How CISOs Can Protect Their Personal Liability

The truth is that in today’s hyperconnected world, maturity-based cybersecurity programs are no longer adequate for combatting cyberrisks. A more strategic, risk-based approach is imperative for effective and efficient risk management (Exhibit 2).

Successful CISOs are specific and transparent about what they will do in their role. They reinforce the reality that security is a team sport. These communications and collaborations are far more important than any technology purchase or deployment.

Long-lived and successful CISOs are intentional and calculated in their planning and decision making. Without a strategy, you're purely reactive, and you find yourself reacting to fires all day, every day.

When you've created this kind of culture, management expectations are rooted in reality, where everyone considers their effect on the organization's security posture, and CISOs aren't faced with surprises, resistance, and friction that make them want to quit. If you advocate with the clarity that most cannot find in cybersecurity, you will achieve

Today’s CISO must set security policy, with almost no authority to enforce it across business units. Moreover, the CISO must act as a diplomat to those business units and serve as explainer-in-chief to more senior executives, as well as the board of directors, many of whom have zero interest in listening to a security briefing.