The CISO Mentor

key component to this is ensuring they are well resourced with
headcount and initiative funds to ensure your organization is well
protected against an agile and ever-evolving cyber threat adversary.
No longer will the month- or year-long horizon be your limit. You
should now be focused on multi-year strategies and ensuring
continued organizational support, culturally and financially.
Practical Application: The Board of your manufacturing firm
is interested in increasing revenue by ensuring customers have inhouse
options to finance their large purchases. The decision has
been made to purchase a financial services firm to implement just
such an option. As CISO, you’ll need to strategically plan for the
impact to your current team. What are the differences in regulation
with a financial services firm? How should the information security
team be aligned in your current organization, post-acquisition? What
capabilities do you now have that can take the place of the acquired
team’s capabilities? How mature is the new team? All of these
questions force key strategic decisions that you’ll need to make, and
then convince the Board to agree to, in order to make the acquisition
successful. As an example, since you’ve become a trusted leader in
the firm over the years, you successfully argue that you need
additional resources focused on financial systems compliance, as
well as a deputy CISO whose job is to act as the CISO of the newly
acquired firm.
13