You did everything you could to land the CISO role. You built your network, kept your training fresh, logged the hours in other infosec roles. You are ready to rock.
Boards and business executives will tell you the same thing: expectations of a new CISO are high. Senior management expects you to have one eye on the day-to-day security posture and another on the booming market for new tools and strategies. Build and maintain strong relationships with managers and stakeholders. Create meaningful management reporting, fight for funding, manage a budget, stay on top of new laws and regulations, build the right team. Plenty to do.
Business knowledge before technical knowledge
Technical know-how is critical but it does not matter if you do not understand the industry you are in or the goals of your own organisation. For CISOs, understanding business process, putting security into a business context, and knowing the external drivers in your industry is as important as knowing how to manage a pen test.
Relationships, relationships, relationships
CISOs are one of the most important roles for stakeholder engagement. Developing and maintaining synergetic relationships inside and outside the parameters of your company is the key to your future success. Strong relationships improve your ability to get funding and drive the changes to security policies that need to happen.
The spotlight shines bright
Many newer CISOs are overwhelmed by how much time they spend on management reports and board presentations. Boards focus on risk profile, threats, vulnerabilities and the effectiveness of controls rather than wishful cyber thinking. Be ready to present, often and with clear data. This is time-consuming work that CISOs are not always accustomed to.
Think ahead
Do not just think about the breaches at hand. Be ready to adapt to the unknown threats coming your way. Executives expect their CISO to be a business strategist as well as a security professional. In a world where disruptive technologies turn business as usual upside down, the successful CISO puts time and energy into the future as well as the present.
And the present
You need to be able to find and patch vulnerabilities cleanly. Executives want patches applied quickly with the resources they have given you. Boards and executives want execution and leadership.
Originally published 4 April 2017. Migrated to the new IRC site in 2026.