Call us now:
Will the role of the CIO be consumed by the CISO? A few years ago one may have said yes, it was a logical move. But not today.
Yes the CISO will understand allot about the IT environment of the company, about its data and the connectivity of systems and through security where opportunities and challenges lie to improve corporate performance. But unlike the CIO, the role of the CISO along with the board is being placed under a regulatory microscope. A microscope that is assessing the legal, compliance and risk management of cybersecurity within organisations, along with civil and criminal penalties.
The CISO role is going through legal and regulatory oversight (SolarWinds, Uber) and likely to be evaluated by company boards, regulators and lawyers for some time to come. As regulations such as the SEC final rule, EU NIS 2, DORA and a slew of other rule focused on corporate governance and corporate risk management work their way through governments.
One suspect that there will be a move to ensure the independence of the CISO and reduce conflicts of interests of security professionals. That arise if they manage a companies IT and its security. One wonders if the role of the CISO should follow that of internal audit (3rd Line), where the role is segregated. More importantly should the CISO role be classified as a control function (See Financial Services)?
Cyber regulation introduces risk management compliance and legal oversight over cybersecurity and the role of the CISO. Raising questions over the professional status of the role of the CISO, as they sit along side their peers such as lawyers, accountants, engineers and auditors? Keeping the role of the CISO independent, maybe a more appropriate option.
@Thaddeus Dziekanowski Brian D. McCarthy
Veritas GRC
#cybersecurity #cyberriskmanagement #ciso #cyberregulation
View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A7168944332098519040