CIO and CISO: complementary roles

At a time when companies of all sizes and in all sectors are faced with growing Cybersecurity challenges, the question of responsibility and management of IT risks arises. Who should be the guarantor, the CISO (Chief Information Security Officer) or the CIO (Chief Information Officer)? What if the roles and missions of the two were complementary?

Today, it is obsolete to assert that Cybersecurity is solely a matter of technology. It must be a reflex for every employee in the company, and IT teams are at the top of the list: every project, every architecture, every IT activity must take account of the challenges inherent in IS security.

CIO / CISO: who does what… on paper?

While the CIO is responsible for overseeing the management and evolution of the company’s information systems, aligning technology with strategic objectives in the service of the various Business Units, the CISO is responsible for protecting data and the IS against security threats and risks, and ensuring compliance with IT security regulations and standards. Where the CIO wants to accelerate and bring agility to the Business Units, the CISO has long been seen as a brake on the company’s digital transformation, the development of its tools and the uses of its employees. However, the opposite is true! His mission is twofold:

• Implement IS security measures, based on various standards (including the famous ISO 27001 standard), and regularly measure their effectiveness through audits;
• Communicating and raising awareness of Cybersecurity, through a range of initiatives designed to promote and disseminate a culture of security throughout the company’s functions and businesses.

The CISO’s actions must ensure information security across all business processes. His or her role therefore cuts across the whole company, and he or she works with a large number of contacts from General Management, Business Units and, of course, the CIO. That’s why they need to demonstrate leadership, adaptability and communication skills. In short, the CISO is the organizer of Cybersecurity within the company: he or she guides and coordinates the Teams in this key area.

Why is Cybersecurity so important?

Cybercrime is a scourge that affects every department in a company. In fact, data loss is one of the major risks across all functions: business, HR, marketing, and so on. Data is now a top priority, particularly for financial reasons: losing data represents a significant financial cost, in addition to the associated human and legal risks. Similarly, IT networks are becoming increasingly open, employees are mobile and hyperconnected, and they expect their IT systems to be very fast and efficient. Digital literacy has spread in many directions, and shadow IT creates vulnerabilities in Cybersecurity, thereby posing potential risks of intrusion, data theft, and so on.

The CISO thus acts as a guardian: he or she ensures the security of data when it is being stored, transmitted, and so on. In order to implement a consistent Cybersecurity strategy within the organization, it is essential that it be approved at the highest level by the company’s Executive Committee and embraced by all employees. Safety is everyone’s business!

How can the CIO and CISO work together to ensure the company’s security?

Did you know? According to the latest “State of Cybersecurity” report from ISACA (an international professional association dedicated to improving the governance of information systems), one-quarter of security teams report directly to the Chief Information Officer. This figure underscores a point made by many decision-makers: the CIO and the CISO both pursue different yet complementary objectives. Together, they form a cybersecurity expert duo, key to ensuring maximum protection of information systems and essential collaboration in convincing executive committees and employees of the importance of managing IT risks.

Nevertheless, the CISO continues to be seen as the one who puts up barriers, often saying “no” in the name of protecting the company’s resources. This sets the CISO apart from the CIO, whose role is to provide business units with the resources and tools they need to be responsive and effective. If the CIO fails in this role, it also leaves the door open to shadow IT…

A partnership between CISOs and CIOs is essential to maintain the integrity of the IS: the growing challenges of Cybersecurity, particularly with the development of cloud architectures, clearly demonstrate that it is essential for both to move forward together, with the common objective of securing the organization’s IS.

So, should the CISO be part of the CIO or not? The question is divisive. Various studies show that the positioning and attachment of the CISO depends on the size and maturity of the organization. Here’s an overview.

How pragmatic are small CIOs?

In small organizations, the ISR function is rarely the subject of a dedicated position. At best, it’s the infrastructure manager, or even the CIO, who is in charge of Cybersecurity. By extension, the CIO, because he or she naturally embodies the culture of risk, may even be responsible for the company’s entire BCP (Business continuity plan). A pragmatic approach closely linked to available Resources.

Why has the CISO long remained outside the CIO?

The increasing number of cyber-attacks, phishing attacks and hacking attacks has brought the role of the CISO to the forefront of organizations. Until now, most large organizations have left this function independent of the CIO. The main reason given for this was that the CISO’s role was one of control, and he or she could not be both judge and jury of the department managing the organization’s information systems. He should not be able to interpret the decisions and measures he himself has put in place, due to possible conflicts of interest.

Another reason given for this was the risk of concentrating too many responsibilities on the CIO alone. Positioning the CISO outside the CIO also promotes synergy between the various departments, and makes them more aware of the company’s risks (failures, threats, areas for improvement), enabling them to make more pertinent decisions.

Recognizing the strategic importance of security, many organizations therefore report the CISO role either to the Risk Management Department (where one exists) or directly to the company’s senior management. In fact, as the ultimate decision-maker, she is responsible for the company’s security and thus plays a key role in allocating the resources and Budgets needed to protect information systems.

In this configuration, where the CISO is not attached to the CIO, there must obviously be a relationship of trust between the two entities, as effective coordination is essential. The two entities must communicate regularly and transparently.

What can be achieved when CISOs and CIOs are integrated within the same department?

If the CIO is the sole guarantor of the overall information system, including security, this model now seems to be becoming obsolete. More and more frequently, the CISO is integrated into the CIO, with a dedicated role that underlines the importance of the function. This positioning is interesting for several reasons:

• Leveraging the company’s digital transformation

The role of the CISO has evolved over the years, from a technical role to one that is indispensable throughout Projects, whether in systems architecture, operations or, more generally, in business transformation. The CISO is part of a global security ecosystem, integrating internal resources, including the CIO, and external resources such as official bodies, standards, labels and best practice networks. Getting CISOs to work together within the CIO means that they can activate effective digitalization levers: they will cover the needs instilled by the company’s various businesses, while at the same time meeting security standards, making Agility a real added value for the whole company.

• Control and manage a global IS Budgets including Cybersecurity

Integrating the CISO function within the CIO also gives the CISO a complete overview of the IT and security Budgets… and the ability to defend them as a whole to the management committee. The question of budget control is key: the CIO will plead the cause of security to the management bodies (to prevent IT security from suffering as a result of budget restrictions). This joint approach helps to position security requirements upstream of Projects, thereby reducing costs and improving project efficiency… while keeping the Cybersecurity operating Budgets under control. Managing and centralizing the CIO’s Budgets by integrating the dimensions linked to Cybersecurity challenges enables a more global approach to all issues.

• Raising Cybersecurity awareness at the highest level of the organization

The CIO, as a member of the Executive Committee, is finally able to bring the voice of Cybersecurity to the highest level of the company’s hierarchy. This demonstrates that security is everyone’s business, not just IT’s, and gives responsibility to each department. It’s up to them to give their CISO the necessary role and weight, and to support and defend his or her action.

CIOs and CISOs on the same wavelength: the debate in a nutshell