Skip to content

Term of the Week: CISO

What is it?

Chief Information Security Officer. The most senior individual responsible for protecting an organization’s information assets.

Why is it important?

The CISO has overall responsibility for the information security program for an organization. The CISO works closely with executive management and business stakeholders to protect information assets.

Why does a business professional need to know this?

The CISO is charged with providing an efficient and effective security program, which includes retaining skilled cybersecurity specialists and documenting and automating cybersecurity processes and procedures. Business professionals should know and work with the CISO and his or her team to build a secure environment.

The CISO works with management stakeholders to allocate an appropriate budget for cybersecurity; acquire the necessary personnel, tools, and resources; and create and execute plans for improving cybersecurity maturity. The CISO is accountable for identifying and communicating relevant information security threats, balancing the competing needs of business operations and information security, and leading the cybersecurity team as it works towards these objective. Cybersecurity maturity occurs over time as more investments are made, processes are refined, and tools are integrated into a long-term plan.

The CISO is responsible for ensuring that appropriate policies, standards, procedures, and guidelines exist within the organization to reduce overall risk and comply with regulatory and privacy requirements. Administrative, technical, and operational controls collectively fulfill this objective.

For example, a cybersecurity analyst may be assigned to implement controls that aggregate and correlate security events to detect malicious behavior against critical information assets. The CISO is responsible for warning stakeholders about the risk of potential malicious events, putting monitoring procedures in place, ensuring that oversight and secondary quality controls are present, and creating a monitoring strategy that reflects the organizations tolerance for risk.


About Todd Fitzgerald

Photo of Todd Fitzgerald

Todd Fitzgerald has built and led Fortune 500/large-company information security programs for 20 years. He was named 2016–17 Chicago CISO of the Year, ranked Top 50 Information Security Executive, authored 4 books - CISO COMPASS: Navigating Cybersecurity Leadership Challenges with Insights from Pioneers (2019), Information Security Governance Simplified: From the Boardroom to the Keyboard, E-C Council Certified Chief Information Security Officer Body of Knowledge, and the ground-breaking CISO Leadership: Essential Principles for Success, and he has contributed to a dozen others. Todd held senior leadership positions at Northern Trust, Grant Thornton International, Ltd, ManpowerGroup, WellPoint (Anthem) Blue Cross Blue Shield/ National Government Services, Zeneca/Syngenta, IMS Health and American Airlines.

Term: CISO


Twitter: @securityfitz


On Amazon:

Leave a Reply