Strategic Communications Planning for a CISO: Strength in Weak Ties

Sep 13, 2026

As information becomes a company’s most valuable asset, the executive accountable for preserving data integrity and security becomes central in complex enterprise environments. Effective policies, procedures, and training across multiple departments demand consensus-building capabilities and trust partnerships amid varied corporate dynamics. In crisis conditions such as data loss, accidental exposure of private information, or malicious system disruption, the CISO faces heightened scrutiny. The paper analyzes strengths, weaknesses, opportunities, and challenges of the CISO in a large public university and links outcomes to weak-tie interpersonal networks.

LanguageEnglish

CategoryPresentations

FormatPDF

Pages11

Reading Time4 min

AccessFree to download

Introduction

SWOT and strategic planning

Weak ties in CISO networks

Interview-based case analysis

Open Access License Notice This article is © its author(s) and is licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0) . This license applies regardless of any copyright or pricing statements appearing later in this PDF. Those statements reﬂ ect formatting from the print edition and do not represent the current open access licensing policy. License details: [https://creativecommons.org/licenses/by/4.0/](https://creativecommons.org/licenses/by/4.0/) The Colloquium for Information Systems Security Education (CISSE) Strategic Communications Planning for a CISO: Strength in Weak Ties Abstract As companies increasingly rate information as their most valuable asset, the executive in charge of maintaining the integrity and security of those assets has become the focal point for security problems in large and complex enterprise environments. Establishing the policies, procedures and training centering on data and system security across multiple departments requires unique consensus building skills and engendering trust partnerships across a complex range of corporate dynamics. And yet, in a crisis involving the loss of vital data, inadvertent disclosure of private information or malicious disruption of systems from outside bad actors, the CISO is in the hot seat. Often, the CISO office has minimum staff and maximum exposure. This paper presents an analysis of the strengths, weaknesses, opportunities and challenges of the CISO for a large state university that can provide insight into the larger problem faced by the private sector. The purpose is to illuminate the management issues facing the executive responsible for promoting the mission of the office—a mission to provide policy and guidance toward maintaining a secure computing environment. The purpose is also to provide a case study of a CISO exhibiting the qualities of security management gained through the strength of interpersonal networks, a case in evidence of the strength of weak ties. 1. Introduction An analysis of the CISO role begins with an acknowledgement of two major challenges. The first is that risk management as it pertains to computing and data is a moving target. There is a constant flow of new technologies, requirements and end-users into the University. This creates an environment that is impossible to secure from all present and future risks to information systems. Given this reality, the CISO’s objective is not to dictate initiatives to eliminate risk, but rather to provide information and support to assist executives within the University organizations to do their own risk management due diligence. Second, the Office does not have responsibility for the equipment or systems at risk, nor can it enforce its recommendations. It can only delegate and suggest better methods and procedures in the face of almost assured breach incidents of sensitive data and systems. While strategic planning and analyses of strengths, weaknesses, opportunities, and threats (SWOT), are increasingly commonplace in the planning and budgeting of critical infrastructure systems, we present this case as one in perhaps a series for the purpose of developing discourse on the politics and economics of organizing to manage cybersecurity. That is, one can perform a SWOT analysis on a system, and one can perform a SWOT analysis of the organization charged with managing the system. We believe that many outstanding issues in cybersecurity exist because of under-analyzed, and coincidentally weak connections, between the political-economic dynamics of organizations responsible for technical systems. The following case illustrates relationships that capitalize on the strength of weak ties between a CISO and fellow administrators from disparate parts ofa large and technologically active public University.“The strength of weak ties” is a phrase coined by Mark Granovetter, in his article by the same name, published by the American Journal of Sociolo

FAQs

What major challenges define the CISO role in this paper?

Risk management is a moving target due to continual technology and user changes. The CISO also lacks direct responsibility and enforcement power over the equipment or systems at risk, relying instead on delegation and recommendations.

How does the paper connect cybersecurity management with weak ties?

It uses the concept of weak ties—ties that connect groups through non-hierarchical relationships—to explain how interpersonal networks between a CISO and administrators support security governance.

What method is used to analyze the CISO’s strengths and challenges?

The paper reports findings from a series of six interviews with CISO stakeholders and applies the analysis steps outlined in Eugene Bardach’s eightfold policy analysis approach, framed through SWOT categories.

Sep 13, 2026

Uploaded by Nguyễn Văn Học