External CISO: Who Actually Manages Your Organization's Cyber Risk?

Who is responsible for information security in your organization? In many organizations the answer comes quickly: "the IT person". Or: "our IT provider".

But when you keep asking a few more questions, the picture gets more complicated:

• Who presents cyber risks to management?
• Who decides which risk needs immediate attention?
• Who reviews the vendors?
• Who makes sure findings from a risk assessment are actually closed?
• Who keeps track of permissions?
• Who connects ISO 27001, customer requirements, cyber insurance, infrastructure and business activity?

This is where the difference between IT management and information security management begins.

IT people need to make things work

IT has a vital role. A user needs a computer. A system needs to run. The VPN needs to connect. A server needs to be available. An issue needs to be fixed. These are critical tasks for the business.

But information security sometimes asks different questions:

• Does the user actually need this permission?
• Is remote access configured in a way that fits the risk?
• Does the data the vendor holds require additional controls?
• What would it mean for the business if a certain system went down?
• Is management aware of the risk?

IT and cyber meet all the time, but they are not the same thing.

Cyber is already a management issue

A cyber incident is not measured only by the number of computers affected. It can affect revenue, customer service, contractual obligations, privacy, reputation, insurance, vendors and business continuity. That is why cyber decisions are also business decisions.

If reducing a certain risk requires a significant investment, someone needs to explain to management: what is the risk? How likely is it? What is the impact? What are the alternatives? And what happens if we decide not to address it right now?

That is not a conversation to have in terms of firewall product names. Technology has to be translated into business risk.

Who connects all the pieces?

An organization can have excellent products: a good firewall, EDR, backup, Microsoft 365, MFA and a professional IT provider. And still be left with a question: who looks at all of it together?

• Who makes sure the gap found six months ago was actually fixed?
• Who reviews a significant system change before it goes live?
• Who checks whether a new vendor creates risk?
• Who is responsible for turning the risk assessment into a work plan?

When no one owns the whole picture, information security can become a collection of actions that do not necessarily add up to one strategy.

Not every company needs a full-time CISO

In a large company, a full-time CISO may be a clear need. But what about a business with 30, 70 or 150 employees?

The risks exist. Customers may demand security. The systems matter. The data is sensitive. But hiring a senior full-time information security manager is not always justified. An external CISO service gives the organization a professional function that matches its scale of activity and risk.

An external CISO is not "a consultant who shows up once a quarter"

An effective service has to connect risk management with real work:

• Follow-up and prioritization.
• Discussions with management.
• Working with IT.
• Vendor oversight.
• Involvement in changes.
• Regulation and standards, such as ISO 27001, where relevant.
• Incident preparedness.
• Policies and procedures.

The goal is for information security to have an owner.

And what happens when there is no owner?

Usually, no immediate disaster. That is exactly the problem.

Gaps build up slowly. Users receive permissions. Vendors connect. New systems come in. Exceptions become permanent. A review gets postponed. A finding stays open. Each action on its own seems small. Two years later, the organization looks different.

External CISO with Marom Cyber

Marom Cyber helps organizations manage information security as an ongoing business process: connecting management, IT, vendors, standards, risks and the work plan. It is part of our information security and cyber advisory services.

Frequently asked questions