The Strategic Value of a Chief Information Security Officer (CISO)

With the continued focus and talk of cybersecurity in the news, the Chief Information Security Officer (CISO) is a valuable resource to the Executive Team and Board of Directors. The CISO should be a key partner to your leadership team to help assess information and cyber risks and strategically address them to help protect financial, operational, reputational, and regulatory aspects of these growing business risks.

• It is “when, not if”. Given the fluid nature of cybersecurity, the reality of a breach occurring is high. A proactive culture of assessing and addressing risk to have a plan in place will help your organization manage, survive, and learn from the incident.

• Cybersecurity is a business risk at its core. Cybersecurity risk, like other business risks, should be understood and addressed by the business leaders introducing the risk.

The value of a capable CISO becomes clear in their ability to quarterback a coordinated game plan to address cybersecurity across the organization by building relationships that facilitate the discussion on protecting systems.

• A CISO should understand the underlying industry and business to help assess and address information and cybersecurity risks and then communicate the impact of cyber risk to the business.

• A CISO should provide options on how to address information and cybersecurity risks that consider business processes, technology, and external compliance requirements.

• A CISO should work with organizational units to manage information and cybersecurity risk using a combination of technology, people, and business processes.

• A CISO should work to improve business processes as they help the organization address their cybersecurity risk and comply with industry and regulatory requirements.

Any CISO will need clearly defined and unconflicted goals along with the support of the organization for them to successfully provide the leadership needed to address the practical and technical challenges facing the organization in both information technology and operational technology functions. That includes:

• A seat at the table and access to Board and executive leadership to fully understand the risks of the organization.

• To be aware of and involved with all business and technology projects to help manage risk and ensure security controls are in place.

• Resources to help implement a security program, manage cybersecurity risk, and provide effective governance over internal controls and compliance programs.

• Funding to assess and address information and cybersecurity risk. As the company’s lead security executive, the CISO requires budgeted resources to implement and manage a security program methodology.

All organizations need someone who provides this level of leadership around addressing cyber and information security within the business. However, not all businesses have the resources or time to invest in such a role. A fractional CISO offers advisory services designed to help business leaders address their technology and cyber security risk and provides a great option for an organization to start somewhere and not neglect the topic entirely. Remember, cyber risk impacts businesses and organizations of all sizes and in all industries.

An effective, fractional CISO encourages security governance from a leadership perspective using a top-down approach and will help the organization be proactive on this critical and complex business risk.

Another option is to consider adding a board member or advisor to the organization’s Board who has a background and expertise in cybersecurity. This approach can help drive a common conversation and approach across important topics like risk management, internal controls and cybersecurity.

Organizational design and reporting structure can have an impact on the value the CISO can provide to the business:

• Where the CISO reports to the Chief Information Officer (CIO) directly. This scenario can cause a challenge in conflicting priorities in terms of action and funding as the CIO is normally focused on enabling information and technology to support business operations whereas the CISO is focused on protecting information and technology from an incident.

• Where the organizational structure has the CIO and CISO functions filled by one person. This creates the conflict noted above but does so within one person. Each of these roles are significant to any organization meeting their business goals and individually can be taxing in terms of overall responsibility and stress load.

• Where there is not a clear expectation that the business unit leadership identifies and manages risk within their organization, leaving the CISO with all the responsibility to identify and manage risk that others are introducing.

As explored earlier, cyber risk is a business risk at its core. An organization that enables a three-way partnership between operational leadership, the CIO, and the CISO will have the best opportunity to simultaneously enable technology and protect information in the pursuit of meeting or exceeding the goals of the business.

• Does your Board have a member or advisor focused on cyber risk?

• Do your CISO and CIO functionally have conflicting priorities?

• Does your business treat cyber risk as a core business risk vs. an IT issue?

• Do you have the resources and expertise within the business to identify and address cyber risk?

Would you like to discuss this topic further? Contact Brian Howell from Crestview.io