Chief information security officer

A chief information security officer (CISO) is a senior-level executive within an organization responsible for establishing and maintaining the enterprise vision, strategy, and program to ensure information assets and technologies are adequately protected. The first person to hold the title of Chief Information Security Officer was Steven Katz, appointed at Citicorp in 1995 after a major hacking incident.^[1] The CISO directs staff in identifying, developing, implementing, and maintaining processes across the enterprise to reduce information and information technology (IT) risks, manages security technologies, implements policies and ensures compliance with regulatory frameworks such as GDPR, PCI DSS and FISMA. The CISO is also usually responsible for information-related compliance (e.g. supervises the implementation to achieve ISO/IEC 27001 certification for an entity or a part of it). The CISO is also responsible for protecting proprietary information and assets of the company, including the data of clients and consumers. CISO works with other executives to make sure the company is growing in a responsible and ethical manner.

Typically, the CISO's influence reaches the entire organization. Responsibilities may include, but not be limited to:

• Computer emergency response team/computer security incident response team
• Cybersecurity
• Disaster recovery and business continuity management
• Identity and access management
• Information privacy
• Information regulatory compliance (e.g., US PCI DSS, FISMA, GLBA, HIPAA; UK Data Protection Act 1998; Canada PIPEDA, Europe GDPR)
• Information risk management
• Information security and information assurance
• Information security operations center (ISOC)
• Information technology controls for financial and other systems
• IT investigations, digital forensics, eDiscovery

Having a CISO or an equivalent function in organizations has become standard practice in business, government, and non-profits organizations. By 2009, approximately 85% of large organizations had a security executive, up from 56% in 2008, and 43% in 2006.^{[citation needed]} In 2018, The Global State of Information Security Survey 2018 (GSISS), a joint survey conducted by CIO, CSO, and PwC,^[2][3] concluded that 85% of businesses have a CISO or equivalent. The role of CISO has broadened to encompass risks found in business processes, information security, customer privacy, and more. As a result, there is a trend now to no longer embed the CISO function within the IT group. In 2019, only 24% of CISOs report to a chief information officer (CIO), while 40% report directly to a chief executive officer (CEO), and 27% bypass the CEO and report to the board of directors. Embedding the CISO function under the reporting structure of the CIO is considered suboptimal, because there is a potential for conflicts of interest and because the responsibilities of the role extend beyond the nature of responsibilities of the IT group. The reporting structure for the CISO can vary depending on the organization’s size, industry, regulatory environment, and risk profile. However, the importance of information security in today’s businesses has raised the CISO’s role to become a senior-level position.^[4]

In corporations, the trend is for CISOs to have a strong balance of business acumen and technology knowledge. CISOs are often in high demand and compensation is comparable to other C-level positions that also hold a similar corporate title.

History

The role of chief information security officer was found in the mid-1990s as organizations faced growing digital threats. Throughout many years, other large corporations, particularly in the financial-services sector had adopted similar roles such as cybersecurity and data protection, which also became an important part to business risk-management.^[5] Early CISO functions often put importance on technical security controls and the responses towards incidents. Over time, the role changed to focusing on enterprise risk, governing, privacy, board level engagement and business needs.^[6]

Responsibilities

Normal CISO responsibilities can include establishing any security policies, reacting to any cyber incidents, tracking identity and access management, regulatory compliance, managing overall information risk, business co-operations, disaster- recovery planning, and leading security operations teams. These responsibilities overlap with business units, IT, legal and finance departments. In modern organizations, the CISO usually play a more strategic role which includes advising executives and boards on cyber risk, merging security investment with enterprise priorities, tracking third party and supply-chain risk, and also tracking the development of the security environment and awareness across the business.

Many CISOs reported to the Chief Information Officer (CIO), however since the late 2010's organizations have increasingly changed the role to report directly to seniors in the management. A survey in 2020 found that only 34% of these roles reported straight to the CEO, while 33% reported to a CIO.^[7] Organizations with revenues under $100 million were less likely to have multiple advanced roles like CISO in comparison to bigger entities.^[8] According to the 2024 global survey of 416 CISOs, different reporting lines and models show an increase in complex governance, but the overall trend towards direct board or CEO access remains clear.^[9] The change to direct reporting has mainly been led by issues regarding conflict of interest if the CISO is included in IT operations, and by the requirement for independent management of the enterprise.

