Finish the seven steps on this page and four pages are in front of you, each one readable by a finance director, a chair or an incoming vendor without translation. The first sets out the decisions an outside CTO will take over the next two quarters, with a deadline beside each line. The second compares the forms of provider you considered against four attributes you fixed before the first sales call. The third is the order you sign, which settles the unit of billing, the person who does the work, the substitution rule, the access boundary and the handover schedule. The fourth is a review day with the agreed numbers set out beside it. No part of it is elaborate. Every part of it stands so that a decision which would otherwise drift through a discussion can be checked by somebody who was not in the room.
An outsourced CTO is the CTO function delivered by a party who is not on your payroll, and the term covers arrangements that differ sharply over who bears the risk when a call turns out wrong. That is why what comes next is a sequence, each step constraining the step after it. The costly failures in this market tend to be sequencing errors. A wrong call at the start cannot be repaired by better work later. PSP IT, which sells outsourced CTO work, sets out the objective of the role as maintaining control over the organisation's whole IT workflow and keeping the technology stack aligned with business goals. That is the standard these seven steps are designed to reach.
1. Write the mandate as a set of decisions, each with a deadline
The first document is a page of decisions you are handing to the outside CTO for the next two quarters, with the deadline each one falls due and the person inside your business who supplies the evidence for it. Write it before you speak to a vendor, because a vendor prices a mandate and discounts a wish. Each line reads as a verb, an object and a deadline: choose the payments provider by 14 March, sign the retention schedule by 30 April, decide whether the warehouse stays on premise by 31 May. The words oversight, advisory and support do not belong on that page unless a decision and a deadline stand beside them.
Red Eagle Tech states on its fractional CTO and IT strategy page that a full-time CTO in the UK typically costs £120,000 to £180,000 a year, and Aalpha's guide for startups gives the figure for the United States and Europe at $150,000 to $300,000 annually before equity is counted. The mandate page is where you say which of those costs you are declining to pay, and for how long.
The step is finished when every line would stand up to a question from your finance director. If most would fail that test, you have produced a job description.
2. Choose the form of provider you will engage, and the two you will set aside
Four forms sell under the same three words, and they differ on who does the work, how many hours arrive each month and who absorbs the cost of a wrong call. A solo practitioner is one person who does the work and is accountable for it, engaged for a fixed number of days a month. A boutique practice of several people gives you a designated lead plus a colleague who can cover a holiday. An agency bench places an architect you interview and keeps a contractual right to substitute that person, which matters more than the interview itself. A managed service provider with a CTO overlay sells strategy as a layer on an operational contract, so the CTO is a role inside a service and the service is accountable for the work, which is the arrangement Stripe OLT sets out in its CTO consultancy.
Aalpha's startup guide sets out the same market in four models: a fractional CTO at ten to twenty hours a week, an interim CTO for a fixed transition, a virtual CTO on a remote subscription, and CTO-as-a-Service delivered by a firm with a bench behind the individual. Set the mandate page beside those four and the choice narrows quickly, because a modest mandate does not need a bench, while several concurrent decisions with an engineering team involved do.
Stripe OLT publishes this comment from a client, the NHS Alliance:
Our partnership with Stripe OLT has empowered us to focus on what we do best, knowing that our technology and security needs are in trusted hands. We look forward to continuing this successful collaboration as we drive towards even greater achievements.
Read that as Nikki Barraclough, Director of Finance & IT at the NHS Alliance, and notice what the words praise: trust, and the room to concentrate on the business. Move on when you can name the one form you will engage and the two you will set aside, without reopening the mandate page.
3. Give the engagement one unit of billing and one full-year number
The unit of billing is whatever the bill is based on, and the options behave differently when the work changes form. A monthly retainer covers hours or days and is the easiest to adjust when the mandate page moves. A fixed price covers a defined deliverable and is safest when the scope will not move. Time and materials covers effort and protects you when the scope is genuinely unknown at signature.
