Security all-rounder CISO: Outsource or hire yourself?

It has been 30 years since the financial services giant Citigroup (formerly Citicorp) set up a special office for cyber security following a series of cyber attacks by Russian hackers. 1994 is therefore considered the year of birth of the profession of Chief Information Security Officer. Today, three decades after the emergence of the first CISO, almost every major company has a cybersecurity specialist. Cybersecurity Ventures explains that there are currently around 32,000 CISOs worldwide. However, with an estimated 334 million companies, it quickly becomes obvious: Many other companies and organisations are yet to staff such a position – no matter how important it may be. This may be due to size, lack of expertise or budget constraints, or because CISO support is needed immediately: A full-time CISO is desirable for many companies, but not always realisable or affordable. Sometimes CISO tasks are also distributed among several IT employees, which harbours risks if there is insufficient knowledge. In such cases, a virtual CISO or an outsourced CISO (CISO-as-a-Service) is a good alternative.

A Chief Information Security Officer plays a central role in ensuring the security and integrity of an organisation’s information assets, of course. Nevertheless, due to the large number of tasks, it is worth listing the main areas of responsibility.

CISOs are:

• Experts in risk management: This includes the identification, assessment and prioritisation of cyber security risks and vulnerabilities. It also involves developing risk mitigation strategies and recommending appropriate security controls and countermeasures.
• Guardian of information security policies and procedures: This involves developing, implementing and enforcing information security policies, standards and procedures throughout the corporate structure. After all, all major laws, regulations and industry standards must be adhered to.
• Incident response chiefs: CISOs develop and maintain plans on how to respond to data breaches in order to contain and mitigate security breaches. They also lead incident response teams in investigating security breaches, determining root causes and implementing defences.
• Security architects: The design, implementation and maintenance of a robust security architecture and infrastructure to protect the systems, networks and data within a company are also part of the CISO’s catalogue of tasks. He or she evaluates security technologies and selects tools to support the security objectives. In some cases, it is advisable to set up an Information Security Management System ((link to ISMS)) in accordance with ISO standard 27001.
• Security trainers: CISOs promote security awareness and best practices within the workforce, contractors and other stakeholders. This includes the development of cyber security training to raise awareness of security risks.
• Compliance controllers: They develop security management frameworks and mechanisms to ensure effective monitoring. They conduct regular security assessments, audits and reviews to verify compliance with internal policies and external regulations.
• Third-Party Risk Managers: CISOs assess the security posture of vendors, suppliers and third-party service providers to ensure they meet the organisation’s security standards and requirements. They establish contractual agreements and monitoring mechanisms to effectively manage third-party security risks.
• Communication specialists: Timely and transparent communication of security incidents, threats and vulnerabilities to senior management, management and stakeholders is also important, as are regular reports on the security situation within the organisation.
• Trend checker and trailblazer: CISOs must always be aware of new threats, trends and technologies in the field of cyber security in order to adapt and improve security measures. They should also drive innovative projects to take the fear out of future security challenges.

It is obvious that every company would like to have such a security all-rounder in its ranks. However, as this is often not possible for the reasons mentioned, it is worth requesting external support: CISO-as-a-Service.

The advantages of external CISO support over a permanent Chief Information Security Officer are summarised in the following “CISO-as-a-Service Top Six”.

CISO-as-a-Service scores with:

• Flexibility: External CISO services are more flexible in terms of the scope and duration of services. CISO support can be scaled as required and additional resources can be added or reduced. This is particularly practical in times of increased security requirements or when implementing specific projects.
• Expertise: External CISO services offer access to a pool of experienced experts. Companies can benefit from in-depth experience and have access to specialised skills that an internal CISO does not have.
• Continuity: External CISOs keep up to date with current threats, trends and best practices. They can ensure that security policies and practices are continuously improved and adapted to the changing threat landscape without the need to divert internal resources.
• Objectivity: External staff ideally provide an objective and independent view of an organisation’s security practices. They are not involved in internal political dynamics and can therefore make decisions based on best practices and objective analyses.
• Cost efficiency: External CISO services can be more cost efficient as organisations only pay for the services actually provided. Permanent CISOs receive a fixed salary, benefits and possibly bonuses, regardless of whether their performance is fully utilised or not.
• Resource optimisation: External CISO services allow companies to free up internal resources for other strategic tasks and business objectives.

External CISO services are a cost-efficient, flexible and effective option to fulfil growing information security requirements. This is especially important when there are no resources or experience available for a permanent CISO. They are suitable for acute needs – onboarding new employees takes longer than hiring an external service – and as an interim solution. Whether SMEs or start-ups, smaller companies and companies in the process of being established benefit from the expertise of experienced CISO providers – and protect their valuable data and systems reliably.

If you would like to find out what CISO-as-a-Service can look like in day-to-day business, read our Success Story “CISO-as-a-Service for Steeltec Group“. The Swiss steel manufacturer relies on CISO-as-a-Service from Swiss IT Security AG. This includes, for example, the creation of a security roadmap, the coordination of various departments and the design of a remote access solution for the devices in the plant.