Hire or Develop a World-Class CISO

Find a strategic and security-focused champion for your business.

Analyst Perspective

Create a plan to become the security leader of tomorrow

The days are gone when the security leader can stay at a desk and watch the perimeter. The rapidly increasing sophistication of technology, and of attackers, has changed the landscape so that a successful information security program must be elastic, nimble, and tailored to the organization’s specific needs.

The Chief Information Security Officer (CISO) is tasked with leading this modern security program, and this individual must truly be a Chief Officer, with a finger on the pulses of the business and security processes at the same time. The modern, strategic CISO must be a master of all trades.

A world-class CISO is a business enabler who finds creative ways for the business to take on innovative processes that provide a competitive advantage and, most importantly, to do so securely.

Cameron Smith
Research Lead, Security & Privacy
Info-Tech Research Group

Executive Summary

Info-Tech Insight
The new security leader must be strategic, striking a balance between being tactical and taking a proactive security stance. They must incorporate security into business practices from day one and enable secure adoption of new technologies and business practices.

Your challenge

This Info-Tech blueprint will help you hire and develop a strategic CISO

• Security without strategy is a hacker’s paradise.
• The outdated model of information security is tactical, where security acts as a watchdog and responds.
• The new security leader must be strategic, striking a balance between being tactical and taking a proactive security stance. They must incorporate security into business practices from day one and enable secure adoption of new technologies and business practices.

Around one in five organizations don’t have an individual with the sole responsibility for security¹

¹ Navisite

Info-Tech Insight
Assigning security responsibilities to departments other than security can lead to conflicts of interest.

Common obstacles

It can be difficult to find the right CISO for your organization

• The smaller the organization, the less likely it will have a CISO or equivalent position.
• Because there is a shortage of qualified candidates, qualified CISOs can demand high salaries and many CISO positions will go unfilled.
• It is easier for larger companies to attract top CISO talent, as they generally have more resources available.

Source: Navisite

Only 36% of small businesses have a CISO (or equivalent position).

48% of mid-sized businesses have a CISO.

90% of large organizations have a CISO.

Source: Navisite

Strategic versus tactical

CISOs should provide leadership based on a strategic vision ¹

¹ Journal of Computer Science and Information Technology

Info-Tech has identified three key behaviors of the world-class CISO

To determine what is required from tomorrow’s security leader, Info-Tech examined the core behaviors that make a world-class CISO. These are the three areas that a CISO engages with and excels in.

Later in this blueprint, we will review the competencies and skills that are required for your CISO to perform these behaviors at a high level.

Align

Aligning security enablement with business requirements

Enable

Enabling a culture of risk management

Manage

Managing talent and change

Info-Tech Insight
Through these three overarching behaviors, you can enable a security culture that is aligned to the business and make security elastic, flexible, and nimble to maintain the business processes.

Info-Tech’s approach

Info-Tech’s methodology to Develop or Hire a World-Class CISO

	1. Launch	2. Assess	3. Plan	4. Execute
Phase Steps	Understand the core competencies Measure security and business satisfaction and alignment	Assess stakeholder relationships Assess core competencies	Identify resources to address your CISO’s competency gaps Plan an approach to improve stakeholder relationships	Decide next actions and support your CISO moving forward Regularly reassess to measure development and progress
Phase Outcomes	At the end of this phase, you will have: Determined the current gaps in satisfaction and business alignment for your IT security program. Identified the desired qualities in a security leader, specific to your current organizational needs.	At the end of this phase, you will have: Used the core competencies to help identify the ideal candidate. Identified areas for development in your new or existing CISO. Determined stakeholder relationships to cultivate.	At the end of this phase, you will have: Created a high-level plan to address any deficiencies. Improved stakeholder relations.	At the end of this phase, you will have: Created an action-based development plan, including relevant metrics, due dates, and identified stakeholders. This plan is the beginning, not the end. Continually reassessing your organizational needs and revisiting this blueprint’s method will ensure ongoing development.

Blueprint deliverables

Each step of this blueprint is accompanied by supporting deliverables to help you accomplish your goals:

CISO Core Competency Evaluation Tool

Assess the competency levels of a current or prospective CISO and identify areas for improvement.

Stakeholder Power Map Template

Visualize the importance of various stakeholders and their concerns.

