I recently had the honor to participate at the Open Lesson of the Executive Master in Cybersecurity and Data Protection organized by 24ORE Business School, where we discussed about the role of the Chief Information Security Officer (CISO).

In a scenario where cyber attacks and cyber threats are constantly lurking, it is imperative that companies are prepared to manage and mitigate these risks in accordance with budget needs and business objectives.

The role of the CISO fits into this context since is responsible for setting and managing the corporate Cyber ​​Security posture.

CISO’s tasks include the definition of long and short-term strategies, best practices, the verification and implementation of processes to mitigate the risks of cyber space, the spread of the cyber security culture in the company.

The role of the CISO is as strategic as it is still not very widespread and is only now starting to get the attention it deserves.

However, it is very important that it respects some characteristics:

1. THE CISO IS NOT A TECHNICIAN
   
   Although often confused with a technical figure, the CISO cannot limit itself only to this aspect.
   
   While understanding the dynamics and complexity of the cyber world, this role must in fact be played mainly by a manager, able to understand company needs and communicate with management at the same level.
   
   A sort of hybrid figure able to connect and understand both worlds, the technical one and the business one, to find the most suitable solutions to guarantee the protection and availability of data and corporate assets.



2. THE CISO MUST REPORT TO THE BOARD
   
   For this role to be effective, however, its placement in the organization chart must be correct.
   
   In fact, when present, the CISO is often employed by other C-level figures such as the CIO (Chief Information Officer) or the CTO (Chief Technology Officer).
   
   This depends on the fact that Cyber ​​Security is still seen as a sub-set of the IT world, but it should be emphasized that this conception is wrong and limiting.
   
   In fact, the purpose of Cyber ​​Security cannot be limited only to the protection of computer data, but is rather to protect all important assets for companies, institutions and citizens.
   
   In the case of networked medical devices and electric cars, for example, these assets also include human lives.
   
   It is therefore important to evaluate Cyber ​​Security as a subject in itself and to ensure that the CISO can report directly to the company Board to maintain the autonomy and decision-making power it needs to operate.



3. THE CISO MAY BE AVAILABLE IN “AS A SERVICE” MODE
   
   The figure of the CISO would be useful in any company.
   
   It is easier to find this role in large companies, but in small and medium-sized companies things get complicated.
   
   Often SMEs do not have enough funds to hire a CISO and in these cases it would be useful to be able to use a “CISO As a Service” service, being able to “rent” this professionalism as needed, optimizing costs and thus making the function accessible. even to smaller companies.
   
   Although this service would make it possible to spread the figure of the CISO even for companies that cannot afford it, on the other hand, since it is a figure outside the company, there could be a lot of resistance to placing it correctly in the organization chart, going to interfere with correct operation. of this role.

Ultimately, CISO must devise and manage Cyber ​​Security strategies in compliance with the corporate budget, in order to spend it effectively and efficiently.

In a scenario where resources tend to be scarce in the face of ever-increasing threats, it is in fact a priority to correctly manage budgets in order not to obtain greater damage.

Knowing the threats for the specific sector and risk model of the company is certainly an excellent tool in this sense, which allows you to target strategies and defenses more precisely. The scenario of cyber threats changes continuously and very rapidly, so it is very important to obtain timely and detailed information about it.

Hackmanac can be useful for this purpose, ask us how!