Stop playing with the CISO role. Fix cybersecurity leadership
Brief
We have spent years telling chief information security officers (CISOs) that they need to become better aligned with the business. They need to understand strategy. They need to speak the language of the board. They need to build relationships with business leaders. They need to translate cyber risk into business risk.
I increasingly believe that we are asking the CISO to solve a problem that the role was never designed to solve.
Business alignment is not primarily a communication problem. It is a leadership and organizational design problem.
And if we are serious about fixing it, we should stop trying to turn every CISO into a chief everything officer.
The CISO has become too many things
The modern CISO is expected to be a technologist, strategist, risk executive, regulator-facing leader, board adviser, crisis manager, transformation executive and business partner.