3 steps to help new CISOs to hit the ground running

Today’s chief information security officers face rampant cyber threats, an expanded attack surface and the pandemic-related explosion of remote workers connecting to agency networks from everywhere. As the  purview of CISOs has grown in recent years, these committed individuals shoulder the responsibility for managing new and increased risks to keep their governments secure. 

New CISOs have no time to waste. Whether they are just starting with their organization or promoted from within, focusing on several foundational steps will help them maximize their first few months on the job and accelerate their implementation of a successful security plan.

1. Assess the current environment 

The first thing a new CISO should do is conduct a thorough assessment of the existing situation: the good, the bad and the ugly. A 90-day self-guided audit of people, process, policy and technology will shine a light on what systems are already in place, what controls exist and what capabilities exist to enforce those controls. They should also identify the “technical debt” so they can incorporate those costs into the strategic direction.  One more priority is to clearly identify and codify meaningful metrics -- for both reporting to executive leadership as well as for measuring operational effectiveness.  

This is the right time  for CISOs to conduct a tools rationalization to identify where there is overlap, where there may be over- or under-investment and what will be required to ensure the right tools for the right job are in place. They should look at installed tools like security information and event management (SIEM) technology and data loss prevention tools to find out if they’re being correctly employed -- and if they’re even the right solution for the issue to be solved. This kind of rationalization activity gives CISOs the opportunity to simplify the technology stack, saving dollars that can be more efficiently redeployed. 

Depending on their bandwidth and domain expertise, CISOs may find it makes sense to engage external resources to help with this assessment. They should look for independent domain experts who can be trusted to render an objective opinion as CISOs execute their security plans.  Because new CISOs will face difficult decisions that are not easily reversed, a good partner can help them sift through the plethora of solutions to find the ones that best meet an agency’s unique needs.

Resourcing will also typically be an issue. In government as well as the private sector, cybersecurity professionals are scarce and costly, so there may be talent gaps to overcome. CISOs should use this time to talk to their team and evaluate their skills, gaps and training needs to help them identify their passion and match it to their talent, professional goals and needs of the team. When CISOs seek new candidates, they should look for those who believe in public service, have a strong desire to help drive the agency vision and desire a challenging work environment that will help them grow professionally.

An assessment also presents a great opportunity for CISOs to learn about workflow pain points -- where staff spends their time and how and where automation can help. Technologies like artificial intelligence, machine learning, robotic process automation and virtual security operation centers can reduce the staff burden of high-touch activities like incident response. 

2. Explore all available financial options

Once the assessment phase is complete, CISOs can then lay out a multiyear plan to execute – first understanding their capabilities to invest in that plan. While budgets are always tight, right now multiple funding sources to support cyber requirements are available. CISOs will want to correctly leverage federal funding, such as the State and Local Cybersecurity Grant Program and the Infrastructure Investment and Jobs Act that includes protections for systems like supervisory control and data acquisition systems that monitor water and power generation. Grants like the Enabling Middle Mile Broadband Infrastructure Program from the National Telecommunications and Information Administration offer CISOs an opportunity to build creative links between such resources and the outcomes they need from their security posture. 

Local legislators may be willing to allocate precious dollars as well. Cybersecurity is a hot topic, and there may be more openness from these officials to support what is increasingly seen as in the best interest of their constituents. While infrequent, there are even opportunities for public-private partnerships, so CISOs should keep an eye out for them. 

It is certainly more complicated to pursue multiple funding sources, but with more resources available now than ever before, it’s worth the effort.

3. Build trust among stakeholders and constituents 

New CISOs should build trust not only with direct colleagues but also with other government agencies that might otherwise be federated. It’s especially important to build a trusted relationship with the CIO so cybersecurity challenges can be tackled collaboratively. CISOs that take the time to assess the environment before making significant changes will further build trust with their team – developing buy-in to the vision and any changes to the strategic objectives.

As CISOs start to push out new citizen-centric services, they must also nurture constituent trust. With growing data breaches and privacy concerns, CISOs must balance privacy protection with the functionality and capabilities of systems made available to citizens. 

It is a big job – and an exciting opportunity to lead cybersecurity in government environments. There is much for new CISOs to do to fast-track their strategic plans, deal with the needs of the day and ultimately move the needle to reduce risk. It requires quickly assessing the situation, establishing cohesive, strategic objectives and acting intentionally on a path they are confident in.

Yes, there will be trials and challenges, but with good planning, the right resources and trusted partners new CISOs can have some fun and make their agency a great place to work while keeping stakeholders and citizens safe.