Understanding Cybersecurity at the Corporate level
Tuesday, April 17, 2018
Cyber Security is evolving to be priority for any organization and the corporate establishment are feeling the heat. Let’s understand who does what in cyber security services at the corporate level.
Chief Information Security Officer (CISO)
The CISO is responsible for all security programs and policies. More CISOs report to the CEO but its most common for them to report to the CIO. Usually the CISO leads a team that implements and monitors security systems that safeguards the company’s critical data from unauthorized access and data leaks. With all the high-profile data breaches in the recent past more companies are aligning the CISO position with the IT department.
Chief Risk Officer (CRO)
Usually this position is filled by an attorney and he/she cover more than just cyber risk. CRO and his/her team assesses how much cyber insurance the company should purchase and also assesses the company's regulatory risk. From an IT security perspective, the CRO plays an advisory role in which they explain to the board what risks malware, exploits, and other hacking incidents present to the company and what the risk/reward scenarios are.
Chief Technology Officer (CTO)
CTOs can be of two types, one that focuses on IT procurements which the company require such as firewalls/routers, data loss prevention, anti-virus software etc.
The other type are usually found in tech companies. They focus on the technology that is embedded on to their products and security is an important component of product development. The CTO assesses whether the company can securely deploy the products they bring to market without any vulnerabilities to the company’s and user’s data.
Chief Information Officer (CIO)
CIO is responsible for the overall IT operations in the organization. He/she typically oversees the budget for the IT operations, so all spending on security systems and personnel must first get approval through the CIO’s desk. CIO reports to the CEO and often have a chair on the executive board.
Chief Privacy Officer (CPO) / Chief Data Officer (CDO)
Data privacy is of prime importance to any company. CPO focuses on the company’s data privacy policies surrounding information security. They assess what data the company needs to keep and set retention policies for data. They decide on where the data resides, how it will be stored, and the policies around maintaining that data.
Chief Financial Officer (CFO)
The CFO overlooks all financial decisions and accounting in an organization. CFO works along with CRO to decide how much cyber insurance the company needs. Both the CISO and the CIO may report to the CFO at some companies.
