Organizations are facing unprecedented cyber challenges alongside the rigors of regulatory compliance. In navigating these struggles, the role of the CISO is critical. This article aims to reflect key principles that will assist you in the process of selecting a CISO in general, and specifically when considering CISO-as-a-Service.
What are the expectations for a CISO-as-a-Service, or a CISO in general? It is vital to understand that a CISO does not deal solely with technology. On the contrary—the CISO is fundamentally not a technical role. A CISO must be a business enabler with management capabilities, someone capable of understanding the company’s business processes, building and leading information security workflows, and possessing the necessary skills to communicate with executives and the Board of Directors in their own language.
Key considerations for choosing a CISO:
- Business Understanding: A CISO must be able to understand business processes. This means going beyond technical terminology to see the big picture of how security initiatives support and enable business goals from an executive perspective.
- Presentation Skills for Management and the Board: One of a CISO’s primary roles is presenting to management and the Board. They must be able to create clear, concise, and impactful presentations that communicate risk posture in business terms.
- Risk Management: Not everything is an emergency. A skilled CISO will prioritize risks and handle alerts and vulnerabilities without causing unnecessary panic, maintaining a balanced perspective on what truly requires attention and when.
- Leadership: A CISO must lead, not be led. A CISO should lead by example and drive others to perform their duties.
- Root Cause Analysis: A CISO must know that the solution to every exposure and risk is not automatically “implementing more technology.” The root cause of many information security issues is a lack of defined processes. Technology is intended to support a process—not replace it. Evidence of this is seen in companies purchasing more and more technology—a celebration for the cyber market—while risk continues to escalate.
The Skills Gap
The market has been flooded with schools and CISO certification programs that accept almost any applicant. This has created a gap in candidate quality; many individuals hold the title of CISO without the required experience or the managerial capacity necessary for the role.
From Infrastructure to CISO – The Gap is Simply Too Wide
As important as it may be, a successful background in infrastructure, networking, or as an analyst does not qualify one for the role of CISO. The transition from these technical roles to a strategic management position requires significant upskilling and a fundamental shift in perception; it cannot be achieved through a CISO course alone. Unlike the aforementioned roles, a CISO must think beyond technical problems, lead and develop information security processes, and possess managerial skills and business acumen. The CISO must align security initiatives with business objectives.
The CISO Role Requires Multidisciplinary Skills
The combination of management capabilities, technical knowledge, regulatory understanding, leadership skills, and a shared language with management is rare and almost impossible to find in a single person. This is why the concept of a CISO group—led by an Executive overseeing a team of experts—is gaining momentum to ensure the client receives comprehensive coverage. Different team members provide expertise in various fields such as regulation, incident response, security architecture, secure development, and more, ensuring all aspects of cybersecurity are covered.
Your Deliverable is Improved Management:
A managerial CISO will focus on strategic leadership, communication with the Board, and aligning defense efforts with business goals, while the team handles technical, procedural, and operational tasks.
You Get What You Pay For
With a few simple questions, you can discover whether the CISO offered to you is an infrastructure manager or a true CISO:
* Question: What is an “asset” in the eyes of management? Answer: An asset is information, such as a customer list (an asset is not a server).
* Question: Is ransomware a risk? Answer: Absolutely not; it is a threat (the risk is the financial cost resulting from the event).
* Question: Must every published vulnerability be immediately mitigated by shutting down systems? Answer: No, only if it has the potential to be realized/exploited.
Additional experience-based questions: How many times have you performed asset or process mapping? How many cyber incidents have you handled or managed? Have you presented to management or the Board? Have you built an annual work plan? What control tasks would you expect to find in an HR procedure?
The cheapest option often means compromising on quality. A low-cost provider will likely offer someone with limited experience and insufficient skills, often resembling an infrastructure manager more than a CISO.
Choosing a CISO service provider is a strategic decision that can significantly impact your defensive posture and level of readiness for a cyber incident. It is essential to look beyond technical skills and price to determine if the provider is offering an infrastructure person disguised as a CISO, or a full team supporting a skilled CISO who operates according to proven information security management methodologies.