Stakeholder Management Strategy Template

Document a plan to manage stakeholders and track actions.

Key deliverable:

CISO Development Plan Template

The CISO Development Plan Template is used to map specific activities and time frames for competency development to address gaps and achieve your goal.

Strategic competencies will benefit the organization and the CISO

Career development should not be seen as an individual effort. By understanding the personal core competencies that Info-Tech has identified, the individual wins by developing relevant new skills and the organization wins because the CISO provides increased value.

Measured value of a world-class CISO

Organizations with a CISO saw an average of $145,000 less in data breach costs.¹

However, we aren’t talking about hiring just any CISO. This blueprint seeks to develop your CISO’s competencies and reach a new level of effectiveness.

Organizations invest a median of around $375,000 annually in their CISO.² The CISO would have to be only 4% more effective to represent $15,000 more value from this position. This would offset the cost of an Info-Tech workshop, and this conservative estimate pales in comparison to the tangible and intangible savings as shown below.

Your specific benefits will depend on many factors, but the value of protecting your reputation, adopting new and secure revenue opportunities, and preventing breaches cannot be overstated. There is a reason that investment in information security is on the rise: Organizations are realizing that the payoff is immense and the effort is worthwhile.

¹ IBM Security
² Heidrick & Struggles International, Inc.

Case Study

In the middle of difficulty lies opportunity

SOURCE
Kyle Kennedy
CISO, CyberSN.com

Guided Implementation

What does a typical GI on this topic look like?

A Guided Implementation (GI) is a series of calls with an Info-Tech analyst to help implement our best practices in your organization.

A typical GI is 6 to 10 calls over the course of 3 to 6 months.

Phase 1

Launch

Phase 1
1.1 Understand Core Competencies
1.2 Measure Security and Business Satisfaction and Alignment

Phase 2
2.1 Assess Stakeholder Relationships
2.2 Assess the Core Competencies

Phase 3
3.1 Identify Resources to Address Competency Gaps
3.2 Plan Approach to Improve Stakeholder Relationships

Phase 4
4.1 Decide Next Actions and Support Your CISO Moving Forward
4.2 Regularly Reassess to Measure Development and Progress

This phase will walk you through the following activities:

• Review and understand the core competencies of a world-class CISO.
• Launch your diagnostic survey.
• Evaluate current business satisfaction with IT security.
• Determine the competencies that are valuable to your IT security program’s needs.

Hire or Develop a World-Class CISO

Case study

Mark Lester
InfoSec Manager, SC Ports Authority

An organization hires a new Information Security Manager into a static and well-established IT department.

Situation: The organization acknowledges the need for improved information security, but there is no framework for the Security Manager to make successful changes.

Follow this case study throughout the deck to see this organization’s results

Step 1.1

Understand the Core Competencies of a World-Class CISO

Activities

Review core competencies the security leader must develop to become a strategic business partner

This step involves the following participants:

• CEO or other executive seeking to hire/develop a CISO

or

• Current CISO seeking to upgrade capabilities

Outcomes of this step
Analysis and understanding of the eight strategic CISO competencies required to become a business partner

Launch

Core competencies

Info-Tech has identified eight core competencies affecting the CISO’s progression to becoming a strategic business partner.

1.1 Understand the core competencies a CISO must focus on to become a strategic business partner

< 1 hour

Over the next few slides, review each world-class CISO core competency. In Step 1.2, you will determine which competencies are a priority for your organization.

1.1 Understand the core competencies (continued)

1.1 Understand the core competencies (continued)

1.1 Understand the core competencies (continued)

Step 1.2

Evaluate satisfaction and alignment between the business and IT security

Activities

• Conduct the Information Security Business Satisfaction and Alignment diagnostic
• Use your results as input into the CISO Core Competency Evaluation Tool

This step involves the following participants:

• CEO or other executive seeking to hire/develop a CISO

or

• Current CISO seeking to upgrade capabilities

Outcomes of this step
Determine current gaps in satisfaction and alignment between information security and your organization.

If seeking to hire/develop a CISO: Your diagnostic results will help develop a profile of the ideal CISO candidate to use as a hiring and interview guide.

If developing a current CISO, use your diagnostic results to identify existing competency gaps and target them for improvement.

For the CISO seeking to upgrade capabilities: Use the core competencies guide to self-assess and identify competencies that require improvement.

