Chief Information Securtiy Officer (CISO) Job Requirements

The primary responsibility of a Chief Information Security Officer (CISO) is to oversee the implementation and management of the organization's cybersecurity programme. The CISO shall be responsible for the day-to-day coordination of all cybersecurity activities, implementation of necessary controls and the mitigation of cybersecurity risks in the organization, including inherent and emerging risks. Contrary to the general misconception that the CISO is responsible for IT security, the role of the CISO is much more broader than the management of IT Security. Cybersecurity is more broader than IT Securtiy given that IT Security is a subset of Cybersecurity. While IT security involve the implementation of security controls over an organization's IT systems and infrastructure, cybersecurity involve the identification, assessment, mitigation and reporting of risks associated with information aseets whereever they may be within the organization. Information assets are not limited to IT systems and infrastructure but include business data/information, trade secrets and customer information in transit, at rest (stored), processed, printed, archived and decommissioned. As such, the role of the Chief Information Security Officer (CISO) focuses on the enterprise-wide cybersecurity risk management rather than IT security risk only. The CISO is also responsible for the development and implementation of the cybersecurity programme and strategy, which have been approved by the Board of Directors and senior management of the organization.

The Chief Information Security Officer (CISO) shall head the organization's Information Security Steering Committee (ISSC), which is responsible for the governance of cybersecurity programme and strategy of the organization. Through the Information Security Steering Committee, the CISO ensures that the organization's cybersecurity policies and procedures are aligned with business objective. The CISO shall be responsible for providing strategic direction for cybersecurtiy governance for her organization. The CISO shall be responsible for the prioritization of cybersecurtiy investments and risk management, which are subject to the ISSC and Board approvals. The CISO shall be responsible for providing adequate cybersecurity awareness and education across the length and breadth of the organization. Given the important of awareness and security education, the CISO shall put in place a programme to drive awareness across employees at all levels including senior management and the Board of Directors without any exemptions. This is at the core of ensuring that information assets are secured across its value-chain and the right tone and culture of security is entrenched within the organization's broader culture.

To improve the cybersecurity posture of the organization, the CISO shall embrass leading practices in the cybersecurity ecosystem including compliance with any required industry frameworks or standards in cybersecurity where applicable. Such leading global standards, frameworks and practices are not limited to NIST Cybersecurity framework, ISO/IEC 27001 & 27002, SOC2, HIPAA, GDPR, FISMA, among others. This is to ensure that good security practices, controls and standards are implemented in the enterprise to promote security and bring enterprise systems and processes up to speed with what is obtainable globally.

The job requirements of the Chief Information Security Officer (CISO) are detailed below:

Reporting line of a Chief Information Security Officer (CISO)

We strongly recommend that the CISO report directly to the Board of Directors via its standing committee(s) responsible for Cybersecurity governance. The Board charter should adequately reflect cybersecurity governance as part of its scope of authority. However, to ensure smooth running of the day to day function of the Cybersecurtiy operations of the organization including the Information Security Steering Committee, the CISO should maintain a dotted reporting line to the Managing Director/Chief Executive Officer (MD/CEO) or its equivalent in the organization. This is to ensure adequate senior management oversight on issues of cybersecurity programme, incidents and response, including provision of resources. The CISO shall not report to any other member of senior management including executive(s) who have authority over information technology as doing so would breach the segregation of duties control required of an assurance function such as the CISO role and could also lead to conflict of interest that is capable of undermining the security of the organization's information aseets.

Professional Certifications for Chief Information Security Officer (CISO)

To be qualified to hold the CISO role, practitioners must acquire certifications such as, Certified Information Systems Security Professional (CISSP) by ISC2, Certified Information Security Manager (CISM) by ISACA and Certified Chief Information Security Officer (CCISO) by EC-Council, Certified Information Systems Auditor (CISA) by ISACA and other related technical or governance ceritifications, among others.