The Evolution of the Chief Risk Officer

Former CIA CISO Robert Bigman recounts building the agency's CISO role from scratch, why governance and policy work were core duties, and how to recover from mistakes in high-stakes environments.

Security Curve CTO Diana Kelley on communicating cybersecurity ROI through a business-profitability lens, building application security programs, and improving inclusivity in the security industry.

A 30-year security veteran shares lessons for CISOs: simple misconfigurations often beat advanced skills, and new senior leaders should focus on understanding the business before spending on tools.

Recaps RSA 2020, highlighting Rohit Ghai's call to reframe the narrative around cyber-resilience, why CISOs must bridge technical and boardroom conversations, and how intel sharing aids defense.

Since the role of the Chief Information Security Officer (CISO) and how he or she reports has a major impact on security and risk, I think it’s interesting to look at how different organizations have structured the position. With that said, there is very little consistency other than a correlation with the industry vertical’s understanding of IT risk.

CISOs from Blackstone, Red Ventures and New American Funding share C-suite buy-in tactics: speak business language, focus on governance, clarify risk ownership and build stakeholder ties.