Becoming a company's Chief Information Security Officer (CISO) is a big responsibility. With a range of information security issues to tackle and business objectives to align with, the task of making an impact in the first 90 days might seem daunting. However, by taking a clear and structured approach to the role, it is possible to achieve a strong set of security results in the initial period and lay the foundation for future success.
Assessing your Information Security Posture and Resources
The first step for any new CISO is understanding the company's current security posture. To get an insight into existing security tools and processes, it is important to spend time talking with cybersecurity and IT teams, review existing policies and procedures and conduct a risk assessment. Once the current security posture is understood, it's then necessary to create a clear vision strategy that meets the needs of the business.
Assessing the available resources is also essential in the first 90 days as a CISO. Questions to ask include: Is there an adequate budget to implement the necessary security initiatives? Does the organization have the staff it needs to bring the security strategy to life? Answering these questions will provide a baseline understanding of the resources available and allow a CISO to plan accordingly.
Creating a Clear Vision
A successful Chief Information Security Officer (CISO) will develop a vision of what they want to accomplish during their tenure. A vision should be based on the organization's business goals, including:
- Becoming more agile and nimble
- Optimising operational efficiency
- Enhancing security controls
The goal is to align the organization's overall cybersecurity vision with the business objectives and risk appetite. This will help the CISO understand where their organization is currently, where it would like to be and what strategies need to be implemented to get there.
Developing Strategies
Once a CISO has established a vision for their organization's cybersecurity program, they can start developing strategies for achieving their goals. These strategies must be tailored to the organization's specific needs and align with the business objectives outlined in their vision.