BSides Austin 2018

We have heard for years that the role of the CISO is moving into the executive suite, but it is perpetually held back by historical connections to the CIO, constraints to the CIO budget, and the technical foundation necessary for a CISO. Lately a new model has emerged from high-governance organizations to split risk management and compliance (termed the 2nd line of defense) from technical operations, risk ownership, and business-line-level responsibility (termed the 1st line of defense). Progressive organizations requiring more advanced digital risk management recognize the need to move cyber risk management into the second line of defense, and are taking steps necessary to mature cyber risk management into the executive suite.