External CISO vs. internal CISO: cost comparison, risks and selection criteria

The Chief Information Security Officer (CISO) is responsible for the strategic and operational management of information security. With the entry into force of NIS-2 in Germany in 2026, the tightening of cybersecurity requirements according to DORA for financial companies since January 2025, the expiring transition to ISO/IEC 27001:2022 by October 2026 and increasing requirements from TISAX, KRITIS and C5, the question arises for around 29,500 companies affected by NIS-2: have their own CISO in-house or external CISO as a service. Both models have hard use cases and equally clear limits, which can be quantified in DACH market figures.

This article provides a cost comparison with specific DACH market figures for 2026, a risk assessment of the two models, a decision tree based on company size and audit pressure, as well as information on contract design and distribution of responsibility in accordance with Section 130 OWiG. You will find out why personnel costs only make up a third of the real total costs of an internal CISO, what typical hourly rates external CISOs charge in Germany, how you can set up a hybrid solution with clearly defined interfaces and why the appointment certificate ultimately determines the line of defence in the event of a claim. CIVAC is a German compliance platform and officer-as-a-service with workspace, 93 controls according to ISO/IEC 27001:2022, 490 audit templates, NIS-2 24/72 reporting path and EU data residency according to standard.

According to salary studies by Robert Half, Hays and Heuse-Hofmann, the gross annual salaries for internal CISOs in Germany in 2026 will be between 110,000 euros (SMEs, 250 to 500 employees) and 220,000 euros (corporations, 5,000 or more employees). In regulated industries such as banking, insurance or critical infrastructure, there is an additional 10 to 20 percent surcharge. Variable compensation amounts to 15 to 25 percent of the basic salary and is based on ISMS goals, audit results and incident key figures.

The real full costs go well beyond the salary. Employer contribution to social security (around 20 percent), pension provisions, company car or mobility allowance, equipment, training budget (at least 5,000 to 10,000 euros annually for certifications such as CISSP, CISM, CISA), conferences, tool costs for GRC and vulnerability scanners as well as vacancy risk add up to full costs of 180,000 to 280,000 euros annually. For corporate CISOs in DACH, the full costs are often over 350,000 euros.

An often overlooked factor is the recruitment time. A CISO position in Germany will be vacant for an average of 5 to 9 months in 2026, and longer in regulated industries. During the vacancy, the de jure responsibility lies with the management, de facto often with a deputy without a mandate and without a budget. Anyone who bridges the gap with an external CISO as an officer-as-a-service ensures the reporting line even in the transition phase. CIVAC delivers the ISB role as a service or as a workspace licence for internal representatives, with delivery in 2 working days instead of the classic 2-6 weeks and complete appointment certificate. This means that the reporting line to management remains seamless and the ISMS does not lose its level of maturity in the transition phase, while audits and NIS 2 reporting obligations continue to be served reliably.

External CISO services are offered in three models: daily or hourly rate, fixed package per month or quarter, success or goal-based models. The daily rates for external CISOs in Germany in 2026 will be between 1,500 and 2,800 euros, depending on experience level and industry. Hourly rates range between 200 and 380 euros. Pure consulting assignments are expensive if long-term responsibility is to be assumed.

Fixed packages are the usual model for officer-as-a-service. A starter package (basic ISMS, one location, monthly status, quarterly report) costs 3,000 to 4,500 euros per month. A medium package (multiple locations, NIS-2 assignment, monthly reports, 8 to 12 hours of consultation) is 6,000 to 9,000 euros per month. A premium package (group structure, several representative roles, audit support, on-site days) costs 12,000 to 18,000 euros per month. Annual costs: 36,000 to 216,000 euros.

