A chief information security officer (CISO) is the senior-level executive within an organization responsible for establishing and maintaining the enterprise vision, strategy and program to ensure information assets are adequately protected. The CISO directs staff in identifying, developing, implementing and maintaining processes across the organization to reduce information and information technology (IT) risks, respond to incidents, establish appropriate standards and controls, and direct the establishment and implementation of policies and procedures. The CISO is also usually responsible for information-related compliance.

Typically the CISO's influence reaches the whole organization and responsibilities include:

• Information security and information assurance
• Information regulatory compliance (e.g., US PCI DSS, FISMA, GLBA, HIPAA; UK Data Protection Act 1998; Canada PIPEDA)
• Information risk management
• Information technology controls for financial and other systems
• Information privacy
• Computer Emergency Response Team / Computer Security Incident Response Team
• Identity and access management
• Disaster recovery and business continuity management.

Having a CISO or the equivalent function in the organization has become a standard in most business, government and non-profit sectors. Throughout the world, a growing number of organizations have a CISO. By 2009, approximately 85% of large organizations had a security executive, up from 56% in 2008, and 43% in 2006. About one-third of these security chiefs report to a Chief Information Officer (CIO), 35% to Chief Executive Officer (CEO), and 28% to the boards of directors.

In corporations, the trend is for CISOs to have a strong balance of business acumen and technology knowledge. CISOs are often in high demand and compensation is comparable to other C-level positions.

[edit] Related links

• Information security
• Board of Directors
• Chief Information Officer
• Chief Exectuvite Officer
• Chief Security Officer
• Chief Risk Officer

[edit] References