What Are CISOs and What Do They Do?

Where CISOs Come From

Surprising to many, it is quite common for the Chief Information Security Officer to come from a non-technical position, such as someone whose career has been in the Legal or Financial areas of the company. This makes sense—many organizations are realizing that cybersecurity issues, while certainly technical in nature, are most impactful to the financial bottom line or can even thrust the company into legal peril through regulatory or liability issues. So an understanding of these functions on a foundational level is vital.

Further, business backgrounds and degrees help CISOs speak the language and communicate effectively with C-Level colleagues and members of the Board.That being said, it also helps if the person selected as CISO at least has strong technical interests or aptitudes. Most certainly, they should be trained in networking and spend a good deal of time on the plant floor learning about what makes the organization run from a technical standpoint.

Treat Your CISO Right

A good Chief Information Security Officer is hard to find—and even harder to keep. One reason is that an individual with both effective business and technical skills is a rare commodity, and once someone proves their mettle in the position, recruiters will undoubtedly come calling. 

However, turnover is also high because of some more unfortunate reasons. Sometimes, CISOs seem to be set up as “window dressing” - merely paying lip service to client, industry or Board demands. In these cases, the CISO might not be given the proper authority or budgets matching their position, and the disconnect between the monumental responsibility of maintaining cyber security and the receipt of inadequate organizational support to deliver results can take its toll—not only on the individual, but on the company as well. If you have a CISO, or when you do, don’t fall into this trap. If you create the role, make it count.

Learning From Colleagues

The Chief Information Security Officer is a relatively new position, and to the best of my knowledge, there is not yet an official certification or accreditation program for the role. However, there is a fairly robust network of CISOs sharing information, key learnings, experiences and best practices with each other, through various trade organizations as well as through business networking sites such as LinkedIn. Newly minted CISOs should be encouraged to find these sources of professional support. They may also be helpful for finding a CISO, if your organization is ready to evolve in this direction or needs a new one.