Launch

1.2 Get started by conducting Info-Tech’s Information Security Business Satisfaction and Alignment diagnostic

The primary goal of IT security is to protect the organization from threats. This does not simply mean bolting everything down, but it means enabling business processes securely. To do this effectively requires alignment between IT security and the overall business.

• Once you have completed the diagnostic, call Info-Tech to review your results with one of our analysts.
• The results from this assessment will provide insights to inform your entries in the CISO Core Competency Evaluation Tool.

Call an analyst to review your results and provide you with recommendations.

Info-Tech Insight
Focus on the high-priority competencies for your organization. You may find a candidate with perfect 10s across the board, but a more pragmatic strategy is to find someone with strengths that align with your needs. If there are other areas of weakness, then target those areas for development.

1.2 Use Info-Tech’s CISO Core Competency Evaluation Tool to understand your organizational needs

After completing the Info-Tech diagnostic, use the CISO Core Competency Evaluation Tool to determine which CISO competencies are a priority for your organization.

• Your diagnostic results will indicate where your information security program is aligned well or poorly with your business.
• For example, the diagnostic may show significant misalignment between information security and executives over the level of external compliance. The CISO behavior that would contribute to solving this is aligning security enablement with business requirements.
  • This misalignment may be due to a misunderstanding by either party. The competencies that will contribute to resolving this are communication, technical knowledge, and business acumen.
  • This mapping method is what will be used to determine which competencies are most important for your needs at the present moment.

Download the CISO Core Competency Evaluation Tool

1.2 Use Info-Tech’s CISO Core Competency Evaluation Tool to understand your organizational needs

After completing the Info-Tech diagnostic, use the CISO Core Competency Evaluation Tool to determine which CISO competencies are a priority for your organization.

1. Starting on Tab 2: CISO Core Competencies, use your understanding of each competency from section 1.1 along with the definitions described in the tool.
   • For each competency, assign a degree of importance using the drop-down menu in the second column from the right.
   • Importance ratings will range from not at all important at the low end to critically important at the high end.
   • Your importance score will be influenced by several factors, including:
     • The current alignment of your information security department.
     • Your organizational security posture.
     • The size and structure of your organization.
     • The existing skills and maturity within your information security department.

Download the CISO Core Competency Evaluation Tool

1.2 Use Info-Tech’s CISO Core Competency Evaluation Tool to understand your organizational needs

After completing the Info-Tech diagnostic, use the CISO Core Competency Evaluation Tool to determine which CISO competencies are a priority for your organization.

2. Still on Tab 2. CISO Core Competencies, you will now assign a current level of effectiveness for each competency.
   • This will range from foundational at a low level of effectiveness up to capable, then inspirational, and at the highest rating, transformational.
   • Again, this rating will be very specific to your organization, depending on your structure and your current employees.
   • Fundamentally, these scores will reflect what you want to improve in the area of information security. This is not an absolute scale, and it will be influenced by what skills you want to support your goals and direction as an organization.

Download the CISO Core Competency Evaluation Tool

Phase 2

Assess

Phase 1
1.1 Understand Core Competencies
1.2 Measure Security and Business Satisfaction and Alignment

Phase 2
2.1 Assess Stakeholder Relationships
2.2 Assess the Core Competencies

Phase 3
3.2 Plan Approach to Improve Stakeholder Relationships

Phase 4
4.1 Decide Next Actions and Support Your CISO Moving Forward
4.2 Regularly Reassess to Measure Development and Progress

This phase will walk you through the following activities:

• Use the CISO Core Competency Evaluation Tool to create and implement an interview guide.
• Assess and analyze the core competencies of your prospective CISOs. Or, if you are a current CISO, use the CISO Core Competency Evaluation Tool as a self-analysis and identify areas for personal development.
• Evaluate the influence, impact, and support of key executive business stakeholders using the CISO Stakeholder Power Map Template.

Hire or Develop a World-Class CISO

Case study

Mark Lester
InfoSec Manager, SC Ports Authority

The new Security Manager engages with employees to learn the culture.

Outcome: Understand what is important to individuals in order to create effective collaboration. People will engage with a project if they can relate it to something they value.

