San Francisco CISO Inner Circle

Do you know who your champions are? Just as risk management is about so much more than being compliant, creating a culture of security requires more than baseline awareness. It’s about creating champions – in your Board, employees, and your customers. It’s also about enmeshing security into the heart of your digital vision and core business processes with security-first mindsets. Uncover tangible steps with your peers to weave security into the fabric of your organization’s culture and competitive position.  

Processes and Planning

• Where does responsibility for security lie within your organization (and where should it lie)? Centralized within a single group, across several groups, with department heads?
• When launching digital initiatives, what are some tactics you’ve employed to bring security into the conversation early and continuously?
• What tools or frameworks (SOAR tools, virtualization, etc) do you use to gain insight into evolving systems, devices, things, and data across your environment? How do you maintain visibility into new tools and initiatives that may increase risk?  

One Size Fits None?

• Security awareness needs are unique to every organization: How successful would you consider your current security awareness programs, and how do you measure them?
• Moving past awareness and into engagement: how do you tailor security education for every part of the business (first-level to the Board)? What are some strategies that work to embed security into everyday activities and functions?
• Do you have/are you planning to launch a “security champion” program? How do you identify and train potential champions, and with whom should CISOs partner to lead/launch the program?  

Thriving and Sustainable

• How do you continuously draw clear connections between business objectives and risk?
• How do you balance business autonomy and scale in deploying new digital technologies with security controls? What safeguards need to be in place?
• Digital customers (internal and external) expect a level of personal control and customization – how should CISOs look at delivering on those expectations while still minimizing risk?
• As a security leader, how do you specifically build your influence in the organization, and the influence of the security function?