AskACISO Interview With Paul Rivers, CISO at Yale University

Third, design technologies and processes that don’t just plan for high availability, but also for recovery and continuity. Lastly, ensure that these recovery and continuity plans are tested often enough to prove that they work.”

Get your business units to pull help from security and not have security keep pushing improvements on them. The main thing is for the CEO to not just provide support and resources for the CISO but to actually change the dynamic by regularly expecting each business line executive or functional leader to be able to articulate at some appropriate leve

This means demonstrating the financial, operational, and reputational benefits of investing in cybersecurity, making the case for cybersecurity as an integral part of your company's risk management strategy.