The role of the Chief Information Security Officer (CISO) is evolving. Market forces are reshaping the responsibilities and expectations of the Security Leader. To thrive, CISOs must adopt new strategies and characteristics.
Some of the market forces driving this change are:
- Emerging and integrated technology— Privacy and then AI was just the start. Identity as the perimeter is another example of technology change in the market.
- The workforce is demanding flexibility— and expect to feel equally connected whether in the office, or remote.
- Budget constraints are shifting business priorities— Companies are deciding how much to invest into security based on budget and available funds as much as based on actual and perceived risk. In some cases this is resulting in a redefinition of the CISO’s scope.
In addition to navigating technology risk and infrastructure sprawl, CISOs will be challenged to maintain support and resources for cybersecurity. This article explores three ways CISOs need to present their “executive-persona” to meet these demands.
1. Integrated & Coordinated Leadership
CISOs are business executives and in that capacity should demonstrate that they simultaneously seek and embrace business connectivity. This means that they take a systems-focus and naturally identify points of connectivity, facilitating integration and communication across departments.
Key Actions
- Focus on Integration Points and Connectivity: Improve operational efficiency and cross-functional collaboration. The CISO may mentally compare the “company” to a “system” and will be able to apply the same principles in securing the system by focusing on building strength in points of connection across the network (aka, across departments).
- Asynchronous Collaboration: Work effectively in diverse groups. Leverage communication norms, and adopt a willingness to explore new channels for asynchronous participation.
- Diplomatic Communication: Modulating engagement models and communication styles enables executives and security leaders to navigate various stakeholders diplomatically. Diplomacy is conveyed through intentionality.
2. Steward & Partner
CISOs should be seen as reliable partners in achieving business objectives. All parts of the business exist to achieve business objectives. And in many cases, those business objectives have a touchpoint with information, technology, or privacy that the CISO is — or should get — involved with. Security Leaders earn trust through demonstrated ownership and partnership.
Key Actions
- Connected Listening: Leveraging the skills of Active Listening, show genuine interest in how other parts of the business operate and contribute to achieving business objectives. Through deeper exploration, CISOs naturally identify opportunities and improvements that reduce systematic risk.
- Active Collaboration: Engage meaningfully with colleagues to offer (and deliver) beneficial support and demonstrate a willingness to help. Collaboration demonstrates that what’s good for one function is good for all functions.
- Leverage the Learning: Partnership doesn’t always mean ‘giving’ it can also mean ‘taking’ and to the extent that Security Teams learn about something else that is being done in another part of the organization that can be leveraged toward security’s objective, partnership is expanded.
3. Operational Excellence
CISOs who analyze Key Performance Indicators across the organization are expected to be achieving consistency and efficiency across their managed functions. They understand that where there is performance excellence, there is reduced risk. And they must continue to be an exemplar of this principle. Specifically, CISOs need to prioritize excellence in the operations that they oversee, prioritizing speed, span, and resource efficiency.
Key Actions
- Exploit Shortcuts: As innovation continues to meaningfully disrupt, CISOs should seek to apply these benefits (responsibly) to deliver operational improvement. Do this for current operations to make them better, faster, and cheaper.
- Performance Metrics: Metrics create objectivity in the operation. And provide a shared language to review priorities and demonstrate progress. Expand performance metrics that strive for better resource management and cost-efficiency. Continue to deliver operational standards, carefully balancing both effectiveness and efficiency. Regularly demonstrate the value of connecting the organizational ‘system’ by demonstrating their relationship to specific business outcomes.
Conclusion
CISOs ARE already proficient at continuously tuning to meet the evolving threat environment. However, to continue to thrive, they must also demonstrate differentiated executive acumen. The next class of CISOs will be those who are distinguished as knowledgeable, collaborative, and operationally excellent. Their earned trust secures their place as essential leaders in their organizations.
