The first year as a new CISO can be exhilarating and at times downright frightening. You have a lot to prove and minds to win over, but you also have the opportunity to start fresh and make a big impact.
Early on, the emphasis is on learning the lay of the land of your new organization, assessing the company’s security maturity level, developing a business-focused security strategy and building up the relationships and political capital needed to make it a reality. But what happens once your first month, your first quarter is under your belt? You have a solid strategy in place and you’ve survived your first board meeting … what’s next?
Contents
How Will You Put Your Plans into Action?
Security doesn’t happen in a vacuum. Even when you have sign-off and budget for your initiatives, executing consistently requires considerable political sway.
In other words, it’s time to cash in on the political capital you’ve been building from Day 1.
One of the biggest mistakes you can make as a new CISO is not maintaining strong lines of communication with key stakeholders, business leaders and risk owners. And we’re not just talking about IT leaders; senior executives in finance, personnel and operations all have a significant stake in the success of your security initiatives.
The level of friction you experience will be dependent on the political environment of your organization. Most organizations have a low appetite for change (even if they claim otherwise) and your best chance of overcoming the difficulties this can cause is to build and maintain strong relationships with key business stakeholders.
Be Seen as a Business Enabler
One of the most important tasks for any CISO, new or experienced, is the need for security to be seen as something more than a cost center. If your program is seen as not related to business objectives, it will be extremely difficult to get traction for your initiatives.
But what does it mean to be a business enabler? At a basic level, you can tie security to business objectives by asking questions such as:
- How much is our reputation worth?
- What impact would a breach have on our ability to do business?
However, these questions, while undoubtedly important to answer, are rooted in negativity. Seen in this light, security is still something that holds the organization back from doing valuable things.
To really be seen as an enabler, you need to go a stage further. For example:
- Could we enter new markets if we were confident in the security of our data and assets?
- Could we be early adopters of blockchain/IoT /something else if our house was thoroughly in order?
- Would it be easier to win government contracts if we could be sure of meeting regulatory requirements?
Managing stakeholder perceptions of a security program is exclusively the domain of the CISO. If you want your program to be seen in a positive light, you’ll need to do two things:
- Invest your energy in building the relationships and communication channels needed to engage with key business stakeholders.
- Actively look for ways to tie your initiatives to important business objectives.
[button link=”https://resources.kudelskisecurity.com/addressing-security-leadership-talent-gap” newwindow=”yes”] Are you a budding CISO? Read our latest executive research to learn how to make that final jump.[/button]
Demonstrating Business Value
As you settle into your role as a CISO, one of the most important functions of program measurement is using metrics to tell a story—specifically, the story of where the organization is in the security journey.
For example:
- Have your initiatives led to a reduction in wasted time for IT staff because they aren’t constantly having to rebuild PCs that have been infected with malware?
- Is the uptime of vital IT systems higher as a result of improved security controls?
- Have phishing awareness tests reduced malware outbreaks and reduced incident management needs?
Identifying and communicating the business benefits of a security program is often difficult, but it can make a substantial difference in the way security is seen by the business.
When it comes to communicating with the board, make sure you’re staying on top of the “latest and greatest” threats—particularly those that have featured heavily in the media. Demonstrating that you’re proactively preparing for new threat vectors is an excellent way to win board trust in your security program.
Handling Changes to the Business Landscape
Changes to the business environment—mergers and acquisitions in particular—can have an important impact on your security strategy and program.
Depending on the scale of change, you may need to conduct a new assessment and develop an entirely new security strategy. This is particularly likely if your organization moves into a new industry that’s heavily regulated. Buying a government defense contractor, for example, is a surefire way to turn a security program on its head.
Fortunately, security also has a valuable part to play in major business change projects. If your organization is considering adopting new technology or buying a company, having a seat at the executive table as a CISO gives you the opportunity to add significant value.
- How much will it cost to securely adopt a new operational technology (OT) solution?
- What is the state of security at a company you’re acquiring? How much will it cost to reach an acceptable level of security? Can that amount be negotiated off the purchase price?
Of course, getting a seat at the table for major change initiatives is far from guaranteed. As usual, you’ll need to campaign for the access you need to add this type of value and continue building on the relationships and political capital you’ve been accumulating since Day 1.
Non-Negotiables of an Effective CISO
Fundamentally, being an effective CISO boils down to two things:
- Building and maintaining relationships with key business stakeholders.
- Being able to evidence the business value of your security program.
If you can do these two things consistently throughout your first year, you’ll pave the way for a strong, business-focused security program.