How to Organize Your Cybersecurity Program

CISOs face a cyber risk deluge that is growing at an exponential rate, not only in volume, but in complexity and scope. Cybersecurity staff can’t possibly review (or even identify) each one, but loss of control and visibility could lead to unacceptable risk.

Meanwhile, CEOs and business executives are moving tech work directly into business functions, and an increasing number of employees perform technology work that involves customizing, building or acquiring technology solutions. The volume and complexity of the risk decisions made at the edge of the enterprise now outweigh those made by central IT and cybersecurity groups.

The “centralize to decentralize” trend represents a new approach to cybersecurity governance. Now, decision centralization reflects a more informed — and scalable — approach emphasizing a flexible, centralized policy while supporting local decision making. Control standards are created locally, and local decision-making supports a centrally governed policy.

To make this work, build steering committees or governance, risk and compliance teams to create the policies and processes that empower local risk decision owners to make the right choices. If you’re going to make them accountable, make it easy for them to do what you would do.

Trading waterfall for agile is key to scalable cyber judgment. Most cyber-risk decisions and implementations are now made at the edge by product teams or business units using agile processes — not centrally controlled, stage-gated waterfall processes. Superficial changes won’t cut it; cybersecurity programs must fundamentally change to support new operating models:

• Embed new roles within local, dispersed teams (business information security officers, local information security officers, security champions).

• Match new ways of working with new processes (DevSecOps, cloud-first models).

• Build scalable processes that selectively escalate conflicts, excess residual risks and exception requests for hands-on support at the speed the business needs.

When it comes to policy, less is more. CISOs are consolidating or reducing — not expanding — policies to be more user friendly. By collaborating with end users on policy, you give risk and data owners control and flexibility to apply standards and implement solutions that work best for them. In short, define the what centrally, and solve the how locally.

An invitation into the C-suite means you can initiate more change and take fewer marching orders. But first you may have to shift your perspective from technology manager to business enabler who can successfully influence risk decision making. To demonstrate credibility, pull back from tactical and operational meetings in favor of more strategic executive engagements.

To make your voice known in the C-suite:

• Offload tactical and operational responsibilities and up your executive engagement. Consider delegating administrative operational functions (e.g., patch management, user administration) to IT teams and user awareness training to the HR training department.

• Broaden your horizons by understanding enterprise risk and business metrics. You can’t influence decisions unless you know how best to present your case. Before meeting with fellow executives, learn about their investments and financial and functional challenges. Learn about their priorities by analyzing material produced by the company and specific departments (annual reports, mission statements). Identify at least one metric that aligns with cybersecurity’s strategic objectives to draw a correlation between the risk, the metric and the actions cybersecurity can take to impact other leaders’ metrics.