Cybersecurity Leadership Role A Sweet Spot for the CISO

Cybersecurity has traditionally been a subject only a few executives were expected to understand. However, as additional security concerns are spreading across businesses, cybersecurity now concerns all members of the C-Suite. For example:

• The chief financial officer needs to ensure secure transactions between financial institutions or business partners.
• The chief marketing officer needs to master how to securely leverage digital and social media without putting the organization at risk.
• The chief human resources officer needs to know that digital recruiting processes are secure and personal data won’t be compromised.

Cybersecurity concerns and capabilities for each managing function should be harmonized under companywide priorities and principles. This presents new opportunities for the Chief Information Security Officer (CISO). To get to this point, the organization needs to establish these key processes:

1.  The CISO needs to interact directly with all C-Suite members.
2.  The  C-Suite needs to agree on what the company wants to do from a holistic perspective.
3.  The CISO needs to facilitate these discussions.

To facilitate these critical conversations in the C-Suite, the CISO should be prepared to ask the following questions:

• What are the crown jewels we want to protect with the highest priority?
• What are the business consequences if those crown jewels are stolen?
• How much are we willing to invest to mitigate those risks?

Integrating cyber-resilience solutions

Across each organization, there can be many solutions to address cyber resilience. A technology solution could be managed-security services; a financial solution could be cyber insurance; an operational solution could be a Computer Security Response Team (CSIRT); a legal solution could be fiduciary actions based on the advice of attorneys.

The key is to integrate these solutions into a cybersecurity strategy that supports the business priorities of the company. Many companies have not defined and assigned a person to lead that effort. This is a new space in corporate business management—and a new opportunity for the CISO.

Conclusion

By taking on the cybersecurity leadership role in the C-Suite, a CISO can develop and drive a cybersecurity strategy that becomes a comprehensive and integrated package, rather than an aggregation of independent tactics. It can be owned by the entire C-Suite and woven into the companywide business strategy. This will help to reduce risk and improve cyber resilience.

Shinichi Yokohama

Source: https://www.securityroundtable.org/cybersecurity-leadership-role-sweet-spot-ciso/