The Many Dimensions of Effective CISO Leaders

Organizations today must ensure their chief information security officer (CISO) has the leadership and business qualities necessary to drive effective management of cyber risks. In a world where the roles and responsibilities of this position are still evolving, pinning down the traits of effective cybersecurity leaders can prove challenging, yet the stakes are too high to ignore. Having an effective security leader can be the difference between surviving the next incident or going down with the ship.

As the U.S. government’s own CISO handbook put it, “Because no two agency missions are exactly the same, no two CISO roles are exactly the same,” noting that some are essentially responsible for all information security activities, while others have taken on a more strategic, organizational-level role.

What are some traits of a successful CISO? CSO Online asked that very question of security leaders, who reported some secrets to their success.

Fifty-four percent of CISOs pointed to leadership as one of the top skills to develop. The next skill identified — communication — was selected by only 49 percent of CISOs, which is surprising given the amount of written, verbal and nonverbal communications CISOs find themselves engaged in on a daily basis. However, the third trait identified might help explain the low percentage for communication skills: 44 percent of CISOs pointed to a strong relationship with business executives, especially in cases where the security leader is treated as an equal.

Next, management skills were mentioned by 33 percent of CISOs, followed by technical skills at 21 percent. While it is somewhat surprising to see technical skills so low in the list, CISOs oversee a department full of technically qualified security professionals that should be able to fill any technical gaps.

In addition to individual traits, let’s also consider the range of interactions that CISOs have in the workplace.

Today’s CISO is responsible for interacting with multiple constituencies across the organization, from the very top levels down to entry-level employees. Here are some common CISO interactions:

We know that the role of security leader requires a vast array of skills, which could fill pages. Instead, a more compact approach is to consider the CISO’s performance across four key dimensions. Why dimensions, you might ask? Because dimensions transcend the usual organizational silos. For each dimension, one should consider the CISO’s current level of performance, starting from “novice” to “understands” to “influences/advises.”

“Understands” means the CISO is able to appreciate how this dimension matters to the health and profitability of the organization, and is thus able to articulate reasonable security solutions. “Influences/advises” means the CISO has reached a point where their advice is sought after, or they strongly influence various aspects of the dimension.

It’s all business, all the time. An effective cybersecurity leader will have developed a strong understanding of key parts of the business. Effective CISOs will be a step ahead, being able to yield their influence over cyber risks during key business decisions.