Table Of ContentThe Business-Minded K
I
S
S
C I S O I
N
G
E
R
How to Organize, Evangelize, and Operate an The Business-Minded
Enterprise-wide IT Risk Management Program
Information technology (IT) risk and information security management are top of mind
for corporate boards and senior business leaders. Continued intensity of cyber terror-
ism attacks, regulatory and compliance requirements, and customer privacy concerns C I S O
are driving the need for a business-minded chief information security offi cer (CISO) to
lead organizational eff orts to protect critical infrastructure and sensitive data.
A CISO must be able to both develop a practical program aligned with overall business
goals and objectives and evangelize this plan with key stakeholders across the organiza-
tion. The modern CISO cannot sit in a bunker somewhere in the IT operations center and
expect to achieve buy in and support for the activities required to operate a program. T
h
e How to Organize, Evangelize, and
This book describes the thought process and specifi c activities a leader should consider B
as they interview for the IT risk/information security leader role, what they should do u
within their fi rst 90 days, and how to organize, evangelize, and operate the program sin Operate an Enterprise-wide IT
e
once they are into the job. It provides practical, tested strategies for designing your s
s Risk Management Program
program and guidance to help you be successful long term. It is chock full of examples, -
M
case studies, and diagrams right out of real corporate in- in
formation security programs. The Business-Minded Chief d
e
Information Security Offi cer is a handbook for success as d
you begin this important position within any company. C
Bryan Kissinger is a seasoned IT and security profes- IS
O
sional with over 20 years of experience in designing and
implementing practical IT risk and information security so-
lutions that drive business value. Prior to Trace3, he was
the vice president and chief information security offi cer
at a large integrated health system. He is known for his
ability to rapidly mature IT risk and information security
programs and quickly deliver on the implementation of
emerging technologies to solve complex business issues.
He has served as the information security leader and or
CISO at multiple large health care organizations.
Business Law and Corporate Risk Management
John Wood, Editor Bryan C. Kissinger, PhD
ISBN: 978-1-95152-750-1
The Business-Minded
Chief Information
Security Officer
The Business-Minded
Chief Information
Security Officer
How to Organize, Evangelize, and
Operate an Enterprise-wide IT
Risk Management Program
Bryan C. Kissinger
The Business-Minded Chief Information Security Officer: How to Organize,
Evangelize, and Operate an Enterprise-wide IT Risk Management Program
Copyright © Business Expert Press, LLC, 2020.
Cover image licensed by Ingram Image, StockPhotoSecrets.com
All rights reserved. No part of this publication may be reproduced,
stored in a retrieval system, or transmitted in any form or by any
means—electronic, mechanical, photocopy, recording, or any other
except for brief quotations, not to exceed 400 words, without the prior
permission of the publisher.
As part of the Business Law Collection, this book discusses general princi-
ples of law for the benefit of the public through education only. This book
does not undertake to give individual legal advice. Nothing in this book
should be interpreted as creating an attorney-client relationship with the
author(s). The discussions of legal frameworks and legal issues is not in-
tended to persuade readers to adopt general solutions to general problems,
but rather simply to inform readers about the issues. Readers should not
rely on the contents herein as a substitute for legal counsel. For specific
advice about legal issues facing you, consult with a licensed attorney.
First published in 2020 by
Business Expert Press, LLC
222 East 46th Street, New York, NY 10017
www.businessexpertpress.com
ISBN-13: 978-1-95152-750-1 (paperback)
ISBN-13: 978-1-95152-751-8 (e-book)
Business Expert Press Business Law and Corporate Risk
Management Collection
Collection ISSN: 2333-6722 (print)
Collection ISSN: 2333-6730 (electronic)
Cover and interior design by Exeter Premedia Services Private Ltd.,
Chennai, India
First edition: 2020
10 9 8 7 6 5 4 3 2 1
Printed in the United States of America.
Abstract
Information technology (IT) risk and information security management
are top of mind for corporate boards and senior business leaders. Con-
tinued intensity of cyber terrorism attacks, regulatory and compliance
requirements, and customer privacy concerns are driving the need for a
business-minded chief information security officer (CISO) to lead orga-
nizational efforts to protect critical infrastructure and sensitive data.
While most CISOs report administratively to the chief information
officer (CIO), there is a growing realization that this key leadership role
requires an individual with both strong technical experience and business
acumen. A CISO must be able to both develop a practical program aligned
with overall business goals and objectives and evangelize this plan with
key stakeholders across the organization. The modern CISO cannot sit
in a bunker somewhere in the IT operations center and expect to achieve
buy-in and support for the activities required to operate a program.
This book describes the thought process and specific activities a leader
should consider as they interview for the IT risk/information security
leader role, what they should do within their first 90 days, and how to
organize, evangelize, and operate the program once they are into the
job. It provides practical, tested strategies for designing your program
and guidance to help you be successful long term. It is chock full of exam-
ples, case studies, and diagrams right out of real corporate information
security programs. The Business-Minded Chief Information Security Officer
is a handbook for success as you begin this important position within
any company.
Keywords
information security; cyber security; information risk; CISO; chief
information security officer; business-minded; IT; maturity
Contents
Preface ..................................................................................................ix
Acknowledgments ...................................................................................xi
Chapter 1 Before You Take the Job ....................................................1
Chapter 2 First 90 Days on the Job .................................................11
Chapter 3 Organize Your Program ..................................................39
Chapter 4 Evangelize Your Program ................................................83
Chapter 5 Operate Your Program ....................................................89
About the Author ................................................................................123
Index .................................................................................................125
Preface
What Does “Business-Minded” Mean?
You might find it an odd title for a book or a bit of an oxymoron to say
business-minded chief information security officer (CISO). The truth is
IT risk and information security professionals have hidden behind their
Certified Information Systems Security Professional (CISSP) certifica-
tions and technical jargon for far too long. I recently came across a quote
but do not recall who said it. It read, “You can’t just rearchitect IT; you
have to rearchitect the business.” I found this statement impactful and
applicable to this publication because many IT professionals think the
world revolves around them.
I believe the gap between information security program funding
and support has been largely created by information security profession-
als failing to convey their needs and goals in business terms that senior
organizational leaders can understand. Simply put, the business-minded
CISO thinks the way the chief executive officer (CEO), chief financial
officer (CFO), and board members think; that is, how best can company
resources be invested to further the mission, vision, and values of the
organization itself?
This concise book will take you through the process of becoming
and operating like a business-minded CISO so you can achieve your
organizational goals and objectives with the full support of your senior
management team and oversight bodies. Let’s start with investigating the
job prospect.
