Top-performing CISOs reserve time for professional development

Just below 70% of the top-performing chief data safety officers (CISOs) dedicate recurring time for professional development on their work calendars in comparison with simply 38% of their bottom-performing counterparts, in keeping with the outcomes of a three-year research of greater than 225 CISOs carried out by analysts at Gartner.

In a report titled Key behaviours driving CISO effectiveness, Gartner set out 5 habits that it believes are held in frequent by probably the most extremely efficient CISOs. On common, mentioned the analysts, every of those behaviours is not less than one and a half occasions extra prevalent among the many prime performing CISOs than it’s among the many backside performing.

“As the CISO role continues to rapidly evolve, it becomes even more critical for security and risk leaders to protect time for professional development,” mentioned Chiara Giradi, senior principal, analysis at Gartner.

“Developing new skills and knowledge as the role changes is essential to effectively serve as a strategic advisor to the business – the new CISO paradigm.”

The analysts discovered these performing on the prime of the sport devoted time and vitality to initiating discussions across the evolving cyber safety panorama to remain forward of threats, with 77% of the highest performers doing this in comparison with 50% of the underside performers.

“No organisation can be fully protected against every cyber threat,” mentioned Girardi. “The most effective CISOs stay apprised of existing and emerging risks so they can provide leadership with context around the most significant threats facing the business, to influence investments and risk decisions accordingly.”

The prime CISOs additionally spent time securing rising expertise, akin to synthetic intelligence (AI), blockchain and machine studying, with 63% of the highest performers doing this in comparison with 38% of the underside performers.

Girardi mentioned many CISOs have been nonetheless behind the curve when it comes to assessing the danger impression of recent expertise, particularly generative AI, given the enthusiastic take-up of such tech amongst menace actors for functions akin to crafting convincing phishing lures.

She added that CISOs usually wanted to be extra proactive when it got here to understanding the impression of generative AI and speaking these dangers with senior enterprise management.

Indeed, constructing relationships and speaking brazenly with different senior decision-makers within the organisation was one of many habits that top-performing CISOs engaged in to a larger diploma than the bottom-performers – 65% of the best CISOs did this in comparison with 37% of the least efficient.

Crucially, these relationships paid off extra when developed outdoors of the context of ongoing IT or cyber safety initiatives, and the CISOs Gartner discovered to be handiest met with thrice as many non-IT stakeholders – akin to heads of human assets, advertising and marketing, gross sales, and many others – than IT stakeholders.

Moreover, the best CISOs outlined their organisations’ threat urge for food via collaboration with different decision-makers and features of enterprise (LoBs) – 67% of the top-performers did this in comparison with 28% of the bottom-performers.

Girardi added: “Non-IT capabilities are key companions that may take expertise and cyber safety choices outdoors of IT.

“By setting aside dedicated time to build relationships with senior business decision-makers across the organisation, CISOs can cultivate an environment where decision-makers understand and care about cyber security, as well as consider cyber security implications in their decision making,” she concluded.

Read extra on Business continuity planning

• The nature of the CISO position might be in flux in 2023

  

  By: Alex Scroxton

• Ideal CISO reporting construction is to high-level enterprise leaders

  

  By: John Burke

• Cyber-war recreation case research: Preparing for a ransomware assault

  

  By: Johna Johnson

• Australian CISOs least ready for cyber assaults

  

  By: Aaron Tan