WEEK 1

Question 1

What is the role of the CISO?

Answer 1

• Security Policy
• Business Enablement
• Compliance
• Protect Information Assets -
• Protect Corporate Secrets

Question 2

Challenges of the CISO

Answer 2

• Budget
• Value Definition
• Control of Resources
• Technical Nature of Position
• Interact with C Suite,Board of Directors

Question 3

Criteria for deciding where to place the CISO

Answer 3

• OrganizationalMaturity
• BusinessDomain
• SkillAlignment

Question 4

Criteria:

Organizational Maturity

Answer 4

• How experienced is the organization in dealing with the types of risk that threaten lines of business?
• Does it build operational resilience to disasters, disruptions, have contingency plans to recover?
• Does it practice responding?

Question 5

Criteria: Business Domain

Answer 5

• Nature of external environment
• Highly regulated?
• Market segment
• Security?
• Operational threats?
• Highly technical?

Question 6

Criteria:

Skill Alignment

Answer 6

• Info Security skillsets relative to rest of organization
• Where does risk management responsibility lie?
• Appropriate balance between technical and business acumen

Question 7

Less Mature organizations require more effort and focus by CISO
WHO DO THEY REPOT TO?

Answer 7

Prefer CISO reports to COO as extension of Operational Arm of organization

Question 8

More mature organizations can rely on embedded personnel and resources more often
WHO DOES THE CISO REPROT TO?

Answer 8

CISO reporting to CIO or CFO is more common here (they own the risk), though less effective in ability to force change

Question 9

Three factors THAT influence BUSINESS criterion ?

Answer 9

• Regulatory Environment
• Threat Environment
• Technical Environment

Question 10

What is the threat to your organization?

Answer 10

1. Do you have defined threat vectors?
2. Is your organization political/activist in nature?
3. Do you store/process valuable data?

report to CEO/COO for high threat environments

Question 11

How is the CISO role similar to the CTO or CIO?

Answer 11

• Need to centralize technology management
• Need to improve efficiency and efficacy
• Manage risk of complexity

Question 12

How is the CISO role different from the CTO or CIO?

Answer 12

• As a risk manager, the CISO requires significant business acumen
• Organizational efforts may require influence beyond technology department
• Bring order from chaos across all functional groups
• Must be authorized to initiate/direct emergency actions to respond to security events (especially in high compliance environments)

Question 13

Three models for a CISO

Answer 13

1. Technical IT-Focused CISO(traditional)
   • CISO report to IT (CIO or CTO)
   • Views security from Technical perspective
2. Empowered CISO (growing approach)
   • CISO report to CEO or CFO
   • Views cybersecurity in broader, risk-focused terms
3. Non-CISO CISO (new security role emerging)
   • designated security officer
   • regulatory and/or industry requirements

Question 14

CISO provides guidance and expertise on ?

Answer 14

• Cybersecurity practices, procedures, metrics
• Data and asset classification
• Vigilance and monitoring of cybersecurity activities and trends
• Oversight of auditing and governance practices
• Incident response
• Security policy design
• Security services implementation
• Security training
• Holistic Risk Management and Assessment

Question 15

Role as CISO : Responsibility?

Answer 15

• protect organizations assets
• Data
• Networks
• Applications • People
• Provide key security services
• Not interfere with ability to conduct business

Question 16

Do you have the authority you need?

Answer 16

• Do I have the authority to act in an emergency?
• Do I have the authority to manage the cybersecurity suite?
• Do I control my budget?
• Do I select devices/applications used?
• Do I have authority to change and create policy?
• Am I a member of the IT Leadership Team?
• Am I allowed to present cybersecurity issues directly to executive management?