How do you manage expectations among your executive leadership without negatively impacting perceptions of both the security function’s effectiveness and your own effectiveness as the CISO?
Sort By:
Oldest
Director of IT4 months ago
Utilize Data and Facts. Financial implications of an undetected breach, vs cost of detection and/ or prevention. Provide data that shows which is the right ROI for the company, and base solutions on the level of risk the company is willing to take. Infrastructure and APP SLAs are not 100%, why should the expectation be 100% that your company would not be breached. As a CISO, work with your peers to determine which systems and data are critical and add extra layers of protection as finances and time permits.CISO in Government4 months ago
I try to involve my CIO as much as I can about the challenges as well as our wins. In my experience, the engagement works better than reports and statistics. But each organization is different. I know some colleagues have to deal with executives that only look at cyber as a money pit with no tangible ROIs. In those unfortunate instances using data to show the level of risk is the only option, because ultimately it’s the executive leadership who has to decide how much risk appetite the organization has.