Success models link part of the remuneration to concrete results: successful initial certification according to ISO/IEC 27001:2022, passing an NIS 2 audit, reducing the MTTR (Mean Time to Respond) to a target value. They are rarely used as a main model, often as a bonus component. The responsibility for preventing damage cannot be completely outsourced because the ultimate responsibility remains with the management in accordance with Section 130 OWiG. External CISOs take on the appointment role and operational control, while the management bears the responsibility for supervision and organisation. This distribution should be precisely regulated contractually, with reporting lines, escalation levels, SLAs for availability and a replacement policy for vacation and illness cases. The appointment certificate, signed, filed, verifiable. In the CIVAC workspace, the contract template, RACI matrix and appointment certificate are available as packages, so that in practice the distribution of responsibility is not lost in the inbox, but is available as verifiable evidence. EU data residency according to standard, handover in 2 working days instead of the classic 2-6 weeks, coordinated with NIS 2 obligations and audit dates.

The choice between internal and external CISO is not a gut decision, but can be structured. Three axes determine the answer: company size (employees, sales, locations), regulatory depth (NIS-2 essential vs. important, DORA, ISO/IEC 27001:2022, TISAX, KRITIS) and ISMS maturity level (initial, defined, measured, optimised).

Companies with fewer than 250 employees, one location and medium compliance pressure usually choose the external CISO as officer-as-a-service. The burden of a full-time CISO is underutilized and the costs are disproportionate to the risk portfolio. For 250 to 1,000 employees with NIS 2 obligations or initial audit requirements, a hybrid model is recommended: an internal ISB with half a position (e.g. existing employees with further training) and an external ISB representative as a backup and for peak loads. If you have 1,000 employees or more with multiple locations and tough regulatory requirements, an internal CISO with your own team is standard, supplemented by external specialists for audits and incident forensics.

The audit requirements quickly overturn the decision. Anyone who has to achieve an initial ISO/IEC 27001:2022 certification in less than 12 months because a customer requests it can rarely achieve this with internal capacities. External CISO services with a bundle of 93 controls, 490 audit templates and a structured workspace significantly shorten preparation. The auditor calls, the evidence is ready. CIVAC accompanies these phases as an officer-as-a-service with handover in 2 working days and complete documentation to the management, so that the reporting line remains resilient even in the peak phase and subsequent audits go through without friction. Others run compliance like a filing cabinet. We run it like software. Licence the workspace for your internal representatives or have our representatives order it.

The legal responsibility for information security remains with the company management according to Section 130 OWiG. An external CISO assumes operational responsibility as an agent, but does not replace the supervisory and organisational duties of the management. This separation is not just academic: In the event of a claim, for example after a ransomware incident with data leakage, supervisory authorities and prosecutors check closely whether the management has fulfilled its obligations, regardless of the CISO model.

In concrete terms, this means: the appointment of the external CISO is made in writing, with a clear description of tasks, reporting line to management, escalation levels, availability SLA (e.g. 24/7 for security-critical ones incidents) and representation regulations. The management organises an internal interface team (e.g. IT management, data protection, HR, communication) that works with the external CISO. Without this internal counterpart, the external CISO works in a vacuum.

The liability of the external CISO is based on the service contract and is usually limited to a multiple of the annual salary. The client's D&O insurance protects the management, but does not cover the external consultant. Anyone who hires an external CISO checks their professional liability and financial loss liability with sufficient coverage (usually 5 to 10 million euros). In the NIS 2 context with fines of up to 10 million euros or 2 percent of group sales, these amounts are relevant. In the CIVAC model, the platform automatically handles the appointment certificate documentation, the reporting line and the escalation levels and delivers the definition of liability in a contractually precise manner. Licence the workspace for your internal representatives or have our representatives order it. EU data residency is standard, so contracts and reports do not leave the region. Audit-proof, documented, § 130 OWiG-proof. This separation makes liability manageable without handing over operational responsibility to an external partner.

The tasks of a CISO can be divided into five clusters: Governance and strategy (security guidelines, risk management, reporting to management and the supervisory board), ISMS operations (setup, maintenance, audit support according to ISO/IEC 27001:2022 and BSI IT-Grundschutz), operational security (vulnerability management, patch management, identity and access management), incident response (24/7 readiness, forensics, crisis communication, NIS-2 24/72 reporting path) and compliance (GDPR, NIS-2, DORA, TISAX, regulatory reporting).

An internal CISO with a team of five covers all five clusters with high availability, but is dependent on external specialists for special questions (cloud security, OT security, AI security). An external CISO as a service typically fully covers clusters 1, 2 and 5, cluster 3 in consulting and control, cluster 4 in control and on-call, often with an attached SOC or MDR partner.

The distribution should be stated in the contract or mandate letter. A RACI (Responsible, Accountable, Consulted, Informed) matrix for each main task prevents gaps. Example: In the event of an incident, the external CISO is responsible for the initial analysis, the management is accountable for external communication, the internal IT manager is consulted for the technical situation, the legal department is informed. Anyone who works cleanly here avoids frictional losses in times of crisis, when every minute counts. Deadline begins as soon as we become aware of it. The NIS-2 early warning must occur within 24 hours and the follow-up notification within 72 hours. The CIVAC workspace maps this RACI matrix with escalation levels and presents the role, task and contact for each representative in plain text, so that no question remains unanswered, even under pressure. The auditor calls, the evidence is ready. This clarity measurably reduces the mean time to respond.

An honest cost comparison includes more than salary vs. daily rate. With an internal CISO, four positions are often overlooked. First, the toolset: GRC platform (SAP GRC, ServiceNow GRC, archer, or specialised tools), vulnerability scanners, awareness training platform, SIEM or SOC connection, threat intelligence feeds. Realistic tool costs for a medium-sized ISMS setup are between 40,000 and 90,000 euros annually. Secondly, the interface costs in the organisation: IT team hours, HR department, legal department, data protection, audit preparation.

Thirdly, the vacancy risk: A CISO position is typically vacant for 5 to 9 months when there is a change, and the handover takes another 2 to 3 months. During this time, the ISMS suffers a loss of maturity, audits are postponed, and risks increase measurably. If the vacancy risk is assumed to have only a 10 percent annual probability of occurrence and a 6-month impact period, this results in an implicit risk premium of 5 percent of the full annual costs. Fourth, the risk of burnout: CISOs are at the forefront of illness and exhaustion statistics in IT professions, which leads to unplanned outages.

With an external CISO as a service, tooling costs are partially included in the package (e.g. the CIVAC workspace with ISMS templates, reporting line, audit templates), and vacancy risk is reduced through substitution arrangements in the pool. There are other hidden costs: onboarding and knowledge building when changing, possibly limited availability in acute situations, depending on the SLA. An honest calculation takes these items into account on both sides and rarely comes to a blanket answer. Others run compliance like a filing cabinet. We run it like software. This discipline makes the real costs visible and prevents a supposedly cheap option in an audit or incident from suddenly becoming the most expensive option because documentation, representation and escalation are not effective.

In practice, many medium and large companies rely on hybrid models. An internal CISO bears strategic responsibility and is the contact person for management and the supervisory board. An external ISB takes care of audit preparation, special topics (NIS 2 compliance, ISO/IEC 27001:2022 conversion, DORA implementation) and representation in the event of failure. The interface is clearly documented, both work on the same platform.

This model combines three advantages. Firstly, the strategic anchoring in the company by the internal CISO, who knows the culture, the stakeholders and the business areas. Secondly, the specialist depth and scalability of the external ISB, which brings experience from several companies and can be ramped up at short notice. Thirdly, risk reduction through double staffing of critical functions: If one side fails, the other steps in, with a documented handover protocol in the workspace.

The prerequisite is a clean interface architecture. The internal CISO remains accountable for the security guidelines, the external ISB is responsible for defined workstreams (e.g. NIS 2 initial audit, cloud security concept, Tisax renewal). In the CIVAC workspace, the task packages are stored as packages, with a deadline, person responsible and status display. Reports automatically flow into the reporting line to management. Licence the workspace for your internal representatives or have our representatives order it. This variant is often the most resilient because it combines the strategic anchoring and the operational clout of a pool without one person becoming a single point of failure. Audit-proof, documented, § 130 OWiG-proof. Appointment certificates for both roles are maintained in the workspace with task descriptions, hourly quotas and reporting lines, so that internal and external responsibilities are visibly intertwined. The hybrid variant reduces the single point of failure risk in the event of staff shortages and ensures audit capability even if the internal CISO is temporarily unavailable or the external mandate ends.

A reliable contract with an external CISO regulates ten points. Firstly, scope of services: specific tasks, responsibilities, demarcation from the internal team, RACI matrix as an attachment. Secondly, availability and SLA: response time to inquiries (in working days or hours), 24/7 availability for safety-critical incidents, replacement arrangements in the event of a failure. Thirdly, reporting: rhythm (monthly, quarterly), format (KPI dashboard, report, on-site presentation), addressees.

Fourthly, contract term and notice periods: The usual initial term is 12 months with subsequent extensions of 12 months each, notice period is 3 months at the end of the term. In the event of an emergency exit, an orderly handover should be arranged within 30 days with a documented handover protocol. Fifth, remuneration: fixed price, hourly quota, additional work, special assignments for incidents, expenses and travel costs. Sixth liability: limitation of liability, proof of insurance, exemption clauses.

Seventh confidentiality and data protection: NDA, order processing agreement according to Art. 28 GDPR, subcontractor regulation, EU data residency. Eighth, non-competition or mandate restriction in the same industry, if relevant. Ninth, handover clause at the end of the contract: complete documentation, knowledge transfer, return of secrets. Tenth, right to audit and inspect: The client can audit the performance of the external CISO, ideally via platform logs and reports. CIVAC maps these ten points as a contract template and provides comprehensible logs for each agent activity in the workspace, including the appointment certificate, the task description and the reporting line to management. The appointment certificate, signed, filed, verifiable. EU data residency is standard, so contracts and reports do not leave the region. Licence the workspace for your internal representatives or have our representatives order it, with delivery in 2 working days instead of the classic 2-6 weeks and complete audit trail. The auditor calls, the evidence is ready. This means that contract drafting does not remain a legal document, but rather becomes an operational routine.

The decision between internal CISO, external CISO and hybrid model is not a question of faith, but a function of maturity, audit pressure, company size and budget. Three rules of thumb help. First rule: Less than 250 employees, medium compliance load, no hard audit within 12 months: external CISO as a service with a clear officer mandate. Second rule: 250 to 1,000 employees, NIS 2 requirement, first audits: hybrid model with half ISB internally and external officer as backup and specialist.

Third rule: from 1,000 employees, multiple locations, tough regulation (NIS-2 essential, DORA, KRITIS): internal CISO with team, external specialists for defined workstreams. The following applies in all three constellations: The workspace and the appointment certificate must be properly managed, otherwise the best model is of little use. Deadline begins as soon as we become aware of it. With NIS-2, 24 hours count for early warning and 72 hours for follow-up reporting.

CIVAC is the compliance platform and officer-as-a-service that maps these models. 25 officer roles are live, including the Information Security Officer. 93 controls according to ISO/IEC 27001:2022, 490 audit templates, NIS-2 24/72 reporting path. Licence the workspace for your internal representatives or have our representatives order it. Handover in 2 working days instead of 2-6 weeks classic, EU data residency according to standard. If you would like to evaluate the reliable cost calculation and the appropriate model for your house, write to info@civac.de or use the contact form. We provide a concrete recommendation with model comparison, contract template and handover plan, tailored to your maturity level and audit schedule, including reporting line to management and appointment certificate. Turn reading into an assignment. The auditor calls, the evidence is ready. The appointment certificate, signed, filed, verifiable.