Imaginovation's guide for CTOs sets out the wider menu the industry uses: fixed price, time and materials, cost plus or open book, incentive-based pricing, shared risk and shared reward, pay per use, and gain sharing. For a CTO engagement the first three are the realistic options, and the real difference between them is who bears the risk of the estimate being wrong. DashDevs sells the same idea in four pack sizes, running from a one-time advisory session through project-based and part-time arrangements to a full-time CTO supplied by a service company, and the one-time session is the only one of the four that cannot support a decision with a deadline on it.
Price the loaded figure before you compare anything: the contracted units multiplied by the rate, plus the internal hours your own people will spend supplying evidence and sitting in sessions, plus access, legal review and any tooling the CTO asks you to acquire. Red Eagle Tech reports on the same page that its clients typically see savings of 20 to 30 per cent once IT spending and contracts have been reviewed. That saving lands on the technology estate, and the engagement fee is a separate line, so both numbers belong on the same page so that nobody confuses them later. Move on when you have one full-year number that includes your own people's time.
4. Draw the access boundary before the compliance scope
Access is settled first, because compliance work expands to fill whatever access you grant. One page should say which systems the CTO can reach, under which specified account, whether that account belongs to them or to the company, what they may export, and what happens to the credentials on the last day. Compliance comes second, and the framework you choose runs on its own clock, because the clocks differ. Red Eagle Tech states on the same page that Cyber Essentials can typically be achieved in one to three months and that ISO 27001 usually takes six to 12 months. A vendor who accepts a three-month target for ISO 27001 has not read the standard.
PSP IT says of legacy migration that a structured, robust plan is needed to complete the upgrade without disrupting the business, and the same discipline applies to access: staged, set out, and reversible without an argument. The check is whether an auditor or your insurer could read the page and agree that the outsider has enough access to work and no more.
5. Settle substitution, handover and continuity before the first payment
The person who does the work and the person who covers absence both belong on the first page of the agreement. A solo practitioner is the person you engaged, so substitution is a change of contract. An agency bench or a managed service includes a bench, and the agreement needs a substitution rule that says who decides, on what notice, and whether you can veto the replacement. DashDevs sets out its full-time CTO as a dedicated specialist formalised through a service company, which is the arrangement where substitution is most likely and the rule matters most. PSP IT states that a detailed business continuity and disaster recovery plan improves your ability to stay operational during a disruption, and the same logic applies to the CTO role: a deputy identified in advance, a handover schedule and a final day agreed in advance. Move on when you can name the person who will do the work, the person who covers a holiday, and the person who takes over if the lead leaves the provider.
6. Fix the review cadence and the numbers the review will read
A review with no numbers is a conversation. Red Eagle Tech states on its fractional CTO page that it agrees clear KPIs at the start of every engagement and reports against them regularly, and the same discipline should be in the agreement you sign. The numbers to fix are the ones that match the mandate page: decisions taken, decisions overdue, spend against the technology budget, risks closed, and access changes made. PSP IT says it takes a proactive role in planning annual IT budgets and keeping vendors accountable, which is a useful reminder that the review is also where the CTO accounts for the money. Move on when the review day is in the diary for the next two quarters and the numbers are ones your finance director can verify without help.
7. Write the exit test before the first quarter ends
The exit test is the last step because it depends on the first six. The agreement should state what has to be true at the end of each quarter for the engagement to continue, and what has to be true for it to stop. Red Eagle Tech states on the same page that its engagements start with a free discovery call and carry no long-term lock-in, which is the commercial shape that makes an exit test meaningful. The test itself is simple: read the mandate page and mark each line closed, moved or stalled. A line that has stalled twice is evidence about the provider or about your own decision process, and the review should say which. PSP IT sets out its outsourced CTO service as agile and on-demand, which is only true if the client can scale the engagement down as well as up. End the engagement, extend it, or change its shape, so make the call on the evidence, with no regard for the comfort of having someone available.