3 ms·
> Don't forget to be honest. I know there's this cult of positivity crap floating around, but the best CISO in this scenario calls the CEO, gives them the hones
by IncRnd 5y ago
> Don't forget to be honest. I know there's this cult of positivity crap floating around, but the best CISO in this scenario calls the CEO, gives them the honest grim assessment of the current situation, says what can be done to fix it, and is eager to get to work.
The job of a CISO is not to convey problems to the CEO but to solve problems. The first CISO didn't understand their role.
- freedomben 5y agoNo not really. The CEO has to balance between the "fix nothing" CTO and "fix everything" CISO. I'm exaggerating a bit of course, in reality it's a blend, but in general the CTO and CISO often have opposite/incompatible goals. The CTO wants to ship fast and ship often, which the CISO doesn't want to ship until everything is done. The CEO ultimately needs to decide where to put the line, and a good CISO will execute under that and escalate when needed.