Glossary term
Chief Information Security Officer (CISO)
Subject: Technology, Cyber and Data, IT and Data Governance
Also known as: Head of information security
The CISO is the senior executive accountable for an organisation's information security strategy, policies and programme, who reports on cyber risk to executives and the board.
Explanation
The role sits where technology, risk and business meet. A CISO sets the security strategy and policies, runs or oversees the security team, and decides how threats are monitored and how incidents are handled. Translation is a large part of the job: the CISO describes cyber risk to directors as business impact, cost and likelihood, and asks for the budget and decisions needed. Reporting lines vary. Some CISOs report to the chief information officer, which can create a conflict when security advice limits technology plans. Others report to the chief risk officer, chief operating officer or CEO, which gives more independence. Many regulators now expect a named senior person to hold this accountability. The CISO normally works with the data protection officer, internal audit and the technology function, but does not own all risk: business units still own the risks in their own processes.
Example
After a phishing campaign hits a regional lender, its CISO leads the response, briefs the board the same day on scope and customer impact, and later proposes mandatory multi-factor sign-in. The proposal needs a budget from operations, so she presents the risk and cost to the executive committee for decision.
Not to be confused with
- Data Protection Officer (DPO)
- A DPO advises on privacy law compliance and must be independent; the CISO owns security of information and systems.