{"id":53072,"date":"2023-08-04T14:00:00","date_gmt":"2023-08-04T14:00:00","guid":{"rendered":"https:\/\/www.darkreading.com\/vulnerabilities-threats\/how-to-talk-so-your-ciso-will-listen"},"modified":"2023-08-04T14:00:00","modified_gmt":"2023-08-04T14:00:00","slug":"how-to-talk-so-your-ciso-will-listen","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/how-to-talk-so-your-ciso-will-listen\/","title":{"rendered":"How to Talk So Your CISO Will Listen"},"content":{"rendered":"
<\/div>\n

All chief information security officers are not created equal. Like the rest of us, each has their own areas of expertise and their own interests. And these differences could have a major effect on how they respond to your request or idea.<\/p>\n

When cybersecurity was considered a technology issue, CISOs tended to have IT backgrounds. This hasn’t been true for quite some time, however, as enterprises digitize, and the legal and business ramifications of security breaches can have a tremendous impact on other areas of an organization’s operations.<\/p>\n

Before you approach your company’s CISO<\/a>, it’s important not only to do your research about the project you’re proposing and to marshal support from elsewhere in the company \u2014 critical for success with any new endeavor \u2014 but also, especially, to understand which type of CISO you’re dealing with.<\/p>\n

Because, to communicate effectively with your CISO<\/a>, you’ll need to speak their language.<\/p>\n

Different Strokes for Different CISO Folks<\/h2>\n

While there are almost certainly as many types of CISO as there are CISOs, I’ve narrowed them into three categories:<\/p>\n

1. The Business CISO.<\/strong> This person considers the effects of security purchases, decisions, and breaches on the entire business. This type of CISO tends to focus on revenue, cost savings, reputation, and efficiency. They’re also more likely to work in concert with other C-suite members, and to consult with them while considering your request.<\/p>\n

Questions they might have include:<\/p>\n