CIOs and CISOs – a modern power struggle?

Cor­po­rate cyber chiefs are high in demand, but many still report into chief infor­ma­tion offi­cers (CIOs). With cyber threats on the rise, some secu­ri­ty lead­ers want greater clout. 

Chief infor­ma­tion secu­ri­ty offi­cers (CISOs) are earn­ing more than ever as demand for qual­i­fied secu­ri­ty lead­ers push­es up salaries. How­ev­er, many still work under IT lead­ers, usu­al­ly CIOs, large­ly because secu­ri­ty pro­fes­sion­als have a tech­ni­cal back­ground and this fits nat­u­ral­ly under the CIO remit.

But with cyber threats increas­ing in fre­quen­cy, scale and sophis­ti­ca­tion, some secu­ri­ty lead­ers are no longer inter­est­ed in a C‑suite role where they’re mere­ly a branch of the IT team, and fear they lack the agency they need to real­ly make a dif­fer­ence.

So how can CIOs best man­age this rela­tion­ship and deal with any poten­tial ten­sion? 

“The best thing the CIO can do is use the strength of their seat to empow­er and sup­port the per­cep­tion of the CISO role across the com­pa­ny,” says Joan­na Burkey, CISO at HP Inc. “In the best rela­tion­ships, the CIO is 100% sup­port­ive of the CISO and main­tains a strong, unit­ed front on secu­ri­ty top­ics. There might be healthy debate in the back­ground, but that is han­dled appro­pri­ate­ly and pri­vate­ly.”

Paul Shaw, group secu­ri­ty offi­cer at media and dig­i­tal mar­ket­ing com­mu­ni­ca­tions com­pa­ny Dentsu, says CISOs that are unable to engage peers or secure bud­get often blame report­ing lines and assume they would be more suc­cess­ful if they report­ed into the CEO.

“My belief is such a move is not the solu­tion; those com­pa­nies either have the wrong per­son in the CISO role, or the wrong per­son in the exec­u­tive team posi­tion they are report­ing to,” he says. “I don’t think it is wrong to have the CISO report­ing into the most senior IT/Technology role as long as that per­son has the right breadth of respon­si­bil­i­ty and is a mem­ber of the exec­u­tive lead­er­ship team.”

Indeed, says Shaw: “If the CIO does not under­stand the impor­tance of secu­ri­ty and is not invest­ed in sup­port­ing a secu­ri­ty agen­da, the com­pa­ny has the wrong CIO. Equal­ly, if the CISO does not under­stand the com­mer­cial real­i­ties of the busi­ness and the bal­anc­ing act the CIO needs to do with bud­gets and resources, the com­pa­ny has the wrong CISO.”

But as long as the roles are held by mature indi­vid­u­als, it’s just the same as any oth­er rela­tion­ship, Shaw notes, with the same desire for mutu­al suc­cess. 

Showing empathy

Sharon Man­dell, CIO at tech­nol­o­gy firm Juniper Net­works, believes CIOs need to empathise with senior cyber exec­u­tives.

“Be sup­port­ive because they have it at least as tough as you do,” she says. “In IT we often think we have the impos­si­ble job, but the real­i­ty is it’s even more chal­leng­ing right now to be the CISO. They have nation states, crim­i­nal rings and a bil­lion dol­lar plus indus­try – ran­somware – aimed at mak­ing them fail,” she says.

Man­dell says the CIO must not only sup­port the CISO in one-on-one set­tings, but help the broad­er organ­i­sa­tion under­stand the chal­lenges they face. “The CIO should be mak­ing it clear that secu­ri­ty is everyone’s respon­si­bil­i­ty, not just the CISO’s or the secu­ri­ty team’s,” she says.

Cru­cial­ly, Man­dell says that while Juniper Net­works’ CISO reports to her, when it comes to mat­ters of secu­ri­ty, she works for the CISO, not the oth­er way around. 

The CEO must be con­fi­dent that their CIO is trans­par­ent about what is going on under­neath them, can live with the impli­ca­tions that the organ­i­sa­tion might face if some­thing goes wrong and will own the respon­si­bil­i­ty if it does. 

“If the CEO can’t get that con­fi­dence, they should have the role report some­where else.”

A change of report­ing?

So could it be in the CIO’s best inter­est – and the best inter­ests of the com­pa­ny – to allow com­plete agency for the CISO?

In many ways, the par­tic­u­lar set­up doesn’t real­ly mat­ter, says Dun­can Brown, vice-pres­i­dent of Euro­pean Enter­prise Research, IDC. What is increas­ing­ly impor­tant, he says, is that secu­ri­ty – and cyber threats in par­tic­u­lar – are giv­en the vis­i­bil­i­ty and pri­or­i­ty they deserve.

“If the CIO can pro­vide this and gar­ner board lev­el sup­port, then the rela­tion­ship should work just fine. Equal­ly, if that sup­port can be pro­vid­ed by anoth­er senior exec­u­tive, such as a head of risk or chief oper­at­ing offi­cer, then again this should work.”

Brown says the obvi­ous solu­tion is for the CISOs them­selves to report at board lev­el. But while we’re see­ing more exam­ples of this, it’s still far from com­mon prac­tice.

“Secu­ri­ty is large­ly a tech­ni­cal sub­ject and explain­ing it to board lev­el exec­u­tives requires a par­tic­u­lar set of com­mu­ni­ca­tion skills that many secu­ri­ty pro­fes­sion­als do not have,” he explains. “In addi­tion, it requires an under­stand­ing of the busi­ness impact of secu­ri­ty threats, rather than a focus on the threats them­selves.”

Organ­i­sa­tion­al hier­ar­chy is less impor­tant than ensur­ing the CISO has the appro­pri­ate plat­form in the com­pa­ny, Burkey argues.

“If the com­pa­ny cul­ture is such that the CISO isn’t lis­tened to or is not allowed to work out of the ‘IT bound­aries’, there are some fun­da­men­tal issues at play that need to be bet­ter under­stood and accept­ed, with­out the assump­tion that ‘just’ a report­ing change would fix them,” she says.

Like any work­ing rela­tion­ship, there is noth­ing unique about this poten­tial con­flict. The goal is empow­er­ing pro­fes­sion­als to work togeth­er to embed secu­ri­ty through their organ­i­sa­tion. This is a shared respon­si­bil­i­ty – with a shared focus on the busi­ness – where each knows the impor­tant role they play.