What Is the CISO’s Role in Risk Management?

Click here to get this post in PDF

If you are in a highly-structured organization, then you’ll opine that the Chief Information Security Officer (CISO) plays a critical role in risk management. They work to ensure that all the organization’s data is safe and evaluates the risk that third parties pose to the business environment. This expansive role and the rise in cases of cybercrime calls for more concentration of CISO on their jobs.

What Role does CISO play in Risk Management?

In any organization, CISO is ranked as senior management due to the sensitive information they handle. Their goal is to protect your company’s assets and technology from malicious people. As cyber threats increase, your CISO is expected to devise clever ways of mitigating these dangers and uphold the confidentiality of private data in the institution.

As times change, the role of CISO has shifted from the traditional fixing of security controls (firewalls and data encryption) to a much wider scope. Today, they have to deal with the rising need for vendors to ensure successful operations of the company without compromising its security.

What are the Benefits of CISO Engaging in Risk Management?

Having a CISO in your organization will give you immense benefits that will boost your security systems and facilitate easier compliance processes. Various standards and regulations demand that your systems be updated regularly to respond to new digital threats as they arise. Some of these regulations are:

• ISO 27001: You’ll need an Information Security Management System (ISMS) to comply
• Health Insurance Portability and Accountability Act (HIPAA). These regulations require an administrative system that involves appropriate security measures and reduced risks.

While the two regulations need a risk management approach to the security of the organization’s information, they are not specific that only a CISO can administer it. However, some regulations are specific that any organization should a CISO. Such regulations include:

• NIST 800-53. This regulation explains the duties of CISO in an organization. They state explicitly that the security officers should establish a security management system within NISTs tiered security risk management approach for a guaranteed Continuous Diagnostics and Mitigation Program (CDM)

As such, you may need to have a CISO in the administration system of your company to mitigate cybersecurity risks.

What are the Primary Functions of CISO?

Any CISO should review the risks that the organization’s current IT system is exposed to using the following strategies:

1. Critical Systems and Data. Due to the high use of digital data in an organization, the CISO should determine the information assets, systems, and networks that will support the digital changes while maintaining successful business operations.
2. External Threat Management. Malicious actions require strategic security protocols to update the systems and software thus eliminating the threat.
3. Internal Threat Management. The establishment of authorization and multi-factor authentications as internal controls is crucial in protecting the system and networks access.
4. Assessing the Vendors Risk. The increase in using of vendors demands for reliable systems to manage the collections, transfer, and storage of the data. They should be enough security controls to protect the privacy of the data.
5. Continuous Monitoring. Your organization should have an automatic monitoring system for internal and external controls to enhance identification system as well as network vulnerabilities.
6. Business Continuity and Incident response. The rise in the number and sophistication of breach cases need CISOs to develop the right strategies that manage the impacts of such risks.

Organizations should include a security risk management system in their vision, strategy, and work plan for smooth operations.

Who should the CISO Report To?

Modern management practices make it necessary for CISOs to report to the Chief Executive Officer (CEO) in an organization instead of the Chief Information Officer (CIO). The CIO procures and manages IT assets which may lead to a conflict with the CISO thus making it wise to segregate the activities. As such, the CISO and IT department should collaborate with the CIO but not reporting directly to them.

When the CISO should Report to The Board of Directors

Corporate governance is part of the Board’s responsibilities to align with the requirements of many standards and regulations including Internet Security Alliance (ISA), Institute of Internal Auditors (IIA), National Association of Corporate Directors (NACD), and Information Systems Audit and Control Association (ISACA). Incorporating the IT security system with the Board of Directors allows extensive consultation for developing risk management strategies. Failure for the CISO to communicate the security strategies or an inactivity of the Board may lead to penalties or jail term from regulations such as the Sarbanes-Oxley Act of 2002.

About the Author

Ken Lynch is an enterprise software startup veteran, who has always been fascinated about what drives workers to work and how to make work more engaging. Ken founded Reciprocity to pursue just that. He has propelled Reciprocity’s success with this mission-based goal of engaging employees with the governance, risk, and compliance goals of their company in order to create more socially minded corporate citizens. Ken earned his BS in Computer Science and Electrical Engineering from MIT.  Learn more at ReciprocityLabs.com.