Act like you belong in the C-suite

< Back to Cyber trust - securing the future landing page

Cyber security is now a common topic of boardroom debate. In the KPMG 2021 CEO Outlook Pulse Survey, cyber risk was ranked as the number one organizational threat by global CEOs, with data security taking a priority over all other technology investments.

Senior executives and non-executive directors have become all too aware of the impact of incidents such as data loss, ransomware and fraud, which can bring operations to a standstill and destroy revenue and reputation.

But they also face a dilemma: They want to rapidly digitize the business, but are starting to recognize that moving too fast, without considering security at the design stage, can also bring risks.

As companies become ever more dependent upon digital technology, every business decision has a cyber security dimension. The CISO’s priorities are shifting from firewalls and identity management to major strategic challenges like brand trust, product security, resilient operations, and robust supply chains.

More and more CISOs are getting a direct line to the CEO, but are they really prepared for such an elevated role? As the saying goes: “When you get to the end zone, act like you’ve been there before.” CISOs need to start thinking that they deserve to be members of the C-suite, focusing on problem-solving and becoming business enablers, with a stake in innovation, growth and revenue.

In stepping up to a C-suite role, CISOs must acquire new skills and mindsets, to focus less on pure security and compliance, and more on broader business risks and opportunities.

Today’s businesses must be fast to market, yet avoid releasing products and services with cyber vulnerabilities. There will always be occasions when CISOs need to apply the brakes, but, by getting involved at the earliest stage of new product development, they can embed security by design and reinvent themselves as business enablers who ultimately help the company go faster, more safely, preserving digital trust.

In the words of Leon Chang, Head, Cyber Defence Group, IHiS, “CISOs that go to board meetings with ill-prepared technical presentations are setting themselves up to fail.” As risk advisors, CISOs should eschew technical detail and speak to the board on its terms, explaining the cyber threat landscape and associated risks to customers, growth, revenue, costs and brand. By using a common language for cyber and operational risk, which resonates with the board, they can frame a constructive debate on cyber security risk — and emphasize the need to embed cyber security in corporate strategy and major investment approvals.

Influence at board level can often be informal, a result of relationships forged with multiple stakeholders. In navigating the corporate jungle, CISOs need to gain trust, by attending meetings of finance, marketing, operations and other functions, to both learn about business risks and educate about cyber threats. CISOs can also bring compelling individuals in front of the board, from within and outside of the cyber team, with interesting outlooks and insights into risk, to articulate the importance of cyber security. In this new, C-suite world, it’s all about influence, as Greg Day, VP and CISO, Europe, Middle East and Africa, Palo Alto Networks, puts it: “A CISO is not a great CISO because of a huge budget and massive team. It’s because they’ve empowered the business around them to go ahead and be successful.”

Working in the gray zone of corporate politics may prove especially challenging for the many CISOs from technical backgrounds. Every organization will get hacked at some point, so the CISO has to demystify cyber security by explaining what an incident could cost the business, and the degree to which investment in cyber security can reduce risk and accelerate recovery. CISOs can bring unique perspectives and insights into the modus operandi of criminals or malicious attackers. Most mature organizations will have well-established enterprise risk management systems, and the CISO should seek to embed cyber security into these.

Managing expectations is another tricky balancing act. Sales and marketing executives want to swiftly launch and enhance new products and services, operations need to run 24/7, while customers expect their data to be secure. By working with CIOs and their DevOps teams, CISOs can help others become heroes, embedding cyber security and making full use of automation, enabling new revenue streams, keeping the lights on, and enhancing trust in the organization.