What a CIO actually does day to day

The CIO owns the relationship between technology and the rest of the business. That means setting the technology strategy, deciding where money goes, choosing which systems run the company, and making sure those systems are reliable, secure and fit for what the organisation is trying to achieve. A good CIO spends less time inside the data centre and more time in the boardroom, translating commercial priorities into a coherent technology plan and translating technology risk back into language the board can act on. The discipline behind that translation is what Starkhorn calls IT strategy, and it is the core of the job.

In practice the work spans four areas: strategy and planning, delivery and operations, people and suppliers, and risk and governance. The CIO sets the direction, oversees the systems that keep the business running, manages the internal teams and the external vendors, and answers for whether the whole estate is safe and compliant. On any given week that can mean approving an investment case, killing a project that has lost its rationale, or sitting with the board to explain why a piece of legacy software is now a liability.

The CIO’s core responsibilities

Strip away the variation between industries and the responsibilities are remarkably consistent:

• Owning the technology strategy and aligning it with the company’s commercial plan, not running it as a separate empire.
• Controlling the technology budget and making clear investment decisions about what to build, buy, renew or retire.
• Keeping core systems available, performant and supportable, so the business can trade without interruption.
• Leading the technology function: hiring, structuring teams, and holding suppliers to account.
• Driving change programmes, from system migrations to full-scale digital transformation in the mid-market.
• Carrying accountability for technology risk, including resilience, data protection and increasingly the safe use of artificial intelligence.

The thread running through all of it is judgement under constraint. A CIO rarely has enough budget, time or people to do everything, so the real value is in prioritisation: deciding what matters most and being willing to say no to the rest.

When a business actually needs a CIO

Not every organisation needs a full-time CIO, but most reach a point where technology decisions are too big to leave to an IT manager and too frequent to leave to the rest of the executive team. Common triggers include rapid growth that has outpaced the original systems, a private equity or board mandate to professionalise the function, a merger or acquisition that needs systems integrated, or a serious incident that has exposed how fragile the estate really is.

The other trigger is ambition. When a company wants to move faster than its current technology allows, someone has to own the plan to get there. If you are unsure whether you have reached that point, the honest test is whether technology decisions are being made deliberately or by default. Where they are made by default, there is usually a leadership gap, and our interim CIO leadership gap work exists precisely to close it.

CIO, CISO, CTO and IT manager: how they differ

These titles get used interchangeably, and they should not be. The CIO owns information and the systems the business runs on, with an internal, operational focus. The CTO owns the technology the business sells, with an external, product focus. In a software company the two can be distinct; in most mid-market firms the CIO covers both.

The CISO, or Chief Information Security Officer, is different again. Where the CIO is accountable for technology working, the CISO is accountable for it being secure. The CIO is judged on enablement, the CISO on protection, and the tension between the two is healthy. Smaller organisations often combine them, which is why Starkhorn offers a combined fractional CIO and CISO service rather than forcing a false choice. If your need is squarely security, our CISO as a service and virtual CISO offerings sit closer to that brief. An IT manager, finally, keeps the lights on; a CIO decides which lights should be on at all. The distinction between the strategic vCIO role and the operational one is set out further in our vCIO explainer.

Why CIO accountability now includes security and AI

The modern CIO cannot treat security as somebody else’s problem. The financial stakes are explicit: the IBM Cost of a Data Breach Report 2025 puts the global average breach at USD 4.44 million, and UK regulators have shown they will act, with the ICO fining British Airways £20 million in 2020 and Interserve £4.4 million in 2022. A CIO who ignores this is exposing the board, which is why board-level cyber governance and a tested incident response plan now sit firmly inside the remit.

Artificial intelligence has added a second front. Staff are adopting tools faster than most companies can govern them, creating shadow AI risk, and regimes such as NIS2 are raising the compliance bar. A CIO today is expected to enable AI safely, not ban it, and that balance has become one of the defining tests of the role.

How the CIO role is delivered: full-time, fractional or interim

A CIO does not have to be a permanent hire. Many organisations get the same strategic leadership through a fractional or interim arrangement, paying for the seniority they need without carrying a six-figure salary year-round. It is a real cost question: a senior security and technology leader in the UK can command anywhere from roughly £95,000 to £600,000 or more depending on scope, so the fractional model often makes commercial sense. Our CIO and CISO cost calculator and pricing page set out the options.

Fractional and interim CIOs are also the right answer at specific moments: leading technology due diligence on an acquisition, stepping in when a permanent CIO leaves, or bringing independent cyber security consulting to a board that needs an outside view. In regulated sectors such as financial services, that independence is often the point.

Why Starkhorn

Starkhorn is led by Daniel J. Jacobs, who has spent over 20 years in technology and security, 15 of them in leadership roles, including Interim Group Technology Director at VetPartners, the BC Partners-backed veterinary group, and CIO and CISO at Jardine Motors Group. He is the author of The Strategy Bridge and holds PRINCE2, ITIL Foundation and full membership of the Institute of Interim Management.

Having held the CIO and CISO seat at Jardine Motors Group and run technology at group level inside a private equity-backed business, Daniel understands what the role demands in practice, not just in theory, and brings that same accountability to clients on a fractional or interim basis.

Frequently asked questions