Strategic CIO // Executive Insights & Innovation
Commentary
7/7/2014
09:06 AM
Mansur Hasib
Mansur Hasib
Commentary
Connect Directly
Twitter
RSS
E-Mail

Don't Set The CISO Up To Fail

More healthcare organizations are hiring CISOs -- a good thing. But bad management structure, insufficient resources, and poor understanding of risks often doom these newly appointed security executives.

(Source: Impact of Security Culture on Security Compliance in Healthcare in the USA by Mansur Hasib, 2013)

(Source: Impact of Security Culture on Security Compliance in Healthcare in the USA by Mansur Hasib, 2013)

Comment  | 
Print  | 
Comments
Newest First  |  Oldest First  |  Threaded View
mhasib
50%
50%
mhasib,
User Rank: Author
7/30/2014 | 9:35:16 PM
Re: Re : Don't Set The CISO Up To Fail
@Sunita - good point. The CISO role is greatly misunderstood in healthcare. People and even some healthcare CIOs in organizations where most of the IT work is outsourced do not understand the role of the CISO. In one such organization where they were paying the CIO in the 700K range wanted to hire a CISO at the 140K range. Even the reporting relationships did not make sense. 
SunitaT0
50%
50%
SunitaT0,
User Rank: Ninja
7/29/2014 | 4:47:37 PM
Re: More Than Words
@Alison: I second that. Security is indeed part of your organization?s culture and should always be valued first. Even the higher tier officials like CEO and CFO should always be informed about the working security of the company, no matter how little it is.
SunitaT0
100%
0%
SunitaT0,
User Rank: Ninja
7/29/2014 | 4:47:08 PM
Re : Don't Set The CISO Up To Fail
Cyber Security Most organizations rely on a third party company for their cyber security. Some companies invest little budget for their cyber security and do not keep track of it. Most of the upper level engineers working in a specific department are not knocked every time someone hits a dead end in cyber security. This enlarges the problem, since if senior engineers don?t know what kind of security they?ll be getting, they would continue their work on that specific software, compromising the database.
Alison_Diana
50%
50%
Alison_Diana,
User Rank: Author
7/8/2014 | 9:20:12 AM
More Than Words
In one way, it's encouraging to learn that more healthcare organizations recognize they must hire a c-level executive to oversee security, realizing security responsibility is more than the CIO can take on. On the other hand, your points about management structure resonate -- and I would imagine many CIOs and CISOs who find themselves in the position you describe (where they report to the CFO or other non-CEO exec) are nodding their heads in frustration and agreement with your points about salary, responsibility, and the burdens they face.

The best organizations in any vertical appear to have realized that security extends far beyond technologies and processes; rather, security is part of their culture and as the leader of all facets of security, the CISO is a key part of the organization's leadership team. S/he is integral to pretty much every aspect of that organization's future growth, measuring risk vs reward, and cannot be seen as lesser to the CFO or any other c-level exec.
The Business of Going Digital
The Business of Going Digital
Digital business isn't about changing code; it's about changing what legacy sales, distribution, customer service, and product groups do in the new digital age. It's about bringing big data analytics, mobile, social, marketing automation, cloud computing, and the app economy together to launch new products and services. We're seeing new titles in this digital revolution, new responsibilities, new business models, and major shifts in technology spending.
Register for InformationWeek Newsletters
White Papers
Current Issue
InformationWeek Tech Digest, Dec. 9, 2014
Apps will make or break the tablet as a work device, but don't shortchange critical factors related to hardware, security, peripherals, and integration.
Video
Slideshows
Twitter Feed
InformationWeek Radio
Archived InformationWeek Radio
Join us for a roundup of the top stories on InformationWeek.com for the week of December 14, 2014. Be here for the show and for the incredible Friday Afternoon Conversation that runs beside the program.
Sponsored Live Streaming Video
Everything You've Been Told About Mobility Is Wrong
Attend this video symposium with Sean Wisdom, Global Director of Mobility Solutions, and learn about how you can harness powerful new products to mobilize your business potential.