Hello friends,
A CISO role is a role that changes color every year and sometimes even more.
There are quite a few people who wonder what the role of the CISO (Chief Information Officer)
is. To Whom is CISO reporting? Is this a C-Level role? What makes a CISO great?Andd quite a
few more questions.
Following my experience and additional research, I will make some order on the subject and
distribute my answer clearly and fluently for each question.
I will focus on the three questions I mentioned as they are frequently asked.
A. What is the role of the CISO?
The main responsibility of the CISO in the organization is: (Categories)
Security operations on the company’s local assets and/or in the various clouds
- Cyber Risk and Intelligence
- Detection and prevention of d ata loss and attempted fraud
- Security architecture
- Identity management and access to organizational systems
- Management of annual plans and roadmap for at least three years
- Event detection, investigation, and criminal identification
- Governance, policy description, and processes that determine how organizations
identify, prevent, and respond to cyber incidents - Risk survey and preliminary activity to reduce and avoid damage
- Initiating and leading the implementation of standards/standards/laws in information
security
The main skills required from CISO are:
Risk and standardization management, extensive technical experience and knowledge,
identity management, crisis management, application, and database security, data, and
asset management, smartphone management and all remote connection equipment,
disaster recovery planning, communications and firewall management, strategic
management and execution tactics, recognition and knowledge of integrity / Laws /
various standards in information security
Key leadership qualities expected of CISO are: (Categories)
- Leading processes for execution and persuasiveness
- Cooperation between organizations and in general
- High personal communication
- Management of objections
- Transfer of targeted information to management
- Has a flight and vision
- Business thinking with a balance of strategic technological and technical thinking
- Decision making
Key character traits expected from CISO are: (Categories)
- Integrity
- Curiosity and constant learning
- Neat and organized
- Time management and priorities
- High interpersonal communication
- Promotion, improvement, and streamlining
- Independent
B. To whom the CISO is subject in the organizational hierarchy
Every organization is different, and there is no standard universal reporting system. Until a few
years ago, it was customary for the CISO to report to the CIO (Chief Information Officer), but as
the cyber world continues to evolve and its complexity increases and requirements only
increase (threats, risks, constant awareness, regulations, and standards, etc.) then large
organizations recommend the CISO be C -Level. (This is the answer to the third question, is CISO
a C-Level role)
In light of the described and years of experience, there are Common Practices regarding CISO
subordination in the organizational hierarchy, when each has its advantages and disadvantages.
(Subordinates to CRO / CTO / COO / CFO etc.)
C. Is CISO a C-Level position?
Please refer to my answer to question B
D. What makes a great CISO? (Some examples)
- Responsibility for making sure the board of the company and the CEO understand, and
are awa re of security, knowing; what are the high-level threats and exposures, what
could be the financial impact on the business, and putting together a strategic plan for
cyber security to make sure that it’s properly implemented across an organization and
there are no surprises awaits at the door. - Business enabler
- Approach: Fact-based, holistic, and multilayered
- Adopt Security on business changes & growth. Be creative on architecting a solution
- Regularly Data-Driven Security Risk Awareness and prevention
I hope I was able to make some order on the subject.
Any feedback, remarks, clarifications will be appreciated