Follow this case study throughout the deck to see this organization’s results

Step 2.1

Identify key stakeholders for the CISO and assess current relationships

Activities

Evaluate the power, impact, and support of key stakeholders

This step involves the following participants:

• CEO or other executive seeking to hire/develop a CISO

or

• Current CISO seeking to upgrade capabilities

Outcomes of this step

• Power map of executive business stakeholders
• Evaluation of each stakeholder in terms of influence, impact, and current level of support

Assess

Identify key stakeholders who own business processes that intersect with security processes

Info-Tech Insight
Most organizations don’t exist for the sole purpose of doing information security. For example, if your organization is in the business of selling pencils, then information security is in business to enable the selling of pencils. All the security in the world is meaningless if it doesn’t enable your primary business processes. The CISO must always remember the fundamental goals of the business.

The above insight has two implications:

1. The CISO needs to understand the key business processes and who owns them, because these are the people they will need to collaborate with. Like any C-level, the CISO should be one of the most knowledgeable people in the organization regarding business processes.
2. Each of these stakeholders stands to win or lose depending on the performance of their process, and they can act to either block or enable your progress.
   • To work effectively with these stakeholders, you must learn what is important to them, and pose your initiatives so that you both benefit.

When people are not receptive to the CISO, it’s usually because the CISO has not been part of the discussion when plans were being made. This is the heart of proactivity.

You need to be involved from the start … from the earliest part of planning.

The job is not to come in late and say “No” ... the job is to be involved early and find creative and intelligent ways to say “Yes.”

The CISO needs to be the enabling security asset that drives business.

– Elliot Lewis, CEO at Keyavi Data

Evaluate the importance of business stakeholders and the support necessary from them

The CISO Stakeholder Power Map Template is meant to provide a visualization of the CISO’s relationships within the organization. This should be a living document that can be updated throughout the year as relationships develop and the structure of an organization changes.

At a glance, this tool should show:

• How influential each stakeholder is within the company.
• How supportive they currently are of the CISO’s initiatives.
• How strongly each person is impacted by IT security activities.

Once this tool has been created, it provides a good reference as the CISO works to develop lagging relationships. It shows the landscape of influence and impact within the organization, which may help to guide the CISO’s strategy in the future.

Download the CISO Stakeholder Power Map Template

Evaluate the importance of business stakeholders and the support necessary from them

1. Identify key stakeholders.
   1. Focus on owners of important business processes.
2. Evaluate and map each stakeholder in terms of:
   1. Influence (up/down)
   2. Support (left/right)
   3. Impact (size of circle)
   4. Involvement (color of circle)
3. Decide whether the level of support from each stakeholder needs to change to facilitate success.

Info-Tech Insight
Some stakeholders must work closely with your incoming CISO. It is worth consideration to include these individuals in the interview process to ensure you will have partners that can work well together. This small piece of involvement early on can save a lot of headache in the future.

Where can you find your desired CISO?

Once you know which competencies are a priority in your new CISO, the next step is to decide where to start looking. This person may already exist in your company.

Ready to start looking for your ideal candidate? You can use Info-Tech’s Chief Information Security Officer job description template.

Use the CISO job description template

Alternatives to hiring a CISO

Small organizations are less able to muster the resources required to find and retain a CISO,

Why would an organization consider a vCISO?

• A vCISO can provide services that are flexible, technical, and strategic and that are based on the specific requirements of the organization.
• They can provide a small organization with program maturation within the organization’s resources.
• They can typically offer depth of experience beyond what a small business could afford if it were to pursue a full-time CISO.

Source: InfoSec Insights by Sectigo Store

Why would an organization not consider a vCISO?

• The vCISO’s attention is divided among their other clients.
• They won’t feel like a member of your organization.
• They won’t have a deep understanding of your systems and processes.

Source: Georgia State University

Step 2.2

Assess CISO candidates and evaluate their current competency

Activities

Assess CISO candidates in terms of desired core competencies

or

Self-assess your personal core competencies

This step involves the following participants:

• CEO or other executive seeking to hire/develop a CISO

or

• Current CISO seeking to upgrade capabilities

and

• Any key stakeholders or collaborators you choose to include in the assessment process

Outcomes of this step

• You have assessed your requirements for a CISO candidate.
• The process of hiring is under way, and you have decided whether to hire a CISO, develop a CISO, or consider a Counselor Seat as another option.

Assess

2.2 Use Info-Tech’s CISO Core Competency Evaluation Tool to assess your CISO candidate

Download the CISO Core Competency Evaluation Tool

Info-Tech Insight
The most important competencies should be your focus. Unless you are lucky enough to find a candidate that is perfect across the board, you will see some areas that are not ideal. Don’t forget the importance you assigned to each competency. If a candidate is ideal in the most critical areas, you may not mind that some development is needed in a less important area.

2.2 Use Info-Tech’s CISO Core Competency Evaluation Tool to evaluate your candidates

After deciding the importance of and requirements for each competency in Phase 1, assess your CISO candidates.

Your first pass on this tool will be to look at internal candidates. This is the develop a CISO option.

1. In the previous phase, you rated the Importance and Current Effectiveness for each competency in Tab 2. CISO Core Competencies. In this step, use Tab 3. Gap Analysis to enter a Minimum Level and a Desired Level for each competency. Keep in mind that it may be unrealistic to expect a candidate to be fully developed in all aspects.
2. Next, enter a rating for your candidate of interest for each of the eight competencies.
3. This scorecard will generate an overall suitability score for the candidate. The color of the output (from red to green) indicates the suitability, and the intensity of the color indicates the importance you assigned to that competency.

Download the CISO Core Competency Evaluation Tool

2.2 Use Info-Tech’s CISO Core Competency Evaluation Tool to evaluate your candidates

• If the internal search does not identify a suitable candidate, you will want to expand your search.
• Repeat the scoring process for external candidates until you find your new CISO.
• You may want to skip your external search altogether and instead contact Info-Tech for more information on our Counselor Seat options.

Download the CISO Core Competency Evaluation Tool

Phase 3

Plan

Phase 1
1.1 Understand Core Competencies
1.2 Measure Security and Business Satisfaction and Alignment

Phase 2
2.1 Assess Stakeholder Relationships
2.2 Assess the Core Competencies

Phase 3
3.1 Identify Resources to Address Competency Gaps
3.2 Plan Approach to Improve Stakeholder Relationships

Phase 4
4.1 Decide Next Actions and Support Your CISO Moving Forward
4.2 Regularly Reassess to Measure Development and Progress

This phase will walk you through the following activities:

• Create a plan to develop your competency gaps.
• Construct and consider your organizational model.
• Create plan to cultivate key stakeholder relationships.

Hire or Develop a World-Class CISO

Case study

Mark Lester
InfoSec Manager, SC Ports Authority

The new Security Manager changes the security culture by understanding what is meaningful to employees.

Outcome: Engage with people on their terms. The CISO must speak the audience’s language and express security terms in a way that is meaningful to the audience.

Follow this case study throughout the deck to see this organization’s results

Step 3.1

Identify resources for your CISO to remediate competency gaps

Activities

Create a plan to remediate competency gaps

This step involves the following participants:

• CEO or other executive seeking to hire/develop a CISO
• The newly hired CISO

or

• Current CISO seeking to upgrade capabilities

Outcomes of this step

• Identification of core competency deficiencies
• A plan to close the gaps

Plan

3.1 Close competency gaps with Info-Tech’s Cybersecurity Workforce Development Training

Resources to close competency gaps

Info-Tech’s Cybersecurity Workforce Training develops critical cybersecurity skills missing within your team and organization. The leadership track provides the same deep coverage of technical knowledge as the analyst track but adds hands-on support and has a focus on strategic business alignment, program management, and governance.

The program builds critical skills through:

• Standardized curriculum with flexible projects tailored to business needs
• Realistic cyber range scenarios
• Ready-to-deploy security deliverables
• Real assurance of skill development

Info-Tech Insight
Investing in a current employee that has the potential to be a world-class CISO may take less time, effort, and money than finding a unicorn.

Learn more on the Cybersecurity Workforce Development webpage

3.1 Identify resources for your CISO to remediate competency gaps

< 2 hours

3.1 Identify resources for your CISO to remediate competency gaps (continued)

< 2 hours

Info-Tech Insight
Surround yourself with great people. Insecure leaders surround themselves with mediocre employees that aren’t perceived as a threat. Great leaders are supported by great teams, but you must choose that great team first.

