CISO
CISO · Chief Information Security Officer · head of information security · virtual CISO · vCISO · RSSI
The Chief Information Security Officer: the person who sets an organisation’s cybersecurity strategy, steers its security risks and advises senior management.
In practice
In France the role is known as RSSI. The CISO writes and maintains the information security policy, runs risk analysis, awareness training, audits and incident management, and reports to management. No general law requires companies to appoint one, but NIS2 and DORA make management bodies accountable for cybersecurity, which calls for a clearly identified function to advise them. To stay independent, the CISO is better off not reporting to the IT department whose choices they are meant to challenge. In an SME, the role can be filled part-time by an outsourced, “virtual” CISO.
Fictional case: an 800-employee manufacturer appoints a CISO reporting to the CEO. Their first move is not to buy a tool: they present the executive committee with the five scenarios that could halt production, each with a budget.
