. Our summary is our own reading. Item 106 asks a filer to describe how management handles cybersecurity risk. Item 1.05 covers reporting a material incident. If the person described in last year's filing has left, we think the next description should match who is actually doing the work. Our SEC disclosure guide covers both items in more depth.

This section describes what the texts say. It is not legal advice. Counsel should confirm how each rule applies to your entity.

Promoted from inside or hired from outside

On our record, outside hires outnumber internal promotions by roughly five to one. Of 301 chief information security officer (CISO) appointments on the Wire that name a previous company, 252 went to someone hired from another company and 49 to someone promoted from inside. An internal promotion accounts for about one in six of the appointments we can trace.

Of 301 appointments on our record that name a previous company, 252 went to people hired from another company and 49 to people promoted from inside.

Source: CISO Tribune record: 301 appointments that name a previous company on the Wire, as of 2026-10-23

Promoted from inside or hired from outside (appointments naming a previous company)

Label	appointments
Hired from another company	252
Promoted from inside	49

One caveat before reading too much into it. The record shows where the new CISO came from. It does not show whether that person held the seat in an acting capacity first. In our reading, some of the 49 will be deputies who covered the gap. Others may have moved over from engineering, risk or IT roles. In our reading, the figure is an upper bound on how often the acting holder keeps the job, not a count of it.

What this suggests about the gap

In our reading, most boards treat the interim period as a bridge to an outside search, not as a trial run for the deputy. If that holds, the gap lasts as long as the external search does, because the internal candidate is rarely the default answer. The timelines in our time-to-fill report are best read with that in mind.

The outside search also runs on terms that candidates set. Riviera Partners says candidates "are looking for authority, access to decision-makers, and the ability to influence the business". We think a board that settles scope and reporting line during the interim period gives itself a shorter search, whichever way it hires.

Some boards decide a full-time hire can wait. For those cases, Riviera Partners says fractional cover or a strong VP of engineering with security ownership "can credibly cover the function for another 12 to 18 months in the right circumstances". In that case the deputy may be running the function for longer than anyone planned.

Preparing a deputy

Given how few appointments go to insiders, we think a deputy should be prepared for either outcome from the first week:

• Settle candidacy early. Tell the deputy plainly whether they are in the running. In our reading, an acting holder who is guessing makes cautious decisions.
• Put decision rights in writing. Spell out what the acting holder can approve, which budget lines they control and when they brief the board.
• Build a record. Decisions logged during the gap become evidence for an internal candidacy. They also become the handover file for an outside hire.
• Plan retention either way. In our reading, a deputy passed over for an external hire is a flight risk. Agree in advance what their role looks like afterward.

A deputy who is a candidate should also run the diligence an outside candidate would. Riviera Partners describes what a sitting CISO should check in a board and CEO as "the conversation that decides whether the placement holds at the 18-month mark." Being an insider does not remove the need for that conversation. For definitions, see interim CISO. For current vacancies, see open seats.

How companies shorten the gap

In our reading, most of the delay in a chief information security officer (CISO) search is set before the first interview. The steps below follow the order a hiring team meets them. In our reading, each one removes a common reason a search slows down or a finalist walks away.

Settle the seat before the search opens

Fortium Partners puts definition first: the role requirements, reporting lines, success criteria, budget, and resources. Riviera Partners says a vague mandate is the most common reason searches stall, and it advises a reporting line with real proximity to the board. Our reporting line glossary entry and reporting lines report cover the options.

Write the success criteria down. Fortium asks what success looks like six months into the role and again eighteen months into the role. For budget, it puts cybersecurity programs at 5% to 15% of the total IT budget in larger organizations, where IT means information technology.

Get executive input in week one

Fortium's second step is to collect executive and key management team members' opinions on what the role needs. A practical test: get the CEO, finance, legal and technology leads to sign off on one job description before a recruiter calls anyone. In our reading, if one of them has not signed off, a finalist will find out during their own diligence.

Run full-time and part-time sourcing together

Fortium tells CEOs to look at both full- and part-time options at the same time. It also notes that the extra diligence for a permanent role makes the organization and the candidate move more slowly. An interim can work on the search itself. IOmergent lists helping define the role, evaluate candidates, and brief finalists among its tasks.

Price the offer against the current market

Fortium says pay can significantly impact the CISO they can attract. Riviera says that if your last pay reference point is more than 18 months old, the market has already moved past it. Check your band against our salary and compensation guide before the first offer goes out, not after a decline.

Name a successor while the seat is still filled

As noted earlier, deputy CISO experience can count toward the top job. In our reading, The cheapest gap is the one a named deputy closes. In our reading, that means four things done in advance:

• Name the deputy in writing.
• Put them in front of the board at least once a year.
• Give them written authority to sign off on incidents and audits.
• Agree on the terms under which acting cover turns into the permanent role.

For what the new leader does once seated, see the first 90 days plan.

Handing the seat to the permanent CISO

A handover is two things: a file and a calendar. The permanent chief information security officer (CISO) should be able to read where the program stands on day one, without asking the interim to rebuild it from memory.

What goes in the file

Audit findings deserve their own tab. Fractional CISO says an interim can help with all cybersecurity audits, so findings opened on the interim's watch belong in the file with their history attached.

A dated handover timeline

IOmergent's engagement model ends with a step titled "Last 2 to 4 weeks: hand over." In that window, the firm says it will document decisions and brief your new CISO. We think that window works best when it is fixed to dates before the new hire starts. Our suggested schedule:

2. Overlap meetings. One walk-through per tab of the file. Joint sessions with the audit lead, the incident responders and the board or audit committee contact, so those relationships move with the job.
3. Contract end date. Agree it in writing before the new CISO's first day, with a named person who can extend it.
4. Access revocation log. A dated list of every account, key, token, vendor portal and mailing list the interim held, with who removed it and when.

How long the interim stays

The sources describe an open end, not a set overlap. Fractional CISO says its agreements are written so the interim CISO can wind down work whenever the new full-time CISO is hired, and that interim work is billed hourly. IOmergent says it will prepare transition materials and support onboarding when your new hire starts, then step back entirely once your permanent hire is onboarded.

In our reading, the right overlap is set by what is still open. One board meeting attended together, or a live incident closed, is a sounder exit test than a count of days. In our reading, hourly billing makes it cheap to extend week by week instead of guessing at the start.

The last step is the cut. Fractional CISO calls it "Clean offboarding," after which the interim is disconnected from your organization. The revocation log is the evidence that the cut happened. Keep it with the handover file. The new CISO's own plan picks up from there; see our first 90 days guide and the interim CISO glossary entry.

What this guide does not cover

This guide does not measure actual vacancy lengths, because our record cannot match most exits to arrivals, and it does not compare, rank or recommend interim or fractional providers. It summarizes what the NYDFS letter and our reading of the SEC items say but does not reproduce the rule text, and it is not legal or financial advice.