3.1 Identify resources for your CISO to remediate competency gaps (continued)

< 2 hours

3.1 Identify resources for your CISO to remediate competency gaps (continued)

< 2 hours

3.1 Identify resources for your CISO to remediate competency gaps (continued)

< 2 hours

3.1 Create the CISO’s personal development plan

• Use Info-Tech’s CISO Development Plan Template to document key initiatives that will close previously identified competency gaps.
• The CISO Development Plan Template is used to map specific actions and time frames for competency development, with the goal of addressing competency gaps and helping you become a world-class CISO. This template can be used to document:
  • Core competency gaps
  • Security process gaps
  • Security technology gaps
  • Any other career/development goals
• If you have a coach or mentor, you should share your plan and report progress to that person. Alternatively, call Info-Tech to speak with an executive advisor for support and advice.
  • Toll-Free: 1-888-670-8889

What you will need to complete this exercise

• CISO Core Competency Evaluation Tool results
• Information Security Business Satisfaction and Alignment diagnostic results
• Insights gathered from business stakeholder interviews

Step 3.2

Plan an approach to improve your relationships

Activities

• Review engagement strategies for different stakeholder types
• Create a stakeholder relationship development plan

This step involves the following participants:

• CEO or other executive seeking to hire/develop a CISO
• The newly hired CISO

or

• Current CISO seeking to upgrade capabilities

Outcomes of this step

• Stakeholder relationship strategy deliverable

Plan

Where should the CISO sit?

Where the CISO sits in the organization can have a big impact on the security program.

• Organizations with CISOs in the C-suite have a fewer security incidents.¹
• Organizations with CISOs in the C-suite generally have better IT ability.¹
• An organization whose CISO reports to the CIO risks conflict of interest.¹
• 51% of CISOs believe their effectiveness can be hampered by reporting lines.²
• Only half of CISOs feel like they are in a position to succeed.²

A formalized security organizational structure assigns and defines the roles and responsibilities of different members around security. Use Info-Tech’s blueprint Implement a Security Governance and Management Program to determine the best structure for your organization.

Who the CISO reports to, by percentage of organizations³

Download the Implement a Security Governance and Management Program blueprint

1. Journal of Computer Science and Information
2. Proofpoint
3. Heidrick & Struggles International, Inc

3.2 Make a plan to manage your key stakeholders

Managing stakeholders requires engagement, communication, and relationship management. To effectively collaborate and gain support for your initiatives, you will need to build relationships with your stakeholders. Take some time to review the stakeholder engagement strategies for different stakeholder types.

When building relationships, I find that what people care about most is getting their job done. We need to help them do this in the most secure way possible.

I don’t want to be the “No” guy, I want to enable the business. I want to find to secure options and say, “Here is how we can do this.”

– James Miller, Information Security Director, Xavier University

Download the CISO Stakeholder Management Strategy Template

Key players – Engage

Info-Tech Insight
Listen to your key players. They understand what is important to other business stakeholders, and they can provide valuable insight to guide your future strategy.

Mediators – Satisfy

Info-Tech Insight
Don’t dictate to stakeholders. Make them feel like valued contributors by including them in development and decision making. You don’t have to incorporate all their input, but it is essential that they feel respected and heard.

Noisemakers – Inform

Spectators – Monitor

3.2 Create the CISO’s stakeholder management strategy

Develop a strategy to manage key stakeholders in order to drive your personal development plan initiatives.

• The purpose of the CISO Stakeholder Management Strategy Template is to document the results of the power mapping exercise, create a plan to proactively manage stakeholders, and track the actions taken.
• Use this in concert with Info-Tech’s CISO Stakeholder Power Map Template to help visualize the importance of key stakeholders to your personal development. You will document:
  • Stakeholder role and type.
  • Current relationship with the stakeholder.
  • Level of power/influence and degree of impact.
  • Current and desired level of support.
  • Initiatives that require the stakeholder’s engagement.
  • Actions to be taken – along with the status and results.

