CIO-CISO Relationship Continues To Evolve

For years, the security pro was one of many staffers under CIO management. Now the CISO is becoming more prominent as businesses buckle down on security.

This is causing a shift in the working relationship between the two C-level executives. While the CIO is responsible for leadership, vision, and IT implementation to propel the business forward, the CISO has a critical role in providing insight and guidance to ensure the strategy is secure.

"The CISO role is becoming more important in the relationship with the CIO," says Dave Mahon, VP and CSO at CenturyLink. "Security is now, in essence, table stakes for delivering on your corporate strategy." 

Part of this is due to the evolution of security. Corporate networks are increasingly complex and support more connected devices than ever, especially with the growth of BYOD programs. Hackers are using more sophisticated methods to breach organizations and steal data.

In this dynamic environment, the CISO identifies vulnerabilities and advises the CIO on future plans, Mahon explains. The two review a road map, look at systems and data throughout the organization, and the CISO provides guidance. For example, he/she may advise the CIO not to use a particular vendor because it's a security risk.

"There is no corporate structure standard but today, the majority of public companies still have the CISO reporting directly to the CIO," says Jeremy King, president at Benchmark Executive Search.

Every company views risk management differently, he continues. Some businesses have their CISO report to the general counsel, head of compliance, COO, or CEO. In addition, the CISO and CIO are becoming more empowered to veto key strategic decisions.

"The CISO has a seat at the boardroom table," says Dawn-Marie Hutchinson, executive director for Optiv's Office of the CISO. "They're saying, 'Let's talk about what the business is doing strategically and how we can enable that functionality.'"

This used to be the CIO's conversation, she says, but reporting structure is changing to prioritize security issues and projects. Businesses want to know how they can maintain the privacy of information systems, and the attention is giving CISOs more face time with board members and execs.

Greg Conti, principal at IronNet Cybersecurity, says he foresees the requirements for CISOs increasing over time, especially as more highly publicized breaches continue to occur.

"The CISO must understand technology, policy, law, compliance, risk, and myriad other areas," he explains. "These are very diverse topics and this complexity requires a strong team because no one can be an expert in it all."

As the CISO becomes critical to business decisions, the CIO's role is changing, says Hutchinson. The CIO is more frequently being relegated to operational tech and handling issues like outsourcing, cloud usage, and network availability -- all issues driving them away from security.

Change and Challenges

Going forward, both the CIO and CISO will face distinct challenges as their roles and relationship continue to evolve.

The role of the CIO won't go away, says Hutchinson, but it will be redefined as we know it. She predicts the CIO will have greater responsibility over innovation. Companies that innovate are those with strong CIOs leading the charge, she notes.

The challenge for CIOs will be deploying new technologies. Oftentimes they're so preoccupied with keeping the lights on, CIOs don't have time to make the IT department more effective in providing and supporting tools that meet changing business needs, she says.

Mahon poses another question that will challenge CIOs and CISOs as the threat landscape evolves: "One of the challenges will be, how do you meet the addressable market, the needs of customers, in a way that still aligns with your own corporate-approved risk management posture?" 

This question will require senior leadership teams that establish the risk management posture to strike a balance between speed-to-market and security. They can choose to go to market quickly, but in doing so, they risk long-term repercussions.

The changing roles of the CISO and CIO may affect spending, says Conti.

"I do see the CIO's role as being potentially less glamorous than that of the CISO in some ways," he notes. "For example, the classic challenge of the CIO is what when everything is working nobody cares, but as soon as something stops working, it becomes a major problem. This challenge is hard to overcome, whereas the CISO has a compelling security narrative driving their requirements."

Related Content: