On 15 October 2026, the audit firm BDO published six findings from its security assessments of Swiss SMEs: the technical basics are usually solid, and attacks rarely succeed because of a purely technical flaw. What is missing is clear ownership, written procedures and management that actually steers the subject. A fractional CIO can fill that gap in a small business without an IT department, provided you know what the role covers, and above all what it does not.
Key takeaways
- According to BDO, the weak link in SMEs is no longer the firewall, but the lack of ownership, procedures and decision paths.
- Your IT provider is not an emergency plan: business continuity remains the company's own responsibility.
- According to the ESET 2026 index, 45% of the businesses surveyed suffered a security incident in the last twelve months.
- A fractional CIO steers, documents and arbitrates. It replaces neither day-to-day support nor night-time on-call cover.
What is happening
October is European Cybersecurity Month. BDO Switzerland used the occasion to publish what it sees in the field, after carrying out many security assessments in SMEs. The good news first: firewalls, antivirus, updates and backups are usually in place, and IT partners do quality work. That is precisely what gives businesses a false sense of security.
The gaps lie elsewhere. Who may approve a payment order received by email from management? Who should staff report a suspicious message to? Who decides, at three in the morning, to shut down critical systems? Very often, nobody has answered these questions. BDO lists typical cases: payments made on the strength of a single email, former employees' accounts still active for months, external providers keeping permanent access without any real oversight.
The most useful finding for a business owner concerns the provider. Many companies assume that, if something goes wrong, their IT partner will handle everything. The partner can restore systems, provided it has the mandate, the backups and the resources, and in a large-scale attack it may have several clients hit at once. But how long can the business run without IT, which customers must be told, who talks to the insurer? No provider can answer on the company's behalf. For BDO, an emergency plan that boils down to an IT service contract is not an emergency plan, and cyber risk belongs to management, just like the risk of fire.
ESET's figures point the same way. Its SMB Cyber Readiness Index 2026, which surveyed 4,400 businesses with 25 to 1,000 endpoints in 13 countries, reports that 45% of them suffered an incident in the last twelve months. The most common causes are nothing exotic: phishing (26%), unpatched vulnerabilities (23%), lack of security monitoring (22%), weak passwords (20%). And for 34% of businesses, investigating the incident took two to six weeks. These businesses are on average larger than the 5-to-50-person SMEs I am talking about here, and Switzerland is not in the sample: keep the order of magnitude, not the decimal point.
What it means for you: what a fractional CIO is for
In a business of 5 to 50 people, IT rarely has an owner. It is split between a provider who comes when called, an employee who "knows about computers" and the owner, who signs the invoices without always knowing what is being bought. Everyone does their part, but nobody has the full picture. That is exactly the gap BDO describes.
A fractional CIO, sometimes called a fractional CTO or a part-time IT director, fills that role a few days a month. The job is not to fix things, it is to steer.
They know what you own. An inventory of accounts, subscriptions, data and access: who holds the passwords, where the backups live, which providers have permanent access.
They write down what is written nowhere. Documentation of your systems, procedures (an employee leaving, payment approval, an incident) and an emergency plan on paper.
They arbitrate on the company's behalf. They compare solutions, write requirements, review providers' quotes and contracts, and check that what is delivered matches what was decided.
They report to management. Once a month or once a quarter, a clear status: what has been done, what is still at risk, what needs a decision.
What the role does not cover matters just as much. A fractional CIO does not fix the printer at eight in the morning, does not provide first-line support to every employee, and cannot be reached at night or at weekends. If your business stops when IT stops, you need a provider with on-call cover, and possibly a round-the-clock monitoring service. The CIO's job is then to define that contract in writing, limits included, and to check that it is honoured. The two complement each other; neither replaces the other.
