CISO: a key job within the business for system security

Project governance almost systematically requires a steering committee. Small or large companies need to benefit from an optimal level of security so that the data integrated in the various work software programs benefit from absolute confidentiality. The use of an information systems security manager (ISSM) is the most appropriate solution. This professional, specialized in IT security issues, and always aware of the latest trends in cybercrime and cybersecurity, is empowered to educate and train employees to ensure the security of computer and telecommunications systems in the various departments of the company. The CISO is usually attached to the company’s information systems department or general management.

The role of the CISO

Stages of intervention of the CISO

To give you an overall picture of the different stages of work carried out by the CISO who ensures the security of IT devices, here is an overview of the main tasks that fall within his or her professional remit:

• Define system security policy: determine objectives and requirements, and draw up appropriate procedures.
• Identify and analyze risks: assess threats and consequences, study available means of protection, draw up a prevention plan.
• Monitor the implementation of projects designed to limit the impact of threats on the company’s business.
• Preventing and training employees in information systems security: awareness-raising and training for management, help in drawing up a security rule book, Council and assistance for teams.
• Supervise the safety tools put in place: check that the safety policy drawn up is consistent with the initial plans, check that the protocol is applied and that company staff comply with safety rules.
• Follow-up on necessary changes: readjust security instructions if necessary, ensure the physical and logical security of all the company’s information systems.
• Limit access to strategic and strictly confidential information networks.
• Monitor technological developments in cybersecurity and cybercrime.

To carry out all these steps in a cyclical manner and ensure the continuous improvement of IS security, the CISO can rely on the PDCA(Plan Do Check Act) method.

The essential skills of the CISO

The job of computer security systems manager requires a certain number of qualities and skills that allow him to perform his job effectively. Here is an overview of the main skills required:

• Rigor and organization are required to identify the safety measures to be implemented and to ensure that company employees comply with procedures.
• Pedagogy is essential for raising awareness or providing training and Council to the company’s various teams and departments.
• Curiosity, particularly in terms of cybersecurity news and new technologies, is essential to better understand and anticipate existing and future threats.
• Good communication and listening skills enable us to better adapt to different interlocutors, so that we can pass on the expected level of information in an objective and professional way to all levels of the company.
• Good stress management is necessary in order to be able to deal with the threats and problems encountered.

Training to become a CISO

To become a computer security systems manager, it is necessary to have graduated from an engineering school or to hold a professional master’s degree in the field of computer science and networks. A degree or certification in cybersecurity or ISO 2700X standards may also be required.

Also read in our "IT project governance" file:

• Lowcode platform: the future of application development?
• The use of UIPATH as an RPA solution
• Project comitology: the governance bodies of an IT project and their roles
• Steering and governance of a Finance IS project: which profiles should be involved?
• Steering and governance of an IT project: which profiles should be involved?
• Project governance: what role for the steering committee?
• The actors of a project team: organization, role and skills
• The IS manager at the heart of the development and evolution of systems
• HRIS Manager: what role in the evolution of HR Information Systems?
• IS project manager: what role and responsibility in an IS project?
• Functional consultant: a role close to the business processes
• Technical consultant: a profession at the heart of technological development
• Solution architect: a profession that manages development and deployment
• DevOps Consultant: role, missions and development skills
• Data Protection Officer (DPO): what roles and missions?
• CISO: a key job within the business for system security
• The service delivery manager at the heart of team management
• Scrum master, a key profession for Scrum project management
• Data scientist: a strategic profession at the service of management
• MOA / MOE: how are the roles divided on a project of implementation of an information system?