Companies that run an ISO 27001 ISMS and need the role reliably filled, but do not have the volume to justify a full-time hire. Typical triggers are an upcoming certification or recertification, security requirements in an enterprise deal, NIS2, or the departure of the internal contact who held the role.