Part-time CIO: giving a small business’s IT someone at the controls

A small business has no IT department. It has one supplier for devices, another for email, a software vendor for sales management, a third for the website, and someone inside — often the managing director or the office manager — who signs the invoices. A part-time CIO fills that gap: giving IT someone at the controls a few days a month, without the business hiring a profile it could not keep busy full time.

What is missing is not technical skill: every supplier has it within its own scope. What is missing is someone whose job is to look at the whole, arbitrate between each party’s interests, and answer to management rather than to a vendor.

The symptom: suppliers, but no pilot

A small business’s IT rarely grows to a plan. It grows in layers: a need appears, a supplier answers it, a contract is signed. Each decision is reasonable on its own. The whole was never decided.

The consequences show in a few signs: contracts renewed automatically whose content nobody remembers, licences paid for the accounts of staff who have left, backups whose restoration nobody has ever tested, incidents where each supplier points at another. None of these is serious alone. Together, they describe a business that spends without deciding.

These businesses almost always have an IT go-to person who never chose the role. It is whoever is most at ease with the tools, who was handed the passwords, then the supplier relationships, then the licence purchases. They do what they can, on top of their actual job. Nobody gave them a mandate to arbitrate, the time to do it, or the authority to contradict a supplier.

This is the ground covered by several subjects already discussed here, which converge: what a maintenance contract actually commits to, the reversibility clause people regret not having written, and the fact that outsourcing does not transfer responsibility. Each describes one piece of the same gap.

The remit of a part-time CIO

A part-time CIO’s remit divides into three workstreams. They are not handled one after the other: they depend on each other.

Governance and budget

The first task is knowing what IT costs, and to whom it is paid. It sounds elementary; it is rarely done. Spending is scattered across several accounting lines, several company cards, several departments. Gathering it often gives management its first overall view.

Governance comes next: who decides on a new tool, who approves a quote, who can create an access right. Until those rules exist, decisions are taken as they come, and the part-time CIO spends the time repairing them. Once written, they hold between visits.

The annual budget and roadmap can then take a form management can read. For a business that must plan its investments over several years, this is the starting point for an IT master plan sized to it.

Finally, a pilot needs instruments. A handful of indicators is enough, provided they are followed: incidents and time to resolve them, spending by line compared with budget, progress on committed projects, upcoming contract deadlines. Presented to management at fixed intervals, they turn IT from something endured into something steered.

Suppliers and contracts

The second workstream concerns those who do the work. The part-time CIO lists the suppliers, reads their contracts, checks what is really covered — response times, backups, reversibility, onward subcontracting — and prepares renegotiations before the renewal dates rather than after.

Above all, the part-time CIO becomes their single point of contact. A supplier answering to someone who can read its invoice does not work the same way as one answering to a busy managing director. The change often shows within the first months, without a single contract being altered.

Security and compliance

The third workstream is the one put off until the incident. It starts with simple measures, which ANSSI, the French national cybersecurity agency, gathers in its IT hygiene guide: an inventory of accounts and access rights, tested backups, applied updates, restricted administrator rights. None requires a large budget; all require someone to take charge.

Then comes the question nobody asks before an incident: what happens the day everything stops? Whom do we call, in what order, with which access rights, and how long can the business carry on without its systems? Writing those answers down calmly, in a few pages, costs little. Improvising them on the day of an attack costs far more, and shows from the outside.

Compliance follows the same path. The record of processing activities, data-processing agreements under the GDPR, the data retention policy: these are management subjects, which the part-time CIO prepares and management decides.

Outsourced CIO or managed services: not the same thing

The confusion is common, and expensive. An outsourced CIO and a managed-services contract do not answer the same question.

Criterion	Outsourced CIO	Managed services
Question addressed	What should be done, and with whom?	How do we keep what exists running?
Role	Decide, arbitrate, check	Operate, maintain, fix
Answers to	The business’s management	Its own service contract
Interest	That IT serves the business	That the contract is profitable and renewed

The two are complementary, not competing. The managed-services provider runs what exists; the part-time CIO decides what to hand it, sets its commitments, and checks they are kept. Giving the second function to the first amounts to letting the supplier write the specification it must meet.

At what size does a small business need one?

Headcount is the wrong way in. A fifteen-person business whose activity rests on critical business software, sensitive customer data and four suppliers needs a pilot more than a hundred-person business equipped with three well-administered off-the-shelf tools.

The useful criteria are of another kind: the number of suppliers to coordinate, how far the business depends on IT, how sensitive the data processed is, and how many technical decisions must be taken in the year. When several of these apply, the question is no longer whether a pilot is needed, but in what form.

Two other forms exist. For a departure, a crisis or a migration, an interim CIO answers an intense, bounded need. And before choosing, an IT audit for a small business shows what there really is to steer. That is often where a Maeliom Consulting engagement begins: the state of play first, the form of support second.

Cadence, cost and limits of the model

The cadence of an engagement follows the volume of decisions, not the size of the business. At the start, presence is heavier: the inventory, the review of contracts and the first security measures take time. It then settles into a regular slot, with written rules doing the work in between.

Cost follows the same logic. It consists of an agreed number of days, billed as a monthly flat fee rather than by the hour, so that management knows what it is committing and the part-time CIO has no incentive to multiply interventions. The useful comparison is not with the salary of a full-time CIO, whom the business would not hire anyway: it is with what poorly renegotiated contracts, unused licences and projects without acceptance criteria cost today.

Finally, the model has its limits. It does not replace a daily presence once IT becomes the core of the business, it assumes suppliers able to operate without hour-by-hour supervision, and it is only worth anything if management gives it a real mandate — access to contracts and invoices, and the right to say no. Without that mandate, the part-time CIO becomes one more adviser, and the business is back where it started.

Common questions