[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-259897-105":53,"doc-detail-259897-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","hiring-your-next-or-first-ciso","Hiring Your Next (or First) CISO","","A practical guide for boards and executive teams to define and hire an effective first Chief Information Security Officer. It explains how to analyze the business “board ask,” clarify regulatory scope without confusing compliance with security success, and translate the organization’s current security posture into an actionable target state and roadmap. The article then outlines core CISO responsibility buckets across governance, risk and compliance, security operations, security technologies, and business-unit risk management to support correct role fit and candidate evaluation.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":16,"@type":70,"position":76},"https://docshare.wps.com/template/resumes/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/hiring-your-next-or-first-ciso/259897/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/hiring-your-next-or-first-ciso/259897.png","ImageObject",442,249,{"name":88,"@type":89},"Rizky","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-21","2026-09-13",true,{"@type":98,"interactionType":99,"userInteractionCount":47},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"What should be done before writing a CISO job requisition?","Question",{"text":108,"@type":109},"Start with analysis, comprehension, and reconciliation of the board/executive ask, regulatory minimum requirements, organizational needs, CISO responsibilities, reporting structure fit, and justification of the compensation package.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"Why does the article warn against treating regulatory compliance as a security program?",{"text":113,"@type":109},"Regulatory compliance sets minimum expectations but does not automatically make security effective. The organization must decide what control level beyond compliance the CISO role can and should drive.",{"name":115,"@type":106,"acceptedAnswer":116},"What are the four main buckets of CISO responsibilities described in the article?",{"text":117,"@type":109},"Governance, Risk and Compliance (GRC); Security Operations (SecOps); Security Technologies; and Business Unit Risk Management (BISO).","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},259897,1790472288,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":15,"category_name":16,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":47,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":79,"language":135,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":136,"faqs":137,"seo_title":138,"seo_description":61,"update_tm":139,"read_time":73},962085564807,"https://ap-avatar.wpscdn.com/davatar_6f874abed73319feea01a86fa6f0fab8","Title  \nHiring Your Next (or First) CISO  \noyhlnCe. Checco (President, ISSA NY Metro Chapter) and Steven Kolombaris (CISO, Sotheby’s)  \nirle provides an overview of points to consider when hiring your first CISO.  \nY  \nou are a growing company, and your board (or regulations such as NYS DFS 500) requires you to hire your first CISO. Heed this business management cliché: “Failing to  \nspend time now to do it right will cost you time to do it twice.”A peer who has been a CISO in multiple industries offers the analogy of a landowner who wants a house, so they hire a general contractor. They realize the general contractor is there to achieve that goal by applying knowledge, experience, expertise, capabilities, connections, tools, in-house and external resources. Yet, many organizations hire a CISO without examining either their goals or the CISO’s skills but expect to be handed immediately a “Cybersecurity Level Achieved” badge.  \nCISOs are the general contractors for cybersecurity. They work to achieve an organization’s security goals through their own knowledge, experience, expertise, capabilities, connections, tools, in-house and external resources.  \nHere are our suggestions for doing it right the first time.  \nDefine the CISO Role  \nWriting and broadly disseminating a job requisition is not your first step. Too often, the job description for the CISO position is left to HR, an external recruiting agency, or written internally by the CTO or other technology-focused executive. This leads  \nto job descriptions that vary wildly from governance, to handson firewall maintenance, or reflects a buffet of skills that no one person possesses.  \nThe correct first steps are analysis, comprehension, and reconciliation of the following factors:  \n1. Board and/or executive committee ask;  \n2. Regulatory minimum requirements;  \n3. Needs of the organization;  \n4. Responsibilities for the CISO;  \n5. Where the CISO best fits into the reporting structure; and  \n6. Justifying a compensation package.  \nOnce these six items have been properly vetted and documented, you can work with the executive committee to build the right level of language for the job requisition.  \nDeconstructing the Board Ask  \nAlthough it seems forward-thinking that the board has requested the creation of a CISO role, deeper exploration of the ‘ask’ is truly needed.  \n• What factors brought about this request?  \n• Internal incident, direct or indirect (with suppliers/ partners);  \n• Internal risk report;  \n• External event or industry tailwind; or  \n• Regulatory compliance, recent audits or other examinations.  \n• What is the board really asking for?  \n• Additional business risk governance;  \n• Explicit security program; or  \n• Other objectives (or checkbox confirmation).  \n• What is the board expecting to see delivered?  \n• Position fulfillment;  \n• Regular risk (and risk exception) reporting; or  \n• Explicit security initiatives.  \n• What is the expected reaction if the CISO challenged the board?  \n• Board is expecting to be challenged;  \n• Board is expecting confirmation, not challenge (narcissism); or  \n• Board’s security governance committee will work with the CISO through challenges.  \nDetermining Regulatory Scope  \nAnother aspect of the CISO role is the scope of regulatory requirements the organization must comply with regarding information security and data privacy. It is also important to note that regulatory compliance does not make a security program successful.  \n18 – ISSA Journal | December 2023  \nIf your company is a service organization or removed from direct regulatory requirements, understand the impact from your clients’ regulatory obligations and align your company’s scope using standards such as ISO-2700x and/or SOC2 compliance.  \nThere is a dichotomy where CISOs view that compliance is far below the minimum standard for security, whereas organizations view regulatory compliance as their maximum spend. Deciding what level of control beyond compliance can b","cbCaiqlsl0FjymWx","https://ap.wps.com/l/cbCaiqlsl0FjymWx","pdf",1119982,"English","# Define the CISO Role\n## Deconstructing the Board Ask\n## Determining Regulatory Scope\n# Organizational Security Roadmap\n# Responsibilities of the CISO\n## Governance, Risk and Compliance (GRC)\n## Security Operations (SecOps)\n## Security Technologies\n## Business Unit Risk Management (BISO)","[{\"question\":\"What should be done before writing a CISO job requisition?\",\"answer\":\"Start with analysis, comprehension, and reconciliation of the board/executive ask, regulatory minimum requirements, organizational needs, CISO responsibilities, reporting structure fit, and justification of the compensation package.\"},{\"question\":\"Why does the article warn against treating regulatory compliance as a security program?\",\"answer\":\"Regulatory compliance sets minimum expectations but does not automatically make security effective. The organization must decide what control level beyond compliance the CISO role can and should drive.\"},{\"question\":\"What are the four main buckets of CISO responsibilities described in the article?\",\"answer\":\"Governance, Risk and Compliance (GRC); Security Operations (SecOps); Security Technologies; and Business Unit Risk Management (BISO).\"}]","Hiring Your Next (or First) CISO | PDF",1789336907]