What you will need to complete this exercise

• Completed CISO Stakeholder Power Map
• Security Business Satisfaction and Alignment Diagnostic results

Download the CISO Stakeholder Management Strategy Template

Phase 4

Execute

Phase 1
1.1 Understand Core Competencies
1.2 Measure Security and Business Satisfaction and Alignment

Phase 2
2.1 Assess Stakeholder Relationships
2.2 Assess the Core Competencies

Phase 3
3.1 Identify Resources to Address Competency Gaps
3.2 Plan Approach to Improve Stakeholder Relationships

Phase 4
4.1 Decide Next Actions and Support Your CISO Moving Forward
4.2 Regularly Reassess to Measure Development and Progress

This phase will walk you through the following activities:

• Populate the CISO Development Plan Template with appropriate targets and due dates.
• Set review and reassess dates.
• Review due dates with CISO.

Hire or Develop a World-Class CISO

Case study

Mark Lester
InfoSec Manager, SC Ports Authority

The new Security Manager leverages successful cultural change to gain support for new security investments.

Outcome: Integrating with the business on a small level and building on small successes will lead to bigger wins and bigger change.

Step 4.1

Decide next actions and support your CISO moving forward

Activities

• Complete the Info-Tech CISO Development Plan Template
• Create a stakeholder relationship development plan

This step involves the following participants:

• CEO or other executive seeking to hire/develop a CISO
• The newly hired CISO

or

• Current CISO seeking to upgrade capabilities

Outcomes of this step

Next actions for each of your development initiatives

Execute

Establish a set of first actions to set your plan into motion

The CISO Development Plan Template provides a simple but powerful way to focus on what really matters to execute your plan.

• By this point, the CISO is working on the personal competency development while simultaneously overseeing improvements across the security program, managing stakeholders, and seeking new business initiatives to engage with. This can be a lot to juggle effectively.
• Disparate initiatives like these can hinder progress by creating confusion.
• By distilling your plan down to Subject > Action > Outcome, you immediately restore focus and turn your plans into actionable items.
• The outcome is most valuable when it is measurable. This makes progress (or lack of it) very easy to track and assess, so choose a meaningful metric.

Download the CISO Development Plan Template

4.1 Create a CISO development plan to keep all your objectives in one place

Use Info-Tech’s CISO Development Plan Template to create a quick and simple yet powerful tool that you can refer to and update throughout your personal and professional development initiatives. As instructed in the template, you will document the following:

Info-Tech Insight
A good plan doesn’t require anything that is outside of your control. Good measurable outcomes are behavior based rather than state based.
“Increase the budget by 10%” is a bad goal because it is ultimately reliant on someone else and can be derailed by an unsupportive executive. A better goal is “reduce spending by 10%.” This is something more within the CISO’s control and is thus a better performance indicator and a more achievable goal.

4.1 Create a CISO development plan to keep all your objectives in one place

Below you will find sample content to populate your CISO Development Plan Template. Using this template will guide your CISO in achieving the goals identified here.

The template itself is a metric for assessing the development of the CISO. The number of targets achieved by the due date will help to quantify the CISO’s progress.

You may also want to include improvements to the organization’s security program as part of the CISO development plan.

Check out the First 100 Days as CISO blueprint for guidance on bringing improvements to the security program

4.1 Use your action plan to track development progress and inform stakeholders

• As you progress toward your goals, continually update the CISO development plan. It is meant to be a living document.
• The Next Action Required should be updated regularly as you make progress so you can quickly jump in and take meaningful actions without having to reassess your position every time you open the plan. This is a simple but very powerful method.
• To view your initiatives in customizable ways, you can use the drop-down menu on any column header to sort your initiatives (i.e. by due date, completed status, area for development). This allows you to quickly and easily see a variety of perspectives on your progress and enables you to bring upcoming or incomplete projects right to the top.

Step 4.2

Regularly reassess to track development and progress

Activities

Create a calendar event for you and your CISO, including which items you will reassess and when

This step involves the following participants:

• CEO or other executive seeking to hire/develop a CISO
• The newly hired CISO

or

• Current CISO seeking to upgrade capabilities

Outcomes of this step

Scheduled reassessment of the CISO’s competencies

Execute

4.2 Regularly evaluate your CISO’s progress

< 1 day

As previously mentioned, your CISO development plan is meant to be a living document. Your CISO will use this as a companion tool throughout project implementation, but periodically it will be necessary to re-evaluate the entire program to assess your progress and ensure that your actions are still in alignment with personal and organizational goals.

Info-Tech recommends performing the following assessments quarterly or twice yearly with the help of our executive advisors (either over the phone or onsite).

