A chief information security officer

A chief information security officer (CISO) is the senior-level chief within a company liable for building up and maintaining the enterprise vision, system, and program to guarantee data resources and technologies are sufficiently ensured.

The CISO coordinates staff in finding, developing, executing, and maintaining measures over the enterprise to decrease data and Information Technology (IT) risks. They react to incidents, set up proper guidelines and controls, manage security technologies, and direct the foundation and execution of policies and procedures. The CISO is also generally liable for data-related compliance (for example oversees the execution to accomplish ISO/IEC 27001 certification for a substance or a part of it).

Typically, the CISO's impact reaches the whole company. Duties may incorporate, however, not be restricted to:

• PC crisis reaction team/PC security incident reaction team
• Cybersecurity
• Disaster recovery and business progression management
• Identity and access management
• Data security
• Data administrative compliance (e.g., US PCI DSS, FISMA, GLBA, HIPAA; UK Data Protection Act 1998; Canada PIPEDA, Europe GDPR)
• Data risk management
• Data security and data assurance
• Information security operations centre (ISOC)
• Information technology controls for budgetary and different systems
• IT investigation, digital forensics, eDiscovery