3 Key Insights from Candid Conversations with Fortune 100 CISOs

Cybersecurity Challenges and Changing Regulatory Compliance Landscape: Insights from Fortune 100 CISOs

Federal Regulations and Agencies

Chief Information Security Officers (CISOs) across industries have a complex relationship with regulatory agencies. Governments are increasingly sharing recommendations and creating regulations to bolster cybersecurity strategies. It is crucial for organizations to establish relationships with federal agencies before experiencing a breach. Having connections with key agencies relevant to their industry helps CISOs understand whom to contact in the event of a security incident.

CISOs who had already cultivated relationships with relevant agencies were able to navigate the incident response process efficiently and effectively. As the regulatory compliance landscape evolves, it’s essential for CISOs to stay updated on regulatory requirements. Some regulations require organizations to periodically disclose information about their cybersecurity practices. For instance, the General Data Protection Regulation (GDPR), the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), and the National Credit Union Administration (NCUA) necessitate organizations to disclose information about a material cybersecurity incident within 72 hours, while the Securities and Exchange Commission (SEC) allows 96 hours. This means that robust incident response plans must be in place to swiftly determine and address any breaches.

CISOs anticipate that the upcoming Cybersecurity Maturity Model Certification (CMMC) will significantly impact prime contractors for Department of Defense contracts. Prime contractors are responsible for ensuring that their subcontractors meet the appropriate CMMC level for their work. Smaller subcontractors must be prepared to answer the extensive questions and meet the required controls. CISOs in both public and private industries acknowledge the inevitability of these changes. They are striving to strike a balance between implementing the necessary protections to meet regulations while being ready to report promptly in the event of a significant incident.

Hiring Challenges and Opportunities

As cybersecurity challenges continue to evolve, a shortage of qualified personnel in the workforce is growing. Research by (ISC)2 indicates a global workforce gap of 3.4 million cyber professionals in 2022. This shortage persists despite increasing risks, new regulatory requirements, and the adoption of new technologies by organizations. The hiring challenges faced by CISOs can be summarized as follows: finding the right talent is difficult, and organizations are also seeking to increase diversity within their teams.

In Florida, however, CISOs have found some relief in filling open roles due to many people relocating to the area during the pandemic. To overcome the challenge of acquiring all the talent they need, CISOs are turning to automation. Security teams are inundated with vast amounts of data as the technology landscape evolves and new tools emerge. CISOs and security leaders are looking to automation to help their teams sort through this data and identify critical areas of focus. They are seeking artificial intelligence (AI) and machine learning (ML) technologies to facilitate more efficient and effective protection of data, infrastructure, and organizations.

CISOs Role and D&O Insurance

Massive breaches, such as the ones exposing the data of over 50 million customers at Uber, have sparked conversations about the role of CISOs and whether they require Directors and Officers (D&O) insurance. For instance, Joseph Sullivan, the former CISO at Uber, was ordered to pay a fine and complete community service and probation for his role in the 2016 breach. While some see it as a broader security failure and cautionary tale for CISOs in their position among the corporate executive team, others argue that Sullivan misrepresented the situation and held greater responsibility.

These incidents highlight the need for a review of the CISO role and its reporting relationship with the executive team and board. CISOs now bear significant responsibility for their organizations’ reputation and success. Many believe it is time to require D&O insurance as part of their cybersecurity leadership role, similar to the rest of the executive team.

What’s Next?

Looking ahead, CISOs are heavily concerned with increasing regulations and the need to comply with them. Security leaders must prioritize the most vital controls and align them with a compliance framework. This helps secure the necessary budget to establish an effective cybersecurity program that incorporates automation, AI, ML, and cybersecurity talent to meet the challenges on the horizon.

Ultimately, the goal is to minimize the need for D&O insurance coverage by proactively implementing robust cybersecurity measures and practices.

Keywords: CISO, cybersecurity, Fortune 100, regulations, hiring challenges, automation, AI, ML, D&O insurance