* A solid understanding of security technology. I don't expect a CISO to be able to field-strip a firewall or jump in and take the place of one of her line anal

* A solid understanding of security technology. I don't expect a CISO to be able to field-strip a firewall or jump in and take the place of one of her line analysts, but I do expect the CISO to understand firewall technologies and talk intelligently about why they're important. One of the CISO's jobs is advocating for security controls with other business organizations, which necessitates the ability to talk intelligently and in layman-understandable terms about what those controls entail, what those technologies do, and why they're important. A CISO who doesn't understand what a digital certificate is will have a hard time arguing for protecting them or will accept weak protections because they sound stronger than they are. Worse, a CISO who doesn't understand security solidly may call for implementing controls that don't make sense or that don't afford any protection, or will focus too heavily on one area while neglecting another. The amount of technological know-how in the CISO will likely vary according to company and org size: the CISO of a small company will likely also be the security person and therefore should be very security-tech-savvy; the CISO of a large corporation will likely be much further removed from the console glass because their scope is much larger. In the latter case, you would expect the CISO to have a solid organization of very security-tech-savvy people to whom the CISO would listen closely and trust to make good recommendations. (This latter part seems to get overlooked.) * CISOs must understand risk, and be able to articulate it in a balanced picture to non-security people. CISOs who always say no and couch risk in the most apocalyptic terms are actively disabling their companies; CISOs who always say yes and couch risk in the gentlest terms are setting their company up for Equifax-level failures. The old saying is "A ship in harbor is safe, but that's not what ships are for"--the CISO needs to be able to let the ship sail when appropriate while still pointing out the reefs on the map. * Along similar lines, the CISO needs to understand her particular company and its industry well. If you don't understand what makes the company money, you may wind up arguing for controls that cut profits or hinder business. CISOs also need to understand and anticipate trends in their industry and as a whole. Cloud, containers, agile development, devops, these are all huge trends in the industry right now, and a good CISO will see them coming and have considered where to fit them in (or where to say "nope, can't do that (right now)...and here's why") so when the business pops up and says, 'We want to do that!' she can explain what's possible, what's reasonable, and where the risks are for their particular business. A healthcare company with extensive HIPAA and Fedramp regulations is going to have an entirely different approach to the cloud than a software-focused startup working on a new social media solution!