Fractional Cybersecurity Leadership

Although not every company requires a full-time CISO, every company has to protect its sensitive data and comply with applicable regulations. Due to a lack of security expertise, a small-midsize  company may have greater security and compliance exposure than a large enterprise.

As more Companies are realizing the need for a Chief Information Security Officer (CISO), the demand has exceeded the supply. For highly-regulated industries it is even more important to have a subject matter expert  responsible for oversight, leading security decisions and educating the management team on risks. 

The considerations for whether a CISO has cybersecurity expertise include: 

1. Whether the CISO has prior work experience in cybersecurity, including, for  example, prior experience as an information security officer, security policy analyst, security auditor, security architect or engineer, security operations or incident response manager, or business continuity planner.

2. Whether the CISO has obtained industry certifications, military training or a degree in cybersecurity.  A CISO should at a minimum be a current CISSP (Certified Information Systems Security Professional) which  is an independent information security certification granted by the International Information System Security Certification Consortium, also known as (ISC)². 

3. Whether the CISO has knowledge, skills, or other background in cybersecurity, including, for example, in the areas of security policy and governance, risk management, security assessment, control evaluation, security  architecture and engineering, security operations, incident handling, or business continuity planning.