Qualifications and skills

CISOs usually have more than ten years of prior experience in information security or IT governance and often have professional certifications. A typical CISO holds non-technical certifications (like CISSP and CISM), although a CISO coming from a technical background will have an expanded technical skillset. As the role changed overtime, CISO's were usually not only expected to understand technical controls but also understand cyber-risk into business language and influence decision making in senior management. Steven Katz had stated that the role is about business risk and cybersecurity is a way to assess business risk, "not an end in itself".^[10] Key skills were now about organizational leadership, strategic thinking, communication with boards, budget management, vendor relations, business processes, regulatory overview, and the ability to merge security outcomes with business needs. Other typical training includes project management to manage the information security program, financial management (e.g. holding an accredited MBA) to manage infosec budgets, and soft-skills to direct heterogeneous teams of information security managers, directors of information security, security analysts, security engineers and technology risk managers. Recently, given the involvement of CISO with Privacy matters, certifications like CIPP are highly requested.

Virtual CISO

A recent development in this area is the emergence of "Virtual" CISOs (vCISO, also called "Fractional CISO").^[11][12] These CISOs work on a shared or fractional basis, for organizations that may not be large enough to support a full-time executive CISO, or that may wish to, for a variety of reasons, have a specialized external executive performing this role. vCISOs typically perform similar functions to traditional CISOs, and may also function as an "interim" CISO while a company normally employing a traditional CISO is searching for a replacement.^[13] These services typically include developing cybersecurity strategy, advising on cyber risk, checking on compliance and helping internal security teams. vCISOs have grown in popularity among small and mid sized enterprises who want better leadership without the cost of a full time CISO.^[14] Key areas that vCISOs can support an organization include:

• Advising on all forms of cyber risk and plans to address them: vCISOs can assess an organization's cybersecurity risks, develop strategies to mitigate those risks, and implement appropriate cybersecurity measures. They can also provide guidance on incident response plans, business continuity, and disaster recovery planning.
• Board, management team, and security team coaching:vCISOs can work closely with the board of directors, management team, and security team to provide coaching, guidance, and expertise on cybersecurity matters. This includes helping organizations understand the strategic implications of cybersecurity risks, developing cybersecurity policies and procedures, and ensuring that cybersecurity best practices are followed.
• Vendor product and service evaluation and selection:vCISOs can assist organizations in evaluating and selecting cybersecurity products and services, such as firewalls, intrusion detection systems, and security information and event management (SIEM) solutions. They can also help with contract negotiations and vendor management to ensure that organizations are getting the best value from their cybersecurity investments.
• Maturity modeling operations and engineering team processes, capability and skills: vCISOs can assess an organization's cybersecurity maturity level and develop plans to improve processes, capabilities, and skills of operations and engineering teams. This includes conducting cybersecurity assessments, implementing cybersecurity frameworks, and providing training and development programs for staff.
• Board and management team briefings and updates:vCISOs can provide regular briefings and updates to the board of directors and management team on the current cybersecurity landscape, emerging threats, and best practices. They can also assist in developing cybersecurity awareness programs and training for employees at all levels of the organization.
• Operating and Capital budget planning and review:vCISOs can assist in the planning and review of operating and capital budgets related to cybersecurity. This includes identifying and prioritizing cybersecurity investments, developing cost-effective strategies for cybersecurity, and ensuring that adequate resources are allocated to address cybersecurity risks.

Trends and conflicts

Today's CISO's have to face a range of different challenges which include a global shortage of good security professionals, rising regulatory issues and increased board critics. In 2019 survey, 53% of organizations they a shortage of cybersecurity roles. More recent data says that the salary of many CISOs increased but the job happiness had remained the same. A recent survey showed that the average salary was around $700,000 for big organizations but only around 60% were happy with the security budget and board.^[15] Regulatory actions have increased scrutiny on board governance for cyber security risks. Even the US Federal Information Security Modernization Act (FISMA) states that it is required for federal agencies to have a senior information security officer which shows the role's growing impact in governance. However, the merging of cloud structures, AI and ML threats, and supply chain-chain disruptions makes the role of CISO very important for enterprises.

Compensation

Compensation for CISOs has increased lot recently which shows the importance for their roles in today's world. In the United states, the median was CISOs was around $500,000 in 2024 and the high percentile earning executives, especially with larger companies) can be over $1 million annually.^[16]

Cybersecurity metrics and business value

The CISO may translate cyber performance into measurable business terms like value at risk (VaR) breach cost avoidance and incident response maturity. Researchers say that boards and executives expect security metrics to meet with financial metrics but a lot of times don't.

See also

• Information security
  • Information security governance
  • Information security management
• Board of Directors
• Chief data officer
• Chief executive officer
• Chief information officer
• Chief risk officer
• Chief security officer