1. Sit down and re-evaluate your CISO core competencies using the CISO Core Competency Evaluation Tool.
2. Analyze your relationships using the CISO Stakeholder Power Map Template.
3. Compare all of these against your previous results to see what areas you have strengthened and decide if you need to focus on a different area now.
4. Consider your CISO Development Plan Template and decide whether you have achieved your desired outcomes. If not, why?
5. Schedule your next reassessment, then create a new plan for the upcoming quarter and get started.

Summary of Accomplishment

Knowledge Gained

• Understanding of the competencies contributing to a successful CISO
• Strategic approach to integrate the CISO into the organization
• View of various CISO functions from a variety of business and executive perspectives, rather than just a security view

Process Optimized

• Hiring of the CISO
• Assessment and development of stakeholder relationships for the CISO
• Broad planning for CISO development

Deliverables Completed

• IT Security Business Satisfaction and Alignment Diagnostic
• CISO Core Competency Evaluation Tool
• CISO Stakeholder Power Map Template
• CISO Stakeholder Management Strategy Template
• CISO Development Plan Template

If you would like additional support, have our analysts guide you through an Info-Tech workshop or Guided Implementation

Contact your account representative for more information

workshop@infotech.com
1-888-670-8889

Related Info-Tech Research

Build an Information Security Strategy
Your security strategy should not be based on trying to blindly follow best practices but on a holistic risk-based assessment that is risk aware and aligns with your business context.

The First 100 Days as CISO
Every CISO needs to follow Info-Tech’s five-step approach to truly succeed in their new position. The meaning and expectations of a CISO role will differ from organization to organization and person to person, but the approach to the new position will be relatively the same.

Implement a Security Governance and Management Program
Business and security goals should be the same. Businesses cannot operate without security, and security's goal is to enable safe business operations.

Research Contributors

• Mark Lester, Information Security Manager, South Carolina State Ports Authority
• Kyle Kennedy, CISO, CyberSN.com
• James Miller, Information Security Director, Xavier University
• Elliot Lewis, Vice President Security & Risk, Info-Tech Research Group
• Andrew Maroun, Enterprise Security Lead, State of California
• Brian Bobo, VP Enterprise Security, Schneider National
• Candy Alexander, GRC Security Consultant, Towerall Inc.
• Chad Fulgham, Chairman, PerCredo
• Ian Parker, Head of Corporate Systems Information Security Risk and Compliance, Fujitsu EMEIA
• Diane Kelly, Information Security Manager, Colorado State Judicial Branch
• Jeffrey Gardiner, CISO, Western University
• Joey LaCour, VP & Chief Security, Colonial Savings
• Karla Thomas, Director IT Global Security, Tower Automotive
• Kevin Warner, Security and Compliance Officer, Bridge Healthcare Providers
• Lisa Davis, CEO, Vicinage
• Luis Brown, Information Security & Compliance Officer, Central New Mexico Community College
• Peter Clay, CISO, Qlik
• Robert Banniza, Senior Director IT Center Security, AMSURG
• Tim Tyndall, Systems Architect, Oregon State

Bibliography

Dicker, William. "An Examination of the Role of vCISO in SMBs: An Information Security Governance Exploration." Dissertation, Georgia State University, May 2, 2021. Accessed 30 Sep. 2022.

Heidrick & Struggles. "2022 Global Chief Information Security Officer (CISO) Survey" Heidrick & Struggles International, Inc. September 6, 2022. Accessed 30 Sep. 2022.

IBM Security. "Cost of a Data Breach Report 2022" IBM. August 1, 2022. Accessed 9 Nov. 2022.

Mehta, Medha. "What Is a vCISO? Are vCISO Services Worth It?" Infosec Insights by Sectigo, June 23, 2021. Accessed Nov 22. 2022.

Milica, Lucia. “Proofpoint 2022 Voice of the CISO Report” Proofpoint. May 2022. Accessed 6 Oct. 2022.

Navisite. "The State of Cybersecurity Leadership and Readiness" Navisite. November 9, 2021. Accessed 9 Nov. 2022.

Shayo, Conrad, and Frank Lin. “An Exploration of the Evolving Reporting Organizational Structure for the Chief Information Security Officer (CISO) Function” Journal of Computer Science and Information Technology, vol. 7, no. 1, June 2019. Accessed 28 Sep. 2022.