What I have learned
I first saw IT from the inside, where it has a proper department. As a systems engineer at Vacheron Constantin (350 users across three sites), I ran migrations and managed the directory, security and backups, before the Richemont group hired me as an adviser to roll out across its brands the Citrix infrastructure I had designed. I then worked as a consultant for the State of Geneva, in the messaging and portals team (more than 30,000 users): archiving, storage, legal compliance. These organisations have procedures, owners and decision paths. That is precisely what an SME lacks, and what it needs at its own scale, without the bureaucracy that comes with it. My full background is online.
The case I use as a reference is AtonRa Partners, a financial management firm founded by professionals from large institutions. In 2010, they wanted to recreate the environment they knew, Lotus Notes included. My first job was not to install anything, but to separate stated needs from real needs, then to compare the options, open source and proprietary alike. The comparison came out in favour of Microsoft, even though I lean towards open source: an independent view exists to recommend what suits the business, not what the adviser prefers. Only then came the servers, email, telephony, remote access, documentation and staff training. In 2013, when the team grew from 5 to 15 people, I organised and fitted out the new offices.
There is a more uncomfortable situation than a new installation: taking over. The provider has left, nobody knows the passwords or how things are set up, and nothing is documented. In that case, I start with the same work: inventory, recovering access, documentation. The goal is not for you to depend on me instead of the previous provider, but never again to depend on a single person.
That is also why my monthly follow-up offer spells it out in black and white: updates, monitoring, a quarterly restore test, and no 24/7 on-call cover. I would rather you knew before signing than at three in the morning.
What to do in practice
1. Make one member of management accountable
One person in management owns IT and its risks, and the subject comes up at a management meeting at least once a year. This is the first question in BDO's self-assessment, and without it the others often go nowhere.
2. Take stock of what you own
Administrator accounts, subscriptions, where your data lives, backups, providers with access. Keep the passwords in a password vault that belongs to the company, not to an employee or a provider.
3. Put your provider's role in writing
What does it do in an incident, how fast, and where does its commitment end? How long would a full restore take? If nobody can answer, you know where to start.
4. Test a restore
A backup that has never been restored is only a hope. Have a folder restored, then a whole server, and time it. I go into more detail in the article on backups and ransomware.
5. Close forgotten access and write the procedures
Former employees, former providers, shared accounts: close whatever is no longer used. Then write three short procedures: an employee joining and leaving, payment approval through a second channel, and what to do in an incident, on paper.
6. Choose your model
An in-house IT person if IT is a full-time job, a provider on its own if your needs are simple and well defined, or a fractional CIO who steers, together with an on-call provider if your business cannot afford downtime.
Frequently asked questions
What is the difference between a fractional CIO and an IT provider?
The provider executes: it installs, fixes and maintains. The fractional CIO decides with you what needs doing, writes the requirements, checks the provider's work and reports to management. They work for the business, not for a vendor.
Does a fractional CIO replace on-call cover?
No. They cannot be reached at night or at weekends. If a system outage stops your business, you need a provider with contractual on-call cover; the CIO helps you define it and check that it works.
When is it better to hire?
When IT keeps one person busy full time, or when you need someone on site every day. A fractional role suits businesses that need someone to steer, not a permanent technician.
Going further
I produce a written assessment of your IT and how it is organised, then help you decide and stay the course: see the Strategy and guidance page. For the technical takeover and monthly follow-up, see the Systems and infrastructure page. To find out whether a fractional CIO makes sense for you, let's talk on a 20-minute call.
Sources
- La cybersécurité dans les PME suisses : six constats tirés de la pratique (Cybersecurity in Swiss SMEs: six findings from practice, in French), BDO Switzerland, 15 October 2026.
- ESET SMB Cyber Readiness Index 2026, ESET, global edition, May 2026 (4,400 businesses with 25 to 1,000 endpoints in 13 countries, Go4insight survey).
Photo: Ivan N / Unsplash (unsplash.com/photos/AfStyhXC5kM).
Tags: fractional CIO, IT director, small business, IT governance, cybersecurity, IT provider, emergency plan