A fractional CISO for Australian and NZ companies that can’t hire one
Board updates, the security questionnaire blocking a deal, the incident plan nobody’s tested, and now the AI tools your staff adopted on their own. I sit in your leadership meetings and own that agenda, part time, for mid-sized Australian and New Zealand companies that need senior security leadership without a full-time executive salary.
Haden McAlpine · CISSP · ISO/IEC 27001 Lead Auditor · 25 years in IT, cyber and infrastructure
What’s changed for Australian and NZ boards
Cyber risk is now squarely a directors’ duties issue. ASIC has taken a financial services licensee to court over inadequate cyber risk management and won. Businesses with annual turnover over $3 million must report ransomware payments to the Australian Signals Directorate within 72 hours. The Notifiable Data Breaches scheme in Australia and the breach notification rules in New Zealand’s Privacy Act put a clock on every incident. And from 10 December 2026, Australian privacy policies must disclose automated decisions, which pulls AI straight into the risk conversation.
Boards are asking better questions. Most mid-sized companies don’t have anyone senior enough to answer them.
What the role covers
Board and executive reporting
A risk picture the board can act on, in plain language, with the decisions they need to make, not a heat map.
Customer and supplier assurance
Security questionnaires, including CPS 234-driven ones from banks and insurers, answered once and consistently.
Incident readiness
A written incident plan, rehearsed with your team, with breach notification and ransomware reporting steps built in and the right retained response provider in place.
AI risk
An AI register, a use policy and controls aligned to the government’s AI6 guidance, so AI adoption doesn’t become the next unmanaged risk.
Roadmap and budget
A 12-month security plan tied to business risk, with a budget you can defend, including what not to buy.
Vendor and MSP oversight
Someone on your side of the table when the managed service provider reports on itself.
Background
Twenty-five years in IT, cyber security, cloud and infrastructure across retail, manufacturing and financial services. CISSP and ISO/IEC 27001 Lead Auditor, based in Sydney and originally from New Zealand. I’ve watched consultants hand a board a deck designed to scare them into a bigger contract. That’s not how I work. More about me.
Common questions
What is a fractional CISO?
A fractional or virtual CISO (vCISO) is a senior security leader who works for your company part time, on a retainer, rather than as a full-time employee. You get strategic leadership, board reporting and accountability, scaled to what a mid-sized business needs.
Do you work on site?
I’m based in Sydney. Most of the work runs remotely in Australian and New Zealand business hours, with on-site days booked for board meetings, workshops and tabletop exercises.
How is this different from what our MSP provides?
Your managed service provider runs your technology. A fractional CISO sets the risk direction, holds providers to account and reports to the board. The two work together, but you shouldn’t rely on your provider to assess its own performance.
Do you provide incident response?
I make sure you’re ready: a written plan, rehearsed with your team, with breach notification and ransomware payment reporting steps built in, and a retained incident response provider in place. I don’t offer 24/7 